Run test

Encrypted DNS setup

Generate paste-ready DoH and DoT configuration for any device or resolver — an Apple profile, Android Private DNS, Windows 11, Pi-hole, AdGuard Home, Unbound, systemd-resolved, or a router. Built in your browser from the resolver's real endpoints.

Updated 6 min read

Where Download, then open the file → Settings → “Profile Downloaded” → Install.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>PayloadContent</key>
  <array>
    <dict>
      <key>DNSSettings</key>
      <dict>
        <key>DNSProtocol</key>
        <string>HTTPS</string>
        <key>ServerURL</key>
        <string>https://cloudflare-dns.com/dns-query</string>
        <key>ServerAddresses</key>
        <array>
          <string>1.1.1.1</string>
          <string>1.0.0.1</string>
          <string>2606:4700:4700::1111</string>
          <string>2606:4700:4700::1001</string>
        </array>
      </dict>
      <key>PayloadType</key>
      <string>com.apple.dnsSettings.managed</string>
      <key>PayloadVersion</key>
      <integer>1</integer>
      <key>PayloadIdentifier</key>
      <string>com.testsdns.dnsSettings.5BCBBA17-0DEC-4240-86AD-58DB3BC08064</string>
      <key>PayloadUUID</key>
      <string>5BCBBA17-0DEC-4240-86AD-58DB3BC08064</string>
      <key>PayloadDisplayName</key>
      <string>Cloudflare DNS encrypted DNS (DoH)</string>
    </dict>
  </array>
  <key>PayloadDisplayName</key>
  <string>Cloudflare DNS DNS (DoH) — TestsDns</string>
  <key>PayloadIdentifier</key>
  <string>com.testsdns.214D12F8-B87C-4E31-A1EC-3BDCC8E1DB22</string>
  <key>PayloadType</key>
  <string>Configuration</string>
  <key>PayloadUUID</key>
  <string>214D12F8-B87C-4E31-A1EC-3BDCC8E1DB22</string>
  <key>PayloadVersion</key>
  <integer>1</integer>
  <key>PayloadDescription</key>
  <string>Configures DoH encrypted DNS for Cloudflare DNS. Generated by testsdns.com — review before installing.</string>
</dict>
</plist>

Unsigned profiles show as “Not Verified” — that's normal for a hand-generated profile. Review the DNS server before installing. On macOS: System Settings → General → VPN & Device Management.

Generated in your browser from Cloudflare DNS's published endpoints — DoH https://cloudflare-dns.com/dns-query · DoT 1dot1dot1dot1.cloudflare-dns.com. Nothing is sent to us or stored.

What encrypted DNS does

Encrypted DNS (DoH / DoT)

Encrypted DNS wraps your DNS lookups in an encrypted channel so no one on the network path can read or change which sites you resolve. DoH carries the query inside HTTPS; DoT uses a dedicated TLS connection on port 853. This tool generates the exact config for each device from a resolver's real endpoints.

By default, DNS travels in plain text on port 53 — your ISP, a public Wi-Fi operator, or anyone on the path can log or tamper with it. Encryption closes that gap for the lookup itself.

What each config sets up

iOS & macOS
A downloadable .mobileconfig profile that turns on DoH or DoT system-wide.
Android
The Private DNS hostname (DoT) for Settings → Network → Private DNS.
Windows 11
netsh commands that register a DoH template and switch the adapter to encrypted DNS.
Pi-hole
A cloudflared DoH-proxy config plus the upstream to set in Pi-hole.
AdGuard Home
DoH and DoT upstream lines — AdGuard Home speaks both natively.
Unbound
A DNS-over-TLS forward-zone block for /etc/unbound/.
systemd-resolved
A resolved.conf block with DNSOverTLS turned on.
Routers
The resolver addresses, plus the DoH/DoT endpoints for firmware that supports them.

What it doesn't do

Encrypting DNS hides which domains you look up from your ISP and from anyone on the local network, and it stops them from redirecting your lookups. It does not hide the IP address each connection ultimately goes to, and on most sites the plaintext server name (SNI) is still visible during the TLS handshake — so encrypted DNS is a real privacy layer, but it is not anonymity and not a VPN. It also doesn't change who answers your queries: the resolver you point it at still sees your lookups, which is why the resolver's own logging policy matters. Pair encrypted transport with a no-log resolver for both.

Once you've applied a config, confirm it's actually encrypted with the DNS leak test, and check the resolver is fast on your connection with the DNS speed test.

Encrypted DNS — frequently asked questions

What is encrypted DNS (DoH and DoT)?

Encrypted DNS wraps your DNS lookups so no one on the network path can read or tamper with which sites you look up. DNS-over-HTTPS (DoH) sends the query inside a normal HTTPS request; DNS-over-TLS (DoT) uses a dedicated TLS connection on port 853. Both encrypt the same lookups — they differ in how they travel.

DoH or DoT — which should I pick?

For a single device, either is fine; DoH is harder for a network to block because it looks like ordinary HTTPS, while DoT is cleaner to run on routers and resolvers because it uses a dedicated port. This generator gives you whichever the platform prefers: Android and most router/server setups use DoT, while browsers, Windows 11, and the Apple profile use DoH.

Is the iOS/macOS profile safe? Why does it say “Not Verified”?

The .mobileconfig is a plain-text Apple configuration profile generated in your browser — you can open it in any text editor and read exactly what it sets before installing. It shows as “Not Verified” only because it isn't cryptographically signed by a paid Apple certificate; that's expected for a self-generated profile and doesn't mean it's unsafe. It sets one thing: your encrypted DNS server.

Does encrypted DNS hide my browsing completely?

No. It encrypts the DNS lookup, so your ISP and others on the network can't see or alter which domains you resolve. But your ISP still sees the IP address each connection goes to, and often the plaintext server name (SNI) during the TLS handshake. Encrypted DNS is a meaningful privacy layer, not anonymity and not a VPN.

Do I need to set this up on every device?

DNS settings are per-device unless you configure them at the router or a network-wide resolver like Pi-hole or AdGuard Home. Setting encrypted DNS once on a router (with supporting firmware) or on Pi-hole/AdGuard Home covers every device on the network; otherwise use the per-platform config here on each device.

Does encrypted DNS slow things down?

The overhead is small and one-time per connection — the encrypted channel is reused for later lookups. Any difference is usually far smaller than the difference between resolvers. Run the DNS speed test to confirm your chosen resolver is fast on your connection.