# Kuuko support > Markdown copy of https://kuuko.app/support/ for agents; the HTML page is the source. Last changed 30 October 2026. How Kuuko works, how to check it with your own eyes, and what to do when something doesn't work. Most of it is also in the app's Learn tab, which works without the internet. **Need a person?** Write to [kuuko@sf4l.net](mailto:kuuko@sf4l.net). It helps if you add: - your **support code**, if you have a vault (Vault tab, Copy); - the **details for support** from Learn › When Kuuko doesn't work (Copy). They contain no addresses, no network names and nothing about other apps. **Never send your 12 words.** Nobody at Kuuko will ever ask for them. ## Test your settings now Three independent tests, run by others, show what reaches your browser. You don't need Kuuko for them: try them now to see how your device is set up today, and again once Kuuko is on. Open them in the browser you want to check, on the device you want to check. ### [EFF Cover Your Tracks](https://coveryourtracks.eff.org/) By the Electronic Frontier Foundation. Shows whether your browser loads tracking ads and invisible trackers. **Today** Without a tracker blocker, “Blocking tracking ads?” and “Blocking invisible trackers?” usually say “No” or “Partial protection”. Partial means the test trackers loaded and only their cookies were blocked. **With Kuuko DNS on** Both say “Yes”: the test trackers don't load at all. The fingerprint part of the test is about your browser, not about Kuuko. ### [DNS leak test](https://www.dnsleaktest.com/) Shows which servers answer your device's DNS questions, the questions that reveal every site and app you use. Choose “Extended test”. **Today** Usually the servers of your internet or mobile provider, or of another DNS service that you or your network chose. **With Kuuko DNS on** Only Kuuko's servers, run with Hetzner in Germany and Finland: **Nuremberg, Germany** `49.12.253.210` `2a01:4f8:1c16:e601::1` **Helsinki, Finland** `65.21.7.95` `2a01:4f9:c013:45c1::1` Never your internet provider's, never your VPN provider's. ### [ipleak.net](https://ipleak.net/) Shows your internet address as websites see it, also over IPv6 and WebRTC, and your DNS servers. **Today** Your normal address, and usually your provider's DNS servers. **With Kuuko DNS on** Your normal address. DNS: only Kuuko's servers. **With Kuuko's VPN on** Only your VPN provider's address and country, also for IPv6 and WebRTC. DNS: only Kuuko's servers. **Good to know:** these sites see your address, because that's how the tests work. ipleak.net says it is powered by AirVPN. dnsleaktest.com doesn't name its operator on the page; its footer links to IVPN Limited's privacy policy. If iCloud Private Relay is on, Safari's results can differ, because Private Relay sends Safari's traffic its own way. A result looks wrong? See [When something doesn't work](https://kuuko.app/support/#fix). ## Getting started 1. **Turn on Kuuko DNS.** Blocking needs only the subscription (new subscribers get the first week free); you don't need a vault (see step 5). In the Blocking tab, choose Turn on Kuuko DNS. To finish: iPhone open Settings › General › VPN & Device Management › DNS and choose Kuuko. Mac open System Settings › Network › Filters and turn on Kuuko. The card then says “Kuuko DNS is on”. 2. **Choose what to block.** Pick the block lists in the Blocking tab. Your choice travels as a short code in the server address, such as `k2-103fe`. Everyone with the same choices has the same code, so it stands for your choices, not for you. 3. **Run the protection test.** On the Blocking card, choose Test now. Kuuko asks its server about known trackers and shows what it blocks with your choices. Then try the [independent tests](https://kuuko.app/support/#test) above. 4. **Add your VPN** (optional, with the subscription). Kuuko works with the VPN you already use, if it hands out WireGuard configs, for example Proton VPN or Mullvad. Get a config from your provider's website, then in the Blocking tab choose Add your VPN and add the file, or scan its QR code on iPhone. Use one config per device. Which providers work, free and paid: [VPNs that work with Kuuko](https://kuuko.app/vpn/). 5. **Make your first email alias** (with the subscription). Aliases also need a **vault**, because our server forwards your mail: a place on our server for your aliases and your ledger. In the Vault tab, choose Create your vault: no name, no email address, no password. You get a passkey on your device and 12 words to write down. Without a subscription, a vault is deleted after 24 hours. Then, in the Aliases tab, add the mailbox your aliases forward to; Kuuko sends it a 6-digit code to confirm it. ## How Kuuko works ### Kuuko DNS: blocking across your apps Before an app loads anything, it asks for the address of a name, for example `ads.example.com`. That question goes, encrypted, to Kuuko DNS instead of your Wi-Fi or mobile provider. If the name is on one of your block lists, Kuuko answers “doesn't exist”, and the ad or tracker never loads. Kuuko also checks names that hide behind other names. **It sees** the name and your internet address. **It keeps** no log of lookups. To stop abuse, it holds your internet address in memory for a few minutes, never on disk. Recent answers are kept for everyone, for a day at most, without who asked. Block lists: [HaGeZi DNS Blocklists](https://github.com/hagezi/dns-blocklists), updated every day, and Kuuko's own lists. **What it can't do:** - Block trackers that use the website's own name. - Stop apps that send tracking data to their own company's servers, the same ones the app needs to work, as Instagram does with Meta. - Look inside apps or read what they send. - Tell you what it blocked. It keeps no record, so there is no list to show. - Answer while a VPN or another app answers DNS on your device. The app checks this and tells you. ### Cookie banners in Safari Kuuko's Safari extension answers cookie banners for you with “reject all”, where a banner offers it. A banner without a reject option is left for you. It's optional and works with a Kuuko subscription. **Switch it on** in the app under Blocking › Safari › Cookie banners in Safari, which shows the steps. Safari then warns that the extension can read and alter the pages you visit: it says this for every extension that works on all websites. **It sees** the pages you let it access, only to find a cookie banner its rules know. **It keeps** the websites where you told it not to answer, on your device. It sends nothing off your device. Rules: [autoconsent](https://github.com/duckduckgo/autoconsent) by DuckDuckGo, with Kuuko's changes ([source](https://kuuko.app/source/autoconsent/)). ### The VPN: your own provider, with Kuuko's blocking inside A VPN sends all your traffic through an encrypted tunnel to your VPN provider's server. From there it goes on to the internet. **It hides** - Your internet address from the websites and apps you use. They see the VPN server's address. - Your traffic from the Wi-Fi you're on and from your internet or mobile provider. They see only that you use a VPN. **It doesn't hide** - Who you are when you're logged in. A website you're signed in to still knows it's you. - Your browser's fingerprint: the details a website can read from your browser stay the same. - Your traffic from the VPN provider. It can see where your traffic goes, so choose one you trust. **With Kuuko:** Kuuko runs no VPN servers and never sees your VPN keys; they stay in your device's Keychain. While the VPN is on, DNS goes to Kuuko through the tunnel, so your block lists keep working. While it is connected or reconnecting, nothing goes beside the tunnel except what the system itself needs, such as joining a Wi-Fi network and push notifications, and your local network if you allow it. With “Always” or “Away from trusted Wi-Fi”, the system starts the VPN again by itself if it stops. With “Manual”, nothing starts it again: if the VPN stops, your traffic goes out normally, without the VPN. ### Email aliases: one address per company Your email address is the one thing almost every shop, app and newsletter has. Used everywhere, it links your accounts together, and once it leaks, spam and phishing follow you for years. With Kuuko you give each company its own address ending in `@kuuko.me`. Mail to it is forwarded to your real mailbox, and you can reply from the alias. If one alias leaks, you see which company it was. Switch that alias off: the others keep working, and your real address never left your hands. An alias can carry “Your name on replies”. Leave it empty and others see only the address: a name makes you easier to recognise and to track across services. ### Leak detection and the ledger **Leak detection** (off unless you switch it on) warns you when mail reaches an alias from someone other than the company you gave it to. That usually means the address was sold, shared or stolen. You still get that mail, with a warning line at the top; with automatic pause, the alias also switches off. A leak by the company itself, such as its own data breach, isn't noticed, because that mail still comes from its domain. **The ledger** is your note of what you shared with whom, when and why. It is encrypted on your devices with a key made from your 12 words. Kuuko's server keeps only a copy it can't read, so your iPhone and Mac stay in step. ### Your vault, your passkey and your 12 words Your vault opens with a passkey on your device. Your 12 words let you open your vault on a new device and unlock your ledger. Write them down and keep them somewhere safe: anyone who has them can open your vault. **If you lose your passkeys and these words, nobody can restore your vault, not even Kuuko.** ## When something doesn't work ### Kuuko DNS isn't working, or a tracker isn't blocked Kuuko checks that its server answers your device's DNS questions. If it doesn't, one of these is usually the reason: 1. **Kuuko isn't selected any more.** This can happen after an update, or when another DNS app was chosen. iPhone Settings › General › VPN & Device Management › DNS, choose Kuuko. Mac System Settings › Network › Filters, turn on Kuuko. 2. **Another VPN is connected.** While it's connected, a VPN usually answers DNS itself, for example Tailscale, Proton VPN's own app or a company VPN. Kuuko works again once that VPN is off, or use your provider's WireGuard config inside Kuuko instead. Mac Tailscale: in its settings, switch off “Use Tailscale DNS settings”. Tailscale's short device names then stop working; its addresses keep working. 3. **The browser uses its own DNS** Mac Firefox, Zen and other browsers built on Firefox: Settings › Privacy & Security › DNS over HTTPS › Off. On “Default protection” they follow Kuuko by themselves. Chrome, Edge and Brave: switch off “Use secure DNS” in the browser's privacy and security settings. 4. **Names looked up before are remembered** for a while, up to a few hours. Quit and reopen the browser. Mac You can also clear the memory in Terminal: `sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder` 5. **Test it again** with the [independent tests](https://kuuko.app/support/#test). Still not right? [Write to us](mailto:kuuko@sf4l.net) with the details for support. ### A site or app doesn't load Its name may be on one of your block lists. If you switched on extra lists, switch those off first. The lists that are always on can't be switched off: turn off Kuuko DNS for a moment instead. Then [tell us the site's name](mailto:kuuko@sf4l.net), so we can check the lists. ### The login page of a hotel or café Wi-Fi doesn't appear Switch the VPN off for a moment, log in, then switch it on again. ### Printers or AirPlay stop working while the VPN is on In the VPN settings, switch on “Allow local network”. Devices at home keep working, and that traffic stays outside the VPN. ## Your subscription Apple sells and bills Kuuko's subscription. Apple handles payments, cancellations and refunds, so we can't do those for you, and we never see your Apple Account or your card. ### Cancel iPhone Settings › your name › Subscriptions › Kuuko › Cancel Subscription. Mac App Store › your name at the bottom of the sidebar › your name again › Subscriptions › Kuuko › Cancel Subscription. Apple's guide: [Cancel a subscription from Apple](https://support.apple.com/118428). Deleting the app or your vault doesn't cancel the subscription: cancel it with Apple. ### Refund Sign in at [reportaproblem.apple.com](https://reportaproblem.apple.com/), choose “I'd like to” › Request a refund, give the reason and choose Kuuko. Apple decides. Apple's guide: [Request a refund](https://support.apple.com/118223). ## Your data Without a vault, nothing about you is written to our servers, except mail you send us. With a vault, you can see and delete your data yourself, at any time: - **Download my data** (Vault tab): a readable file with your vault's data from Kuuko's server, and your aliases as a spreadsheet file. - **Delete vault…** (Vault tab): removes your vault, aliases, mailboxes, ledger, leak detection data and settings at once. You confirm with a passkey or your 12 words. This can't be undone. Copies in our encrypted backups expire within 42 days. We keep only a fingerprint of each deleted alias address, so that it is never given to anyone else. What Kuuko keeps, and what it never sees: [Privacy at Kuuko](https://kuuko.app/privacy/).