↓ Skip to main content
Ixonae on Security
  1. Posts/

Using Encrypted DNS on iPhone Across Cellular and Wi-Fi

·5 mins
Ixonae
Networking Privacy
Table of Contents

I recently wanted to change my default DNS servers on my iPhone - for both cellular and WiFi networks - by secure DoH ones. Sadly, there is no option to do so in the configuration settings (unless you only want to set the DNS servers for specific WiFi networks only.)

In this article I will walk you through why you may want to do it as well, and how.

What is DoH and DoT
#

Historically, the DNS protocol is pretty bad for confidentiality, and your DNS requests will transit in clear text on your networks. Among other things, it means that whoever is providing you the network can see what websites you are accessing.

To prevent that, DoT (DNS over TLS) and DoH (DNS over HTTPS) were standardized in 2016 (RFC 7858) and 2018 (RFC 8484), respectively.

Using them allows making DNS requests over a secure connection rather than in clear with port 53 UDP.

While adoption is growing, encrypted DNS is still not used everywhere. Firefox began enabling DoH by default for US users in 2020. Chrome can automatically upgrade to DoH when the configured DNS provider supports it. Apple added native DoH and DoT support in iOS 14, also in 2020.

Why to override your default DNS
#

On iPhone, DNS settings usually come from the network:

  • The Wi-Fi network (often through its router), unless you manually set DNS for that network.
  • Your mobile network provider on cellular.

When DNS queries are unencrypted, the network operator may be able to see the domain names you look up.

Overriding DNS with DoH or DoT helps protect queries from observation or tampering on the path between your device and the resolver. It can improve your privacy, but it does not provide total privacy: when you connect to a website, its domain name is usually visible in the TLS handshake (and off course the resolver you choose can still see your queries.)

To help prevent that, the ECH (Encrypted Client Hello) feature was created, but it requires both the owner of the service you want to access and the software you use to support it. The MozillaWiki resource below currently says WebKit/Safari has indicated support but has not implemented ECH.

How to override the DNS
#

Apple does not let you configure DNS servers for cellular through Settings, so you need to create a profile to use your chosen DNS across cellular and Wi-Fi networks.

Configuration profiles are XML property files, with a .mobileconfig extension.

Until iOS 27, DNSSettings was the recommended configuration option, and it made things simple because you could just write XML into your file and be done with it.

This was, however, deprecated for iOS 27 and later. The new configuration object, com.apple.configuration.network.dns-settings is fairly similar in structure, but a bit more complex to use, because it needs to be encoded in base64 and integrated in a Declaration object.

To help with that, I added a new tool to my Web Tools Utils.

The tool lets you include one or multiple DNS providers that you wish to use, and optionally let you configure some specific Wi-Fi networks where you will not use them. Note that there are other filters that can be applied, such as the type of connection (Wi-Fi, cellular, and so on), but I don’t use them so I did not include them.

If you want to edit your configuration later, you can also upload it to the tool again, so that the various identifiers stay the same, letting the operating system know that you are updating an existing configuration rather than adding a new one.

Once you have the profile on your device, it can be installed as follows:

  • Open the file. It will be marked for review.
  • Go to “Settings / General / VPN and Device Management”
  • You will see the profile under “Downloaded Profile”
  • Select the profile, and you will be shown some details about what it contains
  • Select install, enter your passcode, select install again
  • Now, if you go to “Settings / General / VPN and Device Management” again (note that the last one became “VPN, DNS & Device Management”), you can see a new “Restrictions and Proxies” Section with a “DNS” setting. There, you can select the DNS that you wish to use if your file contained multiple of them.

In the new unlocked setting dropdown, you will also notice an “Automatic” option. Selecting it will revert to the default behaviour (i.e. not using the DNS servers that you configured.)

Once everything is set up, you can use this tool to check whether your device is behaving as expected.

Extra Resources
#

Related