What iOS allows
Apple lets you change the DNS server per Wi-Fi network in Settings, but there is no user-facing switch for encrypted DNS. System-wide DNS-over-HTTPS or DNS-over-TLS on iOS 14 and newer is installed through a small configuration profile (a signed .mobileconfig file). That profile is the right way to use dnsdome on a phone that leaves the house, because it works on mobile data and identifies your profile by token rather than by IP.
Option 1: encrypted DNS everywhere (configuration profile)
- Sign in to the dnsdome panel, open the profile for this device, and note its DNS-over-TLS hostname from the Encrypted DNS card. It looks like
<token>.dns.dnsdome.com. - Open a support ticket from the panel's Help page asking for an Apple configuration profile for that dnsdome profile. We generate one that carries only a DNS Settings payload, nothing else, and send it to your account email.
- Open the .mobileconfig on the iPhone (from Mail or Files). iOS says "Profile Downloaded".
- Go to Settings → General → VPN & Device Management, tap the dnsdome profile and tap Install.
- Load a website, then check the query log in the panel. Entries from the phone appear within a minute.
Prefer to build the profile yourself? Apple Configurator on a Mac can create a DNS Settings payload: protocol DNS-over-TLS, server name <token>.dns.dnsdome.com, server address 87.244.198.165. Self-made profiles show as unsigned in iOS but work the same.
Known limits
- iOS disables the encrypted DNS profile while any VPN with its own DNS is connected.
- Some captive-portal Wi-Fi networks need the portal page to load first; iOS handles this by temporarily bypassing the profile.
- Safari has no in-browser DoH setting, so the profile is the only way to cover it.
Option 2: plain DNS on one Wi-Fi network
- In the panel, add your home network's public IP to the profile's allowlist. The panel shows the IP you are connecting from.
- On the iPhone open Settings → Wi-Fi, tap the i next to your network, then Configure DNS.
- Switch to Manual, remove the existing servers and add
87.244.198.165. Tap Save.
This applies to that one Wi-Fi network only and does nothing on mobile data. If you have access to the router, set DNS there instead and every device at home is covered without touching each phone; see any router.