Kuuko / Build it yourself

Build it yourself · Part 1Checked: 30 October 2026 · tested on iPhone

Chapter 8: Your iPhone and Mac

Why

Your server is ready. Now your devices need to use it: for every app and every browser, encrypted, without any extra app. A small configuration file, a "profile", tells iPhone and Mac where your resolver is.

This kind of profile has an end date. Apple lists it as available up to iOS 27 and macOS 27, and its replacement is meant for company device management, not for a profile you install yourself. It still installs and works: we tested it on iOS 26.2.1. When Apple removes it, a small app of your own is the way left (see "Going further").

What you need

  • Your server's IPv4 and IPv6 addresses (chapter 3), your domain, and your private path (chapter 4).
  • Your Mac, to write the file.
  • About 20 minutes (our estimate).

Steps

1. Two unique IDs

Every profile needs two IDs of its own. On your Mac:

uuidgen
uuidgen

Keep both results; below they're <uuid-1> and <uuid-2>.

2. Write the profile

Create a file named my-dns.mobileconfig (for example with TextEdit, as plain text) and paste, with your own values:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>PayloadContent</key>
  <array>
    <dict>
      <key>DNSSettings</key>
      <dict>
        <key>DNSProtocol</key>
        <string>HTTPS</string>
        <key>ServerAddresses</key>
        <array>
          <string><your-server-ipv4></string>
          <string><your-server-ipv6></string>
        </array>
        <key>ServerURL</key>
        <string>https://dns.<your-domain>/dns-query/<your-private-path></string>
      </dict>
      <key>PayloadDisplayName</key>
      <string>My DNS</string>
      <key>PayloadIdentifier</key>
      <string>local.my-dns.settings</string>
      <key>PayloadType</key>
      <string>com.apple.dnsSettings.managed</string>
      <key>PayloadUUID</key>
      <string><uuid-1></string>
      <key>PayloadVersion</key>
      <integer>1</integer>
    </dict>
  </array>
  <key>PayloadDescription</key>
  <string>My own encrypted DNS. Remove it in Settings, General, VPN and Device Management.</string>
  <key>PayloadDisplayName</key>
  <string>My DNS</string>
  <key>PayloadIdentifier</key>
  <string>local.my-dns</string>
  <key>PayloadRemovalDisallowed</key>
  <false/>
  <key>PayloadType</key>
  <string>Configuration</string>
  <key>PayloadUUID</key>
  <string><uuid-2></string>
  <key>PayloadVersion</key>
  <integer>1</integer>
</dict>
</plist>

The parts that matter:

  • DNSProtocol HTTPS: encrypted DNS over HTTPS, the kind your server speaks.
  • ServerURL: your resolver's address with your private path. Without the right path, your server answers nothing.
  • ServerAddresses: your server's addresses, so the device can reach it without first looking up its name somewhere else. The device then uses these addresses, not the name: if your server ever gets new addresses, install a new profile on every device.
  • com.apple.dnsSettings.managed: this profile sets DNS for the whole device, every app.
  • PayloadRemovalDisallowed false: you can always remove it.

Check the file on your Mac:

plutil -lint my-dns.mobileconfig

must say OK.

Treat the file like a key. It contains your private path. Don't post it or upload it anywhere.

3. Install it on your iPhone

  1. On your Mac, Finder: right-click my-dns.mobileconfig → Share → AirDrop → your iPhone.
  2. On your iPhone, Settings: tap Profile Downloaded at the top → Install → enter your passcode → Install. "Not Verified" is expected: the profile isn't signed, and that's fine for your own.
  3. Settings → General → VPN & Device Management → DNS: choose My DNS, if it isn't chosen already.

4. On your Mac

We haven't tested a profile on the Mac yet. Double-clicking the file starts the installation, which you finish in System Settings. Then check with dnsleaktest as below.

How you know it worked

On the iPhone (switch any VPN off for now; chapter 9 brings it back):

  1. Safari → dnsleaktest.com → Standard test. The table shows only your server: its address and your hosting provider.
  2. Open google-analytics.com in Safari. It doesn't load ("can't find the server").
  3. Open any normal site. It loads. Don't skip this: "can't find the server" also appears when no DNS works at all.

Tested: 29 October 2026, iPhone with iOS 26.2.1, no other privacy app installed.

Keep a way back

If your server is ever down, your iPhone can't look up any name, and nothing loads. Then:

Settings → General → VPN & Device Management → My DNS → Remove Profile.

The iPhone goes back to your internet provider's DNS at once. Install the profile again when your server is back.

Pitfalls

  • A VPN takes over the DNS. With a VPN on, its DNS usually wins, and your blocking stops. Chapter 9 fixes that.
  • Remembered answers. Right after installing, a site you visited before may still load from the device's memory. Test with names the device hasn't looked up recently.
  • A typo in the path means your server answers nothing, and the iPhone shows no internet. Compare the path in the profile with the one in dnsdist.conf, character by character.
  • The IPv6 address, not the network. Your provider's console may show your IPv6 as a whole network ending in ::/64. The profile needs the server's own address. Check it on the server with ip -6 addr show scope global (at Hetzner it usually ends in ::1).

Time and cost

  • About 20 minutes (our estimate).
  • Free.

Previous: Chapter 7: Logs that forget · Next: Chapter 9: Your DNS inside your VPN

Text: CC BY-SA 4.0 · Commands and configs: CC0