Force iPhone to Use Encrypted DNS with a Configuration Profile

2026-10-14 20:44≈ 999Words≈ 5Minutes

1. Why Use Encrypted DNS?

Traditional DNS queries are generally not encrypted. This means an internet service provider or another intermediary on the network may hijack DNS queries or alter the returned results, potentially redirecting users to a different IP address. In some cases, this can also prevent users from reaching the website they intended to visit.

Even when a website uses HTTPS, DNS queries may still reveal the domain name being accessed. DNS responses can also be manipulated before the HTTPS connection is established.

Ironically, there have also been problems involving the trustworthiness of certificate authorities related to China. In 2015, MCS Holdings used an intermediate certificate issued by CNNIC to issue unauthorized certificates for Google domains. Major browsers subsequently took steps to remove trust in CNNIC certificates. From 2016 onward, the Chinese certificate authority WoSign and its affiliate StartCom were also gradually removed from the trust stores of Google Chrome and Mozilla Firefox following issues including unauthorized certificate issuance and backdating certificate dates.

Given their current level of trustworthiness, I sometimes wonder whether I would even be able to scan a QR code to rent a power bank on the street.

That is why using encrypted DNS through DNS-over-HTTPS (DoH) is a reasonable way to reduce risks such as DNS hijacking and tampering with DNS responses.Someone claiming to be trustworthy is no reason to stoptaking technical precautions.

On a home network, this is relatively easy to set up. You can run a DNS server on a router or NAS and configure it to use public encrypted DNS services such as AliDNS or Cloudflare. Then configure the router to distribute the address of your own DNS server to connected devices.

Smartphones are a little more complicated. On Wi-Fi, you can manually specify a DNS server, but this usually means entering the IP address of a traditional DNS server, such as 223.5.5.5. You cannot simply enter an encrypted DNS URL such as https://dns.alidns.com/dns-query.

What’s more, iPhone’s standard Settings app does not let you freely specify the DNS server used by cellular data. Proxy apps can override DNS handling to some extent, but I do not find that approach particularly elegant. Depending on the domain, the setting may only apply partially. Ideally, I wanted to configure DNS at the system level.

2. What the Configuration Profile Does

Apple provides an officially supported mechanism for configuring DNS. By creating a configuration profile, you can specify which DNS server the device should use. The profile only needs to follow Apple’s supported format and be installed on the iPhone. It does not require signing, jailbreaking, or packaging into an app. However, a profile you create yourself may display a red warning in Settings. For this particular setup, I am choosing to ignore that warning.

Since I intend to use this in mainland China, I chose AliDNS’s DoH service. I did not want to spend time researching the format myself, so I asked ChatGPT to generate the profile. The key is to encode a JSON DNS-settings declaration containing AliDNS’s DoH endpoint,https://dns.alidns.com/dns-query, as Base64 and embed it in the configuration profile. It is not just the URL that gets Base64-encoded.

If you do not want to investigate every detail yourself, you can also ask an AI assistant to generate a DNS configuration profile for iOS. Be sure to specify the DoH service URL and explain that, starting with iOS 27, the legacy DNS settings payload is deprecated and the declarative management type com.apple.configuration.network.dns-settings should be used instead.

The configuration profile source code is shown below. Save it as a UTF-8 text file with the .mobileconfig extension.

This configuration sets AllowFailover: false. If AliDNS’s DoH service becomes unavailable, DNS resolution may fail, making it appear as though the entire internet connection is down. In that situation, you may need to remove the configuration profile. This is not ideal from a user-experience perspective, but AliDNS outages are rare, and because this is a profile you installed yourself, it is easy to remove. I have decided to keep this setting for now.

For iOS 27 and later. Older iOS versions use the legacy DNSSettings payload.

 1<?xml version="1.0" encoding="UTF-8"?>
 2<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 3<plist version="1.0">
 4<dict>
 5    <key>PayloadContent</key>
 6    <array>
 7        <dict>
 8            <key>PayloadType</key>
 9            <string>com.apple.declarations</string>
10            <key>PayloadVersion</key>
11            <integer>1</integer>
12            <key>PayloadIdentifier</key>
13            <string>local.chatgpt.alidns.declarations</string>
14            <key>PayloadUUID</key>
15            <string>0FFA3358-E1D6-4F55-9946-42FC8DB1792D</string>
16            <key>PayloadDisplayName</key>
17            <string>AliDNS Declarative DNS</string>
18            <key>PayloadDescription</key>
19            <string>Locally installs an Apple declarative encrypted DNS settings declaration for AliDNS DoH.</string>
20            <key>Declarations</key>
21            <array>
22                <data>
23                eyJUeXBlIjoiY29tLmFwcGxlLmNvbmZpZ3VyYXRpb24u
24                bmV0d29yay5kbnMtc2V0dGluZ3MiLCJJZGVudGlmaWVy
25                IjoiMzQwN0E5RjQtOUIyNS00QkUwLUI4MTktODZDQUU4
26                NEJFN0I4IiwiU2VydmVyVG9rZW4iOiIzN0JCQ0IyQi1D
27                N0RCLTQ3OEEtQTg3RS03NDEwMUQwNDcwMkUiLCJQYXls
28                b2FkIjp7IlZpc2libGVOYW1lIjoiQWxpRE5TIEVuY3J5
29                cHRlZCBETlMiLCJETlNTZXR0aW5ncyI6eyJETlNQcm90
30                b2NvbCI6IkhUVFBTIiwiU2VydmVyVVJMIjoiaHR0cHM6
31                Ly9kbnMuYWxpZG5zLmNvbS9kbnMtcXVlcnkiLCJBbGxv
32                d0ZhaWxvdmVyIjpmYWxzZX19fQ==
33                </data>
34            </array>
35        </dict>
36    </array>
37    <key>PayloadDescription</key>
38    <string>Apple declarative DNS settings for AliDNS DoH. Applies to all networks; remove this profile to revert.</string>
39    <key>PayloadDisplayName</key>
40    <string>AliDNS Declarative DNS</string>
41    <key>PayloadIdentifier</key>
42    <string>local.chatgpt.alidns.declarative.profile</string>
43    <key>PayloadUUID</key>
44    <string>301BFAB9-5324-43AD-AF0B-46B6C8FA0FED</string>
45    <key>PayloadVersion</key>
46    <integer>1</integer>
47    <key>PayloadType</key>
48    <string>Configuration</string>
49    <key>PayloadRemovalDisallowed</key>
50    <false/>
51</dict>
52</plist>

3. Things to Keep in Mind

This is not a VPN: It configures encrypted DNS only. It does not route all network traffic through a VPN tunnel.
This is not a proxy configuration: It does not configure proxy nodes, routing rules, or traffic-distribution rules.
This is not a root certificate: It does not install a custom certificate authority.
This does not enroll the device in MDM: It does not register the device with an organization’s mobile device management service.
This does not bypass network restrictions: DoH protects DNS queries, but it does not guarantee that a website will be reachable and is not a replacement for a proxy.
This does not automatically block ads: If you need ad blocking, you can use it alongside a tool such as AdGuard.

4. How to Remove the Profile

If you encounter network problems or want to restore the previous DNS behavior, remove the installed configuration profile from the iPhone’s Settings app. After removal, DNS behavior will depend on iOS, the network you are connected to, and any proxy-app settings.

‹ I Finally Decided to Migrate My Blog from Hexo to Hugo