# Build it yourself · Part 1

## Chapter 9: Your DNS inside your VPN

> Markdown copy of https://kuuko.app/build/vpn/ for agents; the HTML page is the source. Part 1 of Kuuko's guide to building the core yourself. Text: CC BY-SA 4.0 · Commands and configs: CC0.

*Checked: 30 October 2026 · tested on iPhone*

---

### Why

A VPN hides your IP address from the sites you visit. But a VPN config also brings its own DNS, and on the iPhone it wins over your profile from chapter 8: your questions go to the VPN company's resolver, and your block lists stop working.

**Whoever sets up the tunnel decides the DNS.** Here you take that decision back by deleting one line.

### What you need

- Your DNS profile from chapter 8, installed and selected.
- The WireGuard app (by WireGuard Development Team) from the App Store. It's free.
- A WireGuard config from a VPN provider. Proton VPN offers one on its free plan (1 device). Other providers: see [VPNs that work](https://kuuko.app/vpn/).
- About 15 minutes (our estimate).

### Steps (iPhone)

1. **Create a WireGuard config at your provider**, on your computer. At Proton: account → Downloads → WireGuard configuration. Choose iOS, pick a server, and **switch NetShield off**: that's Proton's own blocking, and you want to test yours, not theirs.
2. **Send the config file to your iPhone** (AirDrop works) and open it with the WireGuard app. Allow adding the VPN configuration.
3. **Delete the config file from your computer**, and empty the bin. It contains your private key.
4. **In the WireGuard app, tap the tunnel → Edit.** Find **DNS servers** and clear the field completely. At Proton it holds two addresses, for example `10.2.0.1, 2a07:b944::2:1`. Remove both. Save.
5. **Switch the tunnel on.**

That's all. Without a DNS line, the tunnel brings no DNS of its own, and your profile stays in charge.

### How you know it worked

Check three things, with the tunnel on:

1. **dnsleaktest.com → Standard test.** At the top, "Your public IP" is the VPN's (for example in Canada). In the table, the only DNS server is yours (for example your provider in Germany). VPN country above, your server below: that's the proof.
2. **Open `google-analytics.com` in Safari.** It doesn't load ("can't find the server").
3. **Open any normal site.** It loads. Don't skip this: "can't find the server" also appears when no DNS works at all, so a blocked tracker alone proves nothing.

### Pitfalls

- **Keep the provider's DNS line, and its DNS answers instead of yours.** In our test with Proton's line still in place, dnsleaktest showed only Proton's servers, and `google-analytics.com` loaded.
- **The VPN app may put the line back.** If you import a fresh config, or the provider's app replaces it, clear the DNS servers again. Re-check with dnsleaktest whenever you change configs.
- **Apple doesn't document which DNS wins**, as far as we know. What works today may change with an iOS update. Re-run the three checks after every update.

### What we know and don't know yet

- **Tested:** 29 October 2026, iPhone with iOS 26.2.1 and no other privacy app installed, Proton VPN's free WireGuard config, exit in Montreal.
- **Not yet checked:** whether your encrypted DNS travels inside the tunnel or beside it. Your lookups stay encrypted either way; the difference is whether your own server sees the VPN's address or your home address.
- **Mac:** not tested yet with the WireGuard Mac app. We'll add it once we have.

### Time and cost

- About 15 minutes (our estimate).
- The WireGuard app is free. Proton VPN has a free plan for 1 device; paid plans and other providers on [VPNs that work](https://kuuko.app/vpn/).

---

Previous: [Chapter 8: Your iPhone and Mac](https://kuuko.app/build/devices/) · Next: [Chapter 10: Keep it running](https://kuuko.app/build/upkeep/)

Text: CC BY-SA 4.0 · Commands and configs: CC0