pungaagin / encrypted-dns

Configuration profiles for DNS HTTPS and DNS over TLS for iOS 14 and MacOS Big Sur

encrypted-dns-configs

Configuration profiles for DNS over HTTPS and DNS over TLS.

Check out the article for more info: paulmillr.com/posts/encrypted-dns/

Providers

Name	Country	Censorship	Notes	Install button
AdGuard	🇷🇺	🔴	Operated by AdGuard in Russia	HTTPS
AdGuard Family	🇷🇺	🔴	Filters malware & adult content	HTTPS
AdGuard No Filter	🇷🇺	🟢	Filters Unfiltered	HTTPS, TLS
Alekberg	🇳🇱	🟢	Independent hoster in Netherlands	HTTPS
BlahDNS CDN Filtered	🇺🇸	🔴	Independent	HTTPS
BlahDNS CDN Unfiltered	🇺🇸	🟢	Independent	HTTPS
BlahDNS Finland Adsblock	🇫🇮	🔴	Independent	HTTPS
BlahDNS Germany Adsblock	🇩🇪	🔴	Independent	HTTPS
BlahDNS Japan Adsblock	🇯🇵	🔴	Independent	HTTPS
BlahDNS Singapore Adsblock	🇸🇬	🔴	Independent	HTTPS
BlahDNS Swiss Adsblock	🇨🇦	🔴	Independent	TLS
Canadian Shield Private	🇨🇦	🟢	Operated by the Canadian Internet Registration Authority (CIRA)	HTTPS, TLS
Canadian Shield Protected	🇨🇦	🔴	Filters malware	HTTPS, TLS
Canadian Shield Family	🇨🇦	🔴	Filters malware & adult content	HTTPS, TLS
Cloudflare	🇺🇸	🟢	Operated by Cloudflare 1.1.1.1	HTTPS, TLS
Cloudflare Malware	🇺🇸	🔴	Filters malware	HTTPS
Cloudflare Family	🇺🇸	🔴	Filters malware & adult content	HTTPS
DNSPod	🇨🇳	🔴	Operated in mainland China	HTTPS, TLS
Google	🇺🇸	🟢	Operated by Google	HTTPS, TLS
OpenDNS	🇺🇸	🟢	Operated by OpenDNS	HTTPS
OpenDNS Family	🇺🇸	🔴	Filters malware & adult content	HTTPS
Quad9	🇨🇭	🔴	Operated by CleanerDNS, Inc. Filters malware	HTTPS, TLS
Quad9 With ECS	🇨🇭	🔴	Operated by CleanerDNS, Inc. Filters malware	HTTPS, TLS
Tiar.app	🇸🇬 🇺🇸	🔴	"Privacy-first DNS provider" from SG, hosted on Digital Ocean. Filters malware	HTTPS, TLS

Installation

To make settings work across all apps in iOS 14 & MacOS Big Sur, you’ll need to install configuration profile. This profile would tell operating system to use DOH / DOT. Note: it’s not enough to simply set server IPs in System Preferences — you need to install a profile.

To install, simply open the file in GitHib, and then click/tap on install button. The profile should download. On macOS, double click on the downloaded file to open it in settings, and approve instalation. On iOS, go to System Settings => General => Profile, select downloaded profile and tap the “Install” button.

Signed Profiles

In the signed folder, we have signed versions of the profiles in this repository. These profiles have been signed by @Candygoblen123 so that when you install the profiles, they will have a verified check box on the installation screen. It also ensures that these profiles have not been tampered with. However, since they were signed by a third party, they may lag behind their unsigned counterparts a little.

To verify resolver IPs and hostnames, compare mobileconfig files to their documentation URLs. Internal workings of the profiles are described on developer.apple.com. In order to verify signed mobileconfigs, you will need to download them to your computer and open them in a text editor, because signing profiles makes GitHub think that they are binary files.

Known issues

We can't fix the issues, only Apple can:

• Little Snitch / Lulu disable Encrypted DNS
• Some traffic e.g. Terminal / App Store is except from EDNS
• Chrome is except from EDNS
• VPN disable EDNS