# iOS and macOS setup

iPhone, iPad and Mac support encrypted DNS system-wide through a configuration profile (a small `.mobileconfig` file that tells the system to use DNS over HTTPS or DNS over TLS with your configuration id).

## Honest status: profile generator coming soon

A one-click signed profile download from your GraceDNS settings page is being built and is not available yet. Until it ships, you have two working options today.

## Option 1: build the profile yourself (works now)

Apple's profile format is documented and plain XML. Create a `.mobileconfig` with a `com.apple.dnsSettings.managed` payload using either:

- **DNS over HTTPS**: `ServerURL` = `https://dns.gracedns.eu/<configid>`
- **DNS over TLS**: `ServerName` = `<configid>.dns.gracedns.eu`

Replace `<configid>` with your configuration id. Send the file to your device (AirDrop or email), open it, then install it under **Settings, General, VPN and Device Management** (macOS: **System Settings, Privacy and Security, Profiles**). If you manage devices with an MDM, deploy the same payload through it.

## Option 2: per-browser DoH (works now)

If you mainly need filtering in the browser, follow the [browser DNS over HTTPS guide](browser-doh.md); Firefox on iOS/macOS and desktop Chrome/Edge support a custom DoH URL without any profile.

## Verify

With the profile installed, visit a domain your configuration blocks; the connection should fail or show your block page.

## Notes

- iOS ignores the encrypted DNS setting while some VPNs are active; the VPN's own DNS wins. See [What DNS filtering cannot do](../limitations.md).
- Removing the profile removes the filtering. On supervised (school or family-managed) devices, MDM can prevent profile removal.

Back to [docs](../index.md).