Set up DeCloudUs on any device

Every profile has its own resolver hostname, shaped like yourprofile.dns.decloudus.com. That hostname is what carries your filtering rules, so the steps below are the same for everyone but the value is yours alone.

You will find it, along with a ready-made Apple configuration profile and a DNSCrypt stamp, on the profile page in your dashboard. The DNS-over-HTTPS form of the same address is https://yourprofile.dns.decloudus.com/dns-query, and DNS-over-TLS uses the hostname on port 853.

1. Open Settings, then Network & internet, then Private DNS.
2. Choose "Private DNS provider hostname".
3. Enter your profile hostname and save.

This is DNS-over-TLS and it applies to the whole phone — every app, not just the browser. It stays active on mobile data as well as Wi-Fi.

1. Download your configuration profile from the dashboard.
2. On iOS, open Settings — the profile appears under "Profile Downloaded" — and install it.
3. On macOS, open the file and approve it in System Settings under Device Management.

The profile can use DNS-over-HTTPS or DNS-over-TLS. Because it is a system profile, it covers apps as well as Safari, and survives reboots.

1. Open Settings, then Network & internet, then your active adapter.
2. Under DNS server assignment choose Edit, then Manual, and switch on IPv4.
3. Enter the resolver address, set DNS over HTTPS to On, and save.

On Windows 10, which has no built-in support, use dnscrypt-proxy instead — covered under advanced clients below.

1. Open your router admin page and find the DNS or WAN settings.
2. Replace the ISP-provided DNS servers with the resolver address.
3. Reboot the router, or renew the lease on a device, so the change takes effect.

UniFi, OPNsense, pfSense and OpenWrt can go further and forward over DNS-over-TLS, which keeps the queries encrypted between your router and us rather than only filtered.

1. dnscrypt-proxy — add the DoH stamp from your dashboard as the only upstream.
2. Stubby — set the profile hostname as a DNS-over-TLS upstream with authentication by hostname.
3. Unbound — forward-zone to the resolver with forward-tls-upstream enabled.
4. systemd-resolved — set DNSOverTLS and the hostname in resolved.conf.

These are the setups where you control validation as well as transport. The dashboard generates the exact stamp and hostname for each one.

1. In Firefox: Settings, Privacy & Security, then Enable secure DNS with a custom provider.
2. In Chrome: Settings, Privacy and security, Security, then Use secure DNS with a custom provider.
3. Paste the DNS-over-HTTPS URL from your dashboard.

Browser-only setup filters that browser and nothing else. Apps, smart TVs and other browsers keep using whatever DNS the device is set to.

The quickest confirmation is that something you expect to be blocked stops resolving. The dashboard has a troubleshooting page that queries your profile directly and shows you the answer it got, which distinguishes "the rule is not doing what I thought" from "this device is not using the resolver at all".

If a device seems to ignore the setting, the usual cause is another resolver getting there first: a VPN with its own DNS, a browser with secure DNS still pointed at its default provider, or an ISP router that overrides DNS for its own devices.

Filtering at the DNS layer stops a device reaching a domain. It does not inspect traffic, and it cannot block something served from the same domain as content you want — which is why an ad inside an app that serves it from its own domain will still appear. It also stops applying if a device is moved onto a network that forces its own DNS, or if someone changes the setting back.

For the household case, setting it on the router and on each device is what closes most of that gap. See parental controls for how profiles and schedules fit together.