Apple Encrypted DNS Profile Builder

Want to learn why secure DNS is highly recommended? Read the post →

Build a .mobileconfig that forces encrypted DNS system-wide on iOS and macOS, including cellular, which has no Settings UI of its own. Optionally have it stand down on your home Wi‑Fi so a local resolver like Pi‑hole keeps doing the work.

1 · Where it applies

2 · Home networks to exclude

Wi‑Fi network name (SSID)

No networks added yet.

Matching is exact and case‑sensitive. Add every SSID you want excluded: separate 2.4/5 GHz names, guest and IoT networks each count as their own.

2 · Resolver

NextDNS configuration ID

The short ID from your NextDNS dashboard. It identifies your account, so treat the finished profile as sensitive.

DoH endpoint URL

DoT server hostname

Bootstrap IPs (optional, comma separated)

3 · Protocol

4 · Profile details

Display name

Organization

Payload identifier

Installing a profile whose identifier is already present replaces it rather than adding a second. Keep this stable to update in place; change it to run two side by side.

Include bootstrap IP addresses Lets iOS reach the resolver without a plaintext lookup of its hostname first. Optional, since queries stay encrypted either way. Prevent removal from Settings Sets PayloadRemovalDisallowed. On an unsupervised personal device this can only be undone by erasing it, so leave it off unless you mean it.

Profile

Before you trust it

An active VPN overrides this profile. Whatever DNS the VPN pushes wins for as long as it is connected, no matter what this profile says. If you run an always‑on VPN, configure DNS there instead, because this profile will mostly sit idle.
iCloud Private Relay resolves separately. With Private Relay on, Safari’s name resolution goes through Apple’s relays rather than your chosen resolver. Turn it off (Settings → your name → iCloud → Private Relay) if you need every query to go where this profile says.
Test both states before relying on it. Check once on cellular and again on the excluded Wi‑Fi.
Install it manually, not through MDM. Apple's own schema notes that a profile pushed by an MDM applies only to managed Wi‑Fi networks, while one installed by hand also covers cellular. Deploying this through MDM would quietly drop the cellular coverage that is the main reason to use it.
Captive portals can break while it is active. Hotel and airport sign‑in pages sometimes depend on hijacking plaintext DNS. If a portal will not load, disable the profile long enough to sign in.
Generate this on a computer, not the iPhone. Safari on iOS saves a downloaded .mobileconfig to Files rather than opening the install flow. Build it here on a desktop, then AirDrop or email it to the phone.
Unsigned profiles show “Unverified” in red. Expected, and nothing is wrong. It means the file carries no code‑signing certificate, not that its contents are invalid.

Everything here happens in your browser. This page makes no third‑party requests, and the profile is assembled locally, so nothing you type is transmitted or stored. Install by opening the file on the device, then Settings → General → VPN & Device Management. Requires iOS 14 / macOS 11 or later, which is when Apple added the com.apple.dnsSettings.managed payload.