GraceDNSiOS and macOS setup#
iPhone, iPad and Mac support encrypted DNS system-wide through a configuration profile (a small .mobileconfig file that tells the system to use DNS over HTTPS or DNS over TLS with your configuration id).
Honest status: profile generator coming soon#
A one-click signed profile download from your GraceDNS settings page is being built and is not available yet. Until it ships, you have two working options today.
Option 1: build the profile yourself (works now)#
Apple's profile format is documented and plain XML. Create a .mobileconfig with a com.apple.dnsSettings.managed payload using either:
- DNS over HTTPS:
ServerURL=https://dns.gracedns.eu/<configid> - DNS over TLS:
ServerName=<configid>.dns.gracedns.eu
Replace <configid> with your configuration id. Send the file to your device (AirDrop or email), open it, then install it under Settings, General, VPN and Device Management (macOS: System Settings, Privacy and Security, Profiles). If you manage devices with an MDM, deploy the same payload through it.
Option 2: per-browser DoH (works now)#
If you mainly need filtering in the browser, follow the browser DNS over HTTPS guide; Firefox on iOS/macOS and desktop Chrome/Edge support a custom DoH URL without any profile.
Verify#
With the profile installed, visit a domain your configuration blocks; the connection should fail or show your block page.
Notes#
- iOS ignores the encrypted DNS setting while some VPNs are active; the VPN's own DNS wins. See What DNS filtering cannot do.
- Removing the profile removes the filtering. On supervised (school or family-managed) devices, MDM can prevent profile removal.
Back to docs.