How to set up DNS filtering on iPhone

Why your iPhone needs DNS filtering

An iPhone is not just a phone with a browser. It's a pocket computer running dozens of apps that each talk to the internet on their own: news apps fetching articles, games loading ads, social apps phoning home to analytics servers, email clients pulling tracking pixels. Every one of those connections starts with a DNS lookup, and on a stock iPhone, every one of those lookups goes to your carrier's or your Wi-Fi network's DNS server with no filtering and no encryption.

That matters in two concrete ways. First, without filtering, nothing stops a malicious link in a text message from resolving to a phishing page, and nothing stops a free game from hammering ad networks in the background. Second, without encryption, anyone on the same network, the coffee shop Wi-Fi, the hotel network, your ISP, can see every domain your phone looks up, which is a surprisingly complete picture of what you do online.

DNS filtering on iPhone fixes both at once. A filtering DNS server refuses to resolve known-bad domains, so phishing pages, malware hosts, ad networks, and trackers never get an answer and never load. DNS-over-HTTPS encrypts the lookups themselves, so nobody on the network can read or tamper with them. And because iOS lets you install this as a configuration profile, it applies system-wide: Safari, Chrome, and every app on the phone, on Wi-Fi and on cellular data, with no per-app setup.

What you'll need

You need two things: a Koru Shield account and an iPhone or iPad running a recent version of iOS. The encrypted DNS profile feature has been supported since iOS 14, so anything from the last several years works fine. You don't need to install an app, you don't need to keep anything running in the background, and you don't need to jailbreak or change any developer settings. The profile is a standard Apple configuration file, the same mechanism companies use to configure work phones.

If you don't have an account yet, create one free at my.korushield.com. The free plan includes always-on DNS filtering, so you can complete this entire setup without entering a credit card.

Step 1: Get your personal DNS profile

Sign in at my.korushield.com in Safari on your iPhone. Open the Devices section, tap Add device, and choose iPhone or iPad. Your dashboard generates a personal encrypted DNS configuration profile, a small file ending in .mobileconfig that is unique to your account. That personal part matters: your filtering rules, your blocklists, and your usage stats are tied to your profile, not shared with anyone else.

Step 2: Download the profile

Tap the download button for the profile shown in your dashboard. Safari will download the .mobileconfig file and show a prompt saying the profile was downloaded. This is Apple's standard flow for configuration profiles, the same one you'd see when joining a corporate Wi-Fi network or installing a VPN configuration. Nothing has been installed yet at this point; the file is just sitting in your downloads waiting for your approval.

Step 3: Install the profile

Open the Settings app. Near the top, just under your Apple ID name, you should see a notice that says Profile Downloaded. Tap it, then tap Install in the top-right corner. Enter your device passcode when asked, tap Install again on the consent screen, and tap Done.

If you don't see the Profile Downloaded notice, which sometimes happens if you navigated away, go to Settings, then General, then VPN and Device Management. Your downloaded Koru Shield profile will be listed there under Downloaded Profile. Tap it and install from there. Either path ends in the same place: an installed DNS configuration that iOS applies to every network connection.

Step 4: Confirm it's working

Go back to your Koru Shield dashboard and check the Devices section. Your iPhone should show as connected, usually within a few seconds of installing the profile. Then run a real test: visit korushield.com/test-protection on your iPhone. That page includes checks that confirm your DNS queries are going through Koru Shield's filtered, encrypted servers. You can also try visiting a domain you know is on one of your blocklists, for example an ad-heavy test site, and confirm it no longer loads its ads.

One more check worth doing: toggle between Wi-Fi and cellular data and repeat the test. The profile applies to both, which is the whole point. A lot of filtering setups only work on your home Wi-Fi and silently stop the moment you leave the house. The iOS DNS profile doesn't have that gap, because the setting lives on the device, not on the network.

What the profile actually blocks

Once installed, every DNS lookup from your iPhone is checked against Koru Shield's blocklists before it resolves. Out of the box, that includes phishing domains, malware distribution hosts, and known malicious infrastructure. Ad and tracker blocking is available as a category you can toggle on in your dashboard, and family plans can add content categories like adult sites or gambling.

Because the block happens at the DNS lookup stage, blocked content never loads at all. You won't see an ad placeholder where an ad would have been; the ad network's domain simply never resolves, so the page or app renders as if the ad request was never made. Pages load faster, apps use less data, and your battery lasts a little longer because your phone isn't downloading and rendering content you never asked for.

Managing the profile later

The profile stays installed until you remove it, and it survives iOS updates. If you ever want to pause filtering, go to Settings, General, VPN and Device Management, tap the Koru Shield DNS entry, and toggle it off without deleting it. To remove it entirely, tap Remove Profile on the same screen. Your dashboard will show the device as disconnected the next time it checks in.

If you get a new iPhone, just repeat the four steps above. Each device gets its own profile from your dashboard, so you can see per-device stats and apply different filtering rules to different devices, for example stricter categories on a kid's phone and a lighter setup on your own.