Kuuko / Build it yourself

Build it yourself · Part 1Checked: 30 October 2026 · tested on iPhone

Chapter 9: Your DNS inside your VPN

Why

A VPN hides your IP address from the sites you visit. But a VPN config also brings its own DNS, and on the iPhone it wins over your profile from chapter 8: your questions go to the VPN company's resolver, and your block lists stop working.

Whoever sets up the tunnel decides the DNS. Here you take that decision back by deleting one line.

What you need

  • Your DNS profile from chapter 8, installed and selected.
  • The WireGuard app (by WireGuard Development Team) from the App Store. It's free.
  • A WireGuard config from a VPN provider. Proton VPN offers one on its free plan (1 device). Other providers: see VPNs that work.
  • About 15 minutes (our estimate).

Steps (iPhone)

  1. Create a WireGuard config at your provider, on your computer. At Proton: account → Downloads → WireGuard configuration. Choose iOS, pick a server, and switch NetShield off: that's Proton's own blocking, and you want to test yours, not theirs.
  2. Send the config file to your iPhone (AirDrop works) and open it with the WireGuard app. Allow adding the VPN configuration.
  3. Delete the config file from your computer, and empty the bin. It contains your private key.
  4. In the WireGuard app, tap the tunnel → Edit. Find DNS servers and clear the field completely. At Proton it holds two addresses, for example 10.2.0.1, 2a07:b944::2:1. Remove both. Save.
  5. Switch the tunnel on.

That's all. Without a DNS line, the tunnel brings no DNS of its own, and your profile stays in charge.

How you know it worked

Check three things, with the tunnel on:

  1. dnsleaktest.com → Standard test. At the top, "Your public IP" is the VPN's (for example in Canada). In the table, the only DNS server is yours (for example your provider in Germany). VPN country above, your server below: that's the proof.
  2. Open google-analytics.com in Safari. It doesn't load ("can't find the server").
  3. Open any normal site. It loads. Don't skip this: "can't find the server" also appears when no DNS works at all, so a blocked tracker alone proves nothing.

Pitfalls

  • Keep the provider's DNS line, and its DNS answers instead of yours. In our test with Proton's line still in place, dnsleaktest showed only Proton's servers, and google-analytics.com loaded.
  • The VPN app may put the line back. If you import a fresh config, or the provider's app replaces it, clear the DNS servers again. Re-check with dnsleaktest whenever you change configs.
  • Apple doesn't document which DNS wins, as far as we know. What works today may change with an iOS update. Re-run the three checks after every update.

What we know and don't know yet

  • Tested: 29 October 2026, iPhone with iOS 26.2.1 and no other privacy app installed, Proton VPN's free WireGuard config, exit in Montreal.
  • Not yet checked: whether your encrypted DNS travels inside the tunnel or beside it. Your lookups stay encrypted either way; the difference is whether your own server sees the VPN's address or your home address.
  • Mac: not tested yet with the WireGuard Mac app. We'll add it once we have.

Time and cost

  • About 15 minutes (our estimate).
  • The WireGuard app is free. Proton VPN has a free plan for 1 device; paid plans and other providers on VPNs that work.

Previous: Chapter 8: Your iPhone and Mac · Next: Chapter 10: Keep it running

Text: CC BY-SA 4.0 · Commands and configs: CC0