# Build it yourself · Part 1

## Chapter 8: Your iPhone and Mac

> Markdown copy of https://kuuko.app/build/devices/ for agents; the HTML page is the source. Part 1 of Kuuko's guide to building the core yourself. Text: CC BY-SA 4.0 · Commands and configs: CC0.

*Checked: 30 October 2026 · tested on iPhone*

---

### Why

Your server is ready. Now your devices need to use it: for every app and every browser, encrypted, without any extra app. A small configuration file, a "profile", tells iPhone and Mac where your resolver is.

**This kind of profile has an end date.** Apple lists it as available up to iOS 27 and macOS 27, and its replacement is meant for company device management, not for a profile you install yourself. It still installs and works: we tested it on iOS 26.2.1. When Apple removes it, a small app of your own is the way left (see "Going further").

### What you need

- Your server's IPv4 and IPv6 addresses (chapter 3), your domain, and your private path (chapter 4).
- Your Mac, to write the file.
- About 20 minutes (our estimate).

### Steps

#### 1. Two unique IDs

Every profile needs two IDs of its own. On your Mac:

```
uuidgen
uuidgen
```

Keep both results; below they're `<uuid-1>` and `<uuid-2>`.

#### 2. Write the profile

Create a file named `my-dns.mobileconfig` (for example with TextEdit, as plain text) and paste, with your own values:

```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>PayloadContent</key>
  <array>
    <dict>
      <key>DNSSettings</key>
      <dict>
        <key>DNSProtocol</key>
        <string>HTTPS</string>
        <key>ServerAddresses</key>
        <array>
          <string><your-server-ipv4></string>
          <string><your-server-ipv6></string>
        </array>
        <key>ServerURL</key>
        <string>https://dns.<your-domain>/dns-query/<your-private-path></string>
      </dict>
      <key>PayloadDisplayName</key>
      <string>My DNS</string>
      <key>PayloadIdentifier</key>
      <string>local.my-dns.settings</string>
      <key>PayloadType</key>
      <string>com.apple.dnsSettings.managed</string>
      <key>PayloadUUID</key>
      <string><uuid-1></string>
      <key>PayloadVersion</key>
      <integer>1</integer>
    </dict>
  </array>
  <key>PayloadDescription</key>
  <string>My own encrypted DNS. Remove it in Settings, General, VPN and Device Management.</string>
  <key>PayloadDisplayName</key>
  <string>My DNS</string>
  <key>PayloadIdentifier</key>
  <string>local.my-dns</string>
  <key>PayloadRemovalDisallowed</key>
  <false/>
  <key>PayloadType</key>
  <string>Configuration</string>
  <key>PayloadUUID</key>
  <string><uuid-2></string>
  <key>PayloadVersion</key>
  <integer>1</integer>
</dict>
</plist>
```

The parts that matter:
- `DNSProtocol` `HTTPS`: encrypted DNS over HTTPS, the kind your server speaks.
- `ServerURL`: your resolver's address with your private path. Without the right path, your server answers nothing.
- `ServerAddresses`: your server's addresses, so the device can reach it without first looking up its name somewhere else. The device then uses these addresses, not the name: **if your server ever gets new addresses, install a new profile** on every device.
- `com.apple.dnsSettings.managed`: this profile sets DNS for the whole device, every app.
- `PayloadRemovalDisallowed` `false`: you can always remove it.

Check the file on your Mac:

```
plutil -lint my-dns.mobileconfig
```

must say `OK`.

**Treat the file like a key.** It contains your private path. Don't post it or upload it anywhere.

#### 3. Install it on your iPhone

1. **On your Mac, Finder:** right-click `my-dns.mobileconfig` → Share → AirDrop → your iPhone.
2. **On your iPhone, Settings:** tap **Profile Downloaded** at the top → **Install** → enter your passcode → **Install**. "Not Verified" is expected: the profile isn't signed, and that's fine for your own.
3. **Settings → General → VPN & Device Management → DNS:** choose **My DNS**, if it isn't chosen already.

#### 4. On your Mac

We haven't tested a profile on the Mac yet. Double-clicking the file starts the installation, which you finish in System Settings. Then check with dnsleaktest as below.

### How you know it worked

On the iPhone (switch any VPN off for now; chapter 9 brings it back):

1. **Safari → dnsleaktest.com → Standard test.** The table shows only your server: its address and your hosting provider.
2. **Open `google-analytics.com` in Safari.** It doesn't load ("can't find the server").
3. **Open any normal site.** It loads. Don't skip this: "can't find the server" also appears when no DNS works at all.

*Tested: 29 October 2026, iPhone with iOS 26.2.1, no other privacy app installed.*

### Keep a way back

If your server is ever down, your iPhone can't look up any name, and nothing loads. Then:

**Settings → General → VPN & Device Management → My DNS → Remove Profile.**

The iPhone goes back to your internet provider's DNS at once. Install the profile again when your server is back.

### Pitfalls

- **A VPN takes over the DNS.** With a VPN on, its DNS usually wins, and your blocking stops. Chapter 9 fixes that.
- **Remembered answers.** Right after installing, a site you visited before may still load from the device's memory. Test with names the device hasn't looked up recently.
- **A typo in the path** means your server answers nothing, and the iPhone shows no internet. Compare the path in the profile with the one in `dnsdist.conf`, character by character.
- **The IPv6 address, not the network.** Your provider's console may show your IPv6 as a whole network ending in `::/64`. The profile needs the server's own address. Check it on the server with `ip -6 addr show scope global` (at Hetzner it usually ends in `::1`).

### Time and cost

- About 20 minutes (our estimate).
- Free.

---

Previous: [Chapter 7: Logs that forget](https://kuuko.app/build/logs/) · Next: [Chapter 9: Your DNS inside your VPN](https://kuuko.app/build/vpn/)

Text: CC BY-SA 4.0 · Commands and configs: CC0