Device configuration profiles for using public dns resolvers (e.g. dns.digitale-gesellschaft.ch or cloudflare-dns.com) by using DNS over TLS and/or DNS over HTTPS on iOS devices. Profile(s) are not protected and can be uninstalled any time. In case a device is passcode protected, the passcode has to be entered in order to correctly install/uninstall the profile.

Settings according to apple device management documentation: https://developer.apple.com/documentation/devicemanagement/dnssettings

Further information and lists of public dns server:

• https://de.wikipedia.org/wiki/DNS_over_TLS#%C3%96ffentliche_DNS-Server
• https://de.wikipedia.org/wiki/DNS_over_HTTPS#%C3%96ffentliche_DNS-Server
• https://dnsprivacy.org/wiki/

In order to exclude certain networks from direct encrypted DNS requests profiles can be adapted for conditional use. Such exclusions can be defined using domain names, network names (SSID) or adress (ranges). One possible use case may be the exclusion of the home network with an own dns resolver for accessing the local NAS system. In order to use such functionality the following code section has to be added to the regular configuration file in which the string "WIFI Network Name" has to be replaced with the corresponding network name which shall be excluded.

<key>OnDemandRules</key>
    <array>
        <dict>
            <key>Action</key>
            <string>Disconnect</string>
            <key>SSIDMatch</key>
            <array>
                <string>WIFI Network Name</string>
            </array>
        </dict>
        <dict>
            <key>Action</key>
            <string>Connect</string>
        </dict>
    </array>

In the subfolder "conditional" there are two sample files for such cases.

• diy_template as name states provides the basic structure. the "#" characters are filler-only-characters and have to be replaced accordingly
• diy_cloudflare-htttps_conditional.mobileconfig is an example config

• open the mobileconfig files via Safari or download it on the device
• click on the file to install it and switch to/open the system settings
• either on top click to install the profile or goto: general -> profiles (at the bottom)
• follow the instructions as shown

• select the desired DNS settings in the VPN & Network settings: System Settings -> General -> VPN & Network
• supplementary note: "automatic" stand for the interface settings (dhcp, fixed ip,...)

• adding digitalcourage.de configuration file
• adding references to dns privacy in README.md

• adding conditional configuration files (template & cloudflare sample)

• quad9 provider added (quad9.net)

• initial version of config files (cloudflare.com & digitale-gesellschaft.ch)