paulmillr / encrypted-dns

DNS over HTTPS config profiles for iOS & macOS

English | 简体中文 | 繁體中文

encrypted-dns-configs

Configuration profiles for DNS over HTTPS and DNS over TLS. Check out the article for more info: paulmillr.com/posts/encrypted-dns/ and info about contributing a new profile.

Caveats

DoH seems to work faster & better than DoT judging from the Google's article.

Starting from iOS & iPadOS 15.5, Wi-Fi captive portals in cafes, hotels, airports are exempted by Apple from eDNS rules; to simplify authentication. This is good news. There are still some other issues; we can't fix them, only Apple can:

• eDNS gets disabled: Little Snitch & Lulu, VPN
• Some traffic is exempt from eDNS: Terminal / App Store, Chrome

If you need even more privacy, check out encrypted-dns over TOR.

Providers

Censorship=yes means the profile will not send true information about hostname=IP relation for some hosts.

Name	Region	Censorship	Notes	Install (Signed - Recommended)	Install (unsigned) button
360 Security DNS	🇨🇳	Yes	Operated by 360 Digital Security Group	HTTPS	HTTPS
AdGuard DNS Default	🇷🇺	Yes	Operated by AdGuard Software Ltd. Blocks ads, tracking & phishing	HTTPS, TLS	HTTPS, TLS
AdGuard DNS Family Protection	🇷🇺	Yes	Operated by AdGuard Software Ltd. Blocks Default + malware & adult content	HTTPS, TLS	HTTPS, TLS
AdGuard DNS Non-filtering	🇷🇺	No	Operated by AdGuard Software Ltd. Non-filtering	HTTPS, TLS	HTTPS, TLS
Alekberg Encrypted DNS	🇳🇱	No	Independent	HTTPS	HTTPS
Aliyun Public DNS	🇨🇳	No	Operated by Alibaba Cloud Ltd.	HTTPS, TLS	HTTPS, TLS
Archuser.org PubHole	🇺🇸	Yes	Independent. Blocks ads, tracking, and supports OpenNIC Domains.		HTTPS, TLS
BlahDNS CDN Filtered	🇺🇸	Yes	Independent. Blocks ads, tracking & malware	HTTPS	HTTPS
BlahDNS CDN Unfiltered	🇺🇸	No	Independent. Non-filtering	HTTPS	HTTPS
BlahDNS Finland	🇫🇮	Yes	Independent. Blocks ads, tracking & malware	HTTPS	HTTPS
BlahDNS Germany	🇩🇪	Yes	Independent. Blocks ads, tracking & malware	HTTPS	HTTPS
BlahDNS Japan	🇯🇵	Yes	Independent. Blocks ads, tracking & malware	HTTPS	HTTPS
BlahDNS Singapore	🇸🇬	Yes	Independent. Blocks ads, tracking & malware	HTTPS	HTTPS
BlahDNS Switzerland	🇨🇭	Yes	Independent. Blocks ads, tracking & malware	TLS	TLS
Canadian Shield Private	🇨🇦	No	Operated by the Canadian Internet Registration Authority (CIRA)	HTTPS, TLS	HTTPS, TLS
Canadian Shield Protected	🇨🇦	Yes	Operated by the Canadian Internet Registration Authority (CIRA). Blocks malware & phishing	HTTPS, TLS	HTTPS, TLS
Canadian Shield Family	🇨🇦	Yes	Operated by the Canadian Internet Registration Authority (CIRA). Blocks malware, phishing & adult content	HTTPS, TLS	HTTPS, TLS
Cloudflare 1.1.1.1	🇺🇸	No	Operated by Cloudflare Inc.	HTTPS, TLS	HTTPS, TLS
Cloudflare 1.1.1.1 Security	🇺🇸	Yes	Operated by Cloudflare Inc. Blocks malware & phishing	HTTPS	HTTPS
Cloudflare 1.1.1.1 Family	🇺🇸	Yes	Operated by Cloudflare Inc. Blocks malware, phishing & adult content	HTTPS	HTTPS
DNSPod Public DNS	🇨🇳	No	Operated by DNSPod Inc., a Tencent Cloud Company	HTTPS, TLS	HTTPS, TLS
Google Public DNS	🇺🇸	No	Operated by Google LLC	HTTPS, TLS	HTTPS, TLS
keweonDNS	🇩🇪	No	Operated by Aviontex. Blocks ads & tracking	HTTPS, TLS	HTTPS, TLS
Mullvad DNS	🇸🇪	Yes	Operated by Mullvad VPN AB	HTTPS	HTTPS
Mullvad DNS Adblock	🇸🇪	Yes	Operated by Mullvad VPN AB. Blocks ads & tracking	HTTPS	HTTPS
OpenDNS Standard	🇺🇸	No	Operated by Cisco OpenDNS LLC	HTTPS	HTTPS
OpenDNS FamilyShield	🇺🇸	Yes	Operated by Cisco OpenDNS LLC. Blocks malware & adult content	HTTPS	HTTPS
Quad9	🇨🇭	Yes	Operated by Quad9 Foundation. Blocks malware	HTTPS, TLS	HTTPS, TLS
Quad9 w/ ECS	🇨🇭	Yes	Operated by Quad9 Foundation. Supports ECS. Blocks malware	HTTPS, TLS	HTTPS, TLS
Tiarap	🇸🇬 🇺🇸	Yes	Operated by Tiarap Inc. Blocks ads, tracking, phising & malware	HTTPS, TLS	HTTPS, TLS

Installation

To make settings work across all apps in iOS, iPadOS & macOS, you'll need to install configuration profile. This profile would tell operating system to use DoH / DoT. Note: it's not enough to simply set server IPs in System Preferences — you need to install a profile.

iOS / iPadOS: Open the mobileconfig file in GitHub by using Safari (other browsers will just download the file and won't ask for installation), and then click/tap on "Allow" button. The profile should download. Go to System Settings => General => VPN, DNS & Device Management, select downloaded profile and tap the "Install" button.

macOS (official docs):

1. Download and save the profile. After save, rename it to be in format: NAME.mobileconfig, not NAME.txt, or so

2. Choose Apple menu > System Settings, click Privacy and Security in the sidebar, then click Profiles on the right. (You may need to scroll down.) You may be asked to supply your password or other information during installation.

3. In the Downloaded section, double-click the profile.

4. Review the profile contents then click Continue, Install or Enroll to install the profile.

   If an earlier version of a profile is already installed on your Mac, the settings in the updated version replace the previous ones.

Scope

There seems to be an additional option that allows to use system-wide profiles. To try it, add this to mobileconfig file:

<key>PayloadScope</key>
<string>System</string>

Signed Profiles

In the signed folder we have signed versions of the profiles in this repository. These profiles have been signed by @Xernium so that when you install the profiles, they will have a verified check box on the installation screen. It also ensures that these profiles have not been tampered with. However, since they were signed by a third party, they may lag behind their unsigned counterparts a little. The signature is valid until 2024-11-30

Previous signature by: @Candygoblen123, replaced at 2023-11-29

To verify resolver IPs and hostnames, compare mobileconfig files to their documentation URLs. Internal workings of the profiles are described on developer.apple.com. In order to verify signed mobileconfigs, you will need to download them to your computer and open them in a text editor, because signing profiles makes GitHub think that they are binary files.

Contributing a new profile

Profiles are basically text files. Copy an existing one and change its UUID, make sure you update README with new profile's info.

In addition to generating online, there are many other ways to generate a random UUID:

• Press F12 to open DevTools in the browser, run this code in the console

crypto.randomUUID();

• Run these commands in the macOS / Linux terminal

# Works both in macOS & Linux
uuidgen

# Works in Linux
cat /proc/sys/kernel/random/uuid

• Run this cmdlet in Powershell

New-Guid

encrypted-dns's Issues

OpenDNS Family Shield

The script published for adding OpenDNS servers to iOS 14.x devices only supports the OpenDNS Home servers. For OpenDNS Family Shield users the following OpenDNS IP addresses must be configured on the iOS 14.x devices.

Please visit https://en.wikipedia.org/wiki/OpenDNS or https://support.opendns.com/hc/en-us/articles/227988127-Getting-started-About-using-OpenDNS for more information.

Hello from encrypted-dns.party

Hi!

Really appreciate the work here; encrypted DNS is awesome. FYI if you want to use any profiles I already created over at https://encrypted-dns.party / https://gitlab.com/nitrohorse/ios14-encrypted-dns-mobileconfigs, please feel free.

Add AliDNS support

encrypted-dns

Feature Suggest: Make it on-demand

My home WIFI have a ad-blocked DNS powered by pi-hole. But this profile force the DNS all the time. Is it possible to make it exclude certain SSID, to use the DNS from DHCP. And use the profile setting for those WIFI not on the list and cellular.
https://emm.how/t/ios-14-changes-in-configuration-profiles/1285
https://thomas-witt.com/auto-connect-your-ios-device-to-a-vpn-when-joining-an-unknown-wifi-d1df8100c4ba
OnDemand key seems do something similar, but how to combine with the DNS profile?

Hope to add Tencent DoH configuration profiles

DoH: https://doh.pub/dns-query
DoT: dns.pub

ignore pls

error message sorry

How to check?

Hello,
First of all thanks for your contribution.

I installed the profile. Is there a way to check if DNS encryption is working? I am asking that also because I have noticed a warning next to the WiFi network name:

this network is blocking DNS encrypted traffic

Thanks for helping,
Dan

[question] iPadOS support

Hi,
any idea if this could work in iPadOS, and not just iOS?
There is no Profile section under Settings/General in iPadOS 14.3
thanks

dns

Need Help with iOS 14 DNS

Hello, this request might be slightly offtopic, but I am pulling out my hair with iOS 14 encrypted DNS and maybe someone her ecan help me. So the question is if it is possible to extend your profiles with a second, local and most importantly NON ENCRYPTED DNS server? Problem is that iOS 14 seems to totally ignore such unencrypted servers if there an encrypted one (here: Cloudflare) is available. So the idea is to construct a mobileconfig which instructs iOS to use this second DNS as well, but only for certain domains. Is this possible at all?

Cannot delete the Cloudflare DNS Option. The minus is greyed out. please help.

Chrome exempting itself form macOS settings

In blog post Firefox is mentioned but not Chrome.

It might then come as a surprise to some users that Chrome will exempt itself from global settings on macOS (of course) and will use its own DNS-over-https. If someone would like to setup DoH on Chrome this is how to do it:

Go to Settings-> Privacy and Security --> Security and scroll down to Use Secure DNS. Check this option and select predefined server (Google, Cloudflare) or use your own.

Chrome 87 on Big Sur 11.0.1

Add profiles for Cleanbrowsing servers

Thanks for making these

Can you add profiles for the Cleanbrowsing servers?
https://cleanbrowsing.org/filters/

I was going to make a PR, but I see the mobileconfig files have some fields like UUIDs in them.
Do you have a script or something you use to generate profiles ?

Thanks,

I don't know what i'm doing

How do you use tcpdump?

Mixing DNS servers ?

Hello,

Is it possible to mix DNS configurations in one single mobileconfig ?

For example, can I define a Cloudflare + Quad9 DoH for redundancy purposes ?

Thanks.

Little Snitch / Lulu seem to disable DNS over HTTPS / TLS

Seems like a bug

Add quad 9 With ECS + quad9 correction

I create this issue to correct Quad9 (now in Swiss) and add ECS version
Pull Request come in 5 minutes.

Does iOS support only one DoH config?

iOS 14.3 on iPhone 8
When I installed a new DoH config the existed one disappeared. I want to know whether the system support only ONE DoH setting? Thank you.

AdGaurd and AdGuard Family DNS-over-TLS

Please add AdGaurd and AdGuard Family DNS-over-TLS profiles: https://kb.adguard.com/en/dns/setup-guide

Yandex DNS

Please add Yandex DNS: https://kb.adguard.com/en/general/dns-providers#yandex-dns

DNS Profile Will Not Work After Connecting To VPN

After connecting to VPN then disconnect, DNS profile will not work until system restart. This happens in both Mac & iOS.

Hotspot login - captive.apple.com

Is there a way for the https over dns to bypass certain links? Seems the certain captive.apple.com hotpot login pages do not load when dns over https is active. However - once logged in - I found that I can reactivate https over dns and continue browsing over the hotspot. Just can’t use to connect on the hotspot landing page.

Who signed the signed ones?

The signed ones are signed by Andrew Glaze; who is that?

I am the DNS

Hello author, I would like to ask how to get the signature, I also want to get DNS, purr purr.

wrong link in readme

In readme.md, the link to AdGuard No Filter TLS actually points to adguard-nofilter-https.mobileconfig, but it should point to adguard-nofilter-tls.mobileconfig

How to install on iOS?

This is my first time trying to download something from GitHub on iOS so maybe I'm just missing something easy. I tried to follow the instructions but didn't see any "raw" button to download. I will attach a video screenshare to show what I did...https://user-images.githubusercontent.com/13949350/124803075-44ba3900-df1e-11eb-9157-246a92bcc7fc.MOV

CloudFlare for team

I used your main config for Cloudflare

and I tried to change the IP's for Cloudflare team instead of Cloudflare public IPs.
I installed the profile on iOS 14.5, query are resolved but somehow not filtered

(I have a block list on Cloudflare for team and I can access blocked domain)

im not sure what Im missing

UncensoredDNS

Hi,
would be nice to have DoH config files for Anycast and Unicast servers provided by UncensoredDNS. There are also specific DoT servers too.

https://blog.uncensoreddns.org/dns-servers/

Please add Nextdns TLS/HTTPS with custom id profiles

Because their profiles suck, don’t even import and don’t have support for DOH/DOT.

Thankfully macOS can just add the VPN profile from the macOS app and connect from Network setting without the app after but I don’t think iOS is as lucky.

Plus would be cool if I could edit the profile myself and choose preferred DNS server since their 2nd backup one is usually like 2x as fast or more — though I don’t know if that would work with their custom ID DNS profile for dashboard/filters and whatnot.

Cloudflare DNS over HTTPS typo

This line:

https://github.com/paulmillr/encrypted-dns/blob/master/cloudflare-https.mobileconfig#L23

... should probably say Configures device to use Cloudflare Encrypted DNS over HTTPS, not TLS.

DoH over non standard port

Unfortunately I need to create a profile for an Inhouse (non-public) DoH proxy. Creating the profile was quite easy by modifying the google profile provided here, but I stuck at the point that I need to run the DoH proxyy on another port than 443.
Can I define the port somewhere in profile?

Encrypted DNS (HTTPS over DNS)

Blog post doesn't take into account TLS Server Name Indication means middlemen can still see hostnames

With Encrypted DNS, the middlemen will only see 91.198.174.192 — which is an IP of wikipedia.org. Hold on, there’s a nice detail. Ipinfo.org tells us there are at least 19 domain names associated with this IP! In fact, you could be visiting invoker.com — which has the same IP today. The ISP would not know the difference.

The ISP will be able to (with a bit more difficulty) see the TLS ALPN SNI hostname sent plaintext, which all major browsers and some clients will send, however it is still correct the DNS itself would not be susceptible.

doh not working in iphone !

the tls profile working perfect

the doh is not !

iphone x 14.3

AdGuard DNS Non-filtering

Please add AdGuard DNS Non-filtering: https://kb.adguard.com/en/general/dns-providers#non-filtering

Wrong IP addresses in canadianshield-protected-https.mobileconfig

The IP addresses in canadianshield-protected-https.mobileconfig currently end in 10 when they should all end in 20 per the instructions on the Canadian Shield website.

I checked all the other mobileconfig files for Canadian Shield, and they have the right IP addresses.

Thanks for posting these mobileconfig files for us Canadians!

cloudflare-tls.mobileconfig ServerName should be one.one.one.one

https://developer.apple.com/documentation/devicemanagement/dnssettings/dnssettings

If no ServerAddresses are provided, the hostname will be used to determine the server addresses. This key must be present only if the DNSProtocol is TLS.

The ServerName string used is cloudflare-dns.com which is in the X509v3 Subject Alternative Name of the certificate, but resolves to web servers for Cloudflare's DNS. The ServerName should probably be one.one.one.one which resolves to the actual DNS servers.

OpenDNS profile doesn't work

We're having reports that opendns doesn't work while cloudflare does.

All IP addresses and URL query match the official docs. Not sure how to debug this

https://support.opendns.com/hc/en-us/articles/360038086532-Using-DNS-over-HTTPS-DoH-with-OpenDNS

some problem

After removing the description file, there is still a dns over https item in the network settings

Why does it say "Not Running" even though I already installed the profile.

What can I do if it's "not running" in my network settings?

/etc/resolver configuration not working

When this profile is enabled on my mac, this configuration file in /etc/resolver/docker is not working:

#/etc/resolver/docker

nameserver 127.0.0.1
port 19322 

Are there any change can I make in the profile to make it works?

Need for system-wide profile

In Mac, Safari uses the encrypted dns, all other apps like terminal and App Store use the unencrypted dns server from network settings.
Could you please create a profile that uses system-wide encrypted dns?

dospod config is not work

severaddress is wrong

About DNSPod's Server Address

hi,
I saw that the readme file don't have DNSPod's Public DNS website address, there is https://dns.pub
and we do also have DoT service, url is dot.pub
thanks

Add cloudflare malware

Primary DNS: 1.1.1.2
Secondary DNS: 1.0.0.2
https://security.cloudflare-dns.com/dns-query

Add a Warning about iCloud private Relay.

Hello @paulmillr
It can be interesting to add a warning, that iCloud private relay redirect DNS query AND only DNS query of Safari (for now).

So for those who use it they must continue to install profile for DNS query of other APP and Warning them if they use it with profile of DNS who do Adblock the Adblock capability will not work on safari.

Censorship?

Hello,
can you please advise what does censorship imply? This is not clear to me.
Thanks,
Dan

It is recommended to add Tencent DOH and DOT

First of all, thank you very much for the description file. It is recommended to add Tencent DOH and DOT. The DOH address is https://doh.pub/dns-query, and the DOT address is dns.pub or doh.pub