Set up encrypted DNS on any device

Every time a device opens a site or an app, it first asks a resolver to turn a name such as example.com into an address. That question normally goes, in the clear, to whichever resolver your internet provider chose for you.

DeCloudUs answers that question instead, over an encrypted connection, and refuses to answer for anything you have chosen to block — ads and trackers, malware, adult content, or a single app such as TikTok. Nothing is installed, because the setting is one your device already has. Filtering happens before a connection is ever made, so it applies to apps and smart devices, not only to a browser.

Each profile you create gets its own resolver hostname, shaped like yourprofile.dns.decloudus.com. That hostname is what carries your rules, which is how one household can filter a child’s tablet differently from a work laptop.

The steps below are written to be followed by anyone, with the hostname shown in the shape it takes rather than as a real value — yours does not exist until you have a profile.

Once you do, the dashboard is the easier path: it shows your exact hostname, the DNS-over-HTTPS URL and the DNSCrypt stamp with a button to copy each one, generates the Apple configuration profile as a file you download, and gives per-device instructions for whatever you are setting up. Nothing has to be typed out by hand or adapted from a generic example.

The same hostname works in all three places. What differs is how much it covers and how far it travels.

There are three, and the device usually decides for you. DNS-over-TLS is what Android and most routers speak, and it is the hostname on its own. DNS-over-HTTPS is what Windows 11 and browsers speak, and it is the same name as a URL ending in /dns-query. DNSCrypt is the older of the three, used by DNSCrypt-proxy and some routers, and it is identified by a stamp rather than a name.

All three reach the same resolvers and apply the same rules. Pick whichever the device in front of you supports; the dashboard shows all three forms of your address side by side.

1. Open Settings, then Network & internet, then Private DNS. On some phones it is under Connections, then More connection settings.
2. Choose "Private DNS provider hostname".
3. Enter your profile hostname and save.

Android 9 and later. The setting covers every app, not just the browser, and stays active on mobile data as well as Wi-Fi — which is why a child’s phone cannot get around it by leaving the house.

1. Download your configuration profile from the dashboard.
2. On iPhone or iPad, open Settings — it appears near the top as "Profile Downloaded" — and install it.
3. On a Mac, open the file, then approve it in System Settings under Device Management.

The profile can carry DNS-over-HTTPS or DNS-over-TLS. Because it is a system profile it covers apps as well as Safari and survives a reboot. iOS 14, iPadOS 14 and macOS 11 or later.

1. Open Settings, then Network & internet, then your active adapter (Wi-Fi or Ethernet).
2. Next to DNS server assignment choose Edit, switch to Manual, and turn on IPv4.
3. Enter the resolver address, set DNS over HTTPS to On (Manual template), and save.

Windows 10 has no built-in support. Use DNSCrypt-proxy or a browser setting there instead — both are covered below.

1. Open your router’s admin page and find the DNS or WAN settings.
2. Replace the DNS servers your ISP provided with the resolver address.
3. Reboot the router, or renew the lease on a device, so the change takes effect.

UniFi, OPNsense, pfSense and OpenWrt can go further and forward over DNS-over-TLS, so the queries are encrypted between your router and us rather than only filtered. A basic ISP router usually cannot, and some refuse to let you change DNS at all — in that case set it per device.

1. systemd-resolved — set DNSOverTLS and the hostname in resolved.conf.
2. Stubby — add the profile hostname as a DNS-over-TLS upstream, authenticated by hostname.
3. Unbound — a forward-zone to the resolver with forward-tls-upstream enabled.
4. DNSCrypt-proxy — add the DNSCrypt stamp from your dashboard as the only upstream.
5. Pi-hole or AdGuard Home — set the resolver as the upstream and let it handle the encryption.

These are the setups where you control validation as well as transport. The dashboard prints the exact stamp, hostname and config snippet for each one, so none of it has to be assembled by hand.

1. Firefox: Settings, Privacy & Security, Enable secure DNS using — Max Protection, with a custom provider.
2. Chrome or Edge: Settings, Privacy and security, Security, then Use secure DNS with a custom provider.
3. Paste the DNS-over-HTTPS URL from your dashboard.

This filters that browser alone. Apps, other browsers and smart devices keep using whatever DNS the device is set to — which is also why a browser with its own secure DNS can appear to ignore a device-wide setting.

The quickest confirmation is that something you expect to be blocked stops resolving. Turn on a category — ads and trackers is the easiest to see — and load a page that normally carries them.

For proof rather than an impression, the dashboard has a query log: switch it on for the profile and you will see the names that device is asking for, and which were blocked and why. If queries appear there, the device is reaching us. A public tool such as dnsleaktest.com answers the same question from the other side: it reports which resolver answered for you, which should be ours and not your provider’s.

The dashboard also has a troubleshooting page that queries your profile directly and shows the answer it got. That separates “the rule is not doing what I thought” from “this device is not using the resolver at all”, which are the two things that feel identical from the outside.

Almost always, something else is answering first. In rough order of how often it is the cause:

• A VPN. Make sure to change your VPN app settings to use the device's own DNS configuration instead of the DNS provider's own DNS.
• A browser with its own secure DNS. Chrome, Edge and Firefox have DNS settings tht somes default to using other DNS resolvers, so you have to make sure to disable that.
• A device with DNS hardcoded. Streaming sticks, consoles and some smart TVs ignore what they are given. Those are the ones a router setting is for — and the ones that show why blocking at the DNS layer matters.

Do I need to install an app?

No. Every current operating system and device can speak encrypted DNS by itself, so setup is a setting rather than software. Apple devices take a small configuration profile, which your dashboard generates for you; nothing runs in the background and there is nothing to keep updated.

Is this a VPN?

No. A VPN sends all of your traffic through someone else’s network. This changes only which DNS resolver answers the question "what is the IP address for this website", and encrypts that question and answer to keep it secure. Your traffic still goes straight to the sites you visit, which is why it does not slow browsing down the way a VPN can.

Will it slow my connection?

Not at all. In fact, it should speed it up in most cases. A name lookup happens once per domain and is then cached by your device, and our resolvers are all over the the world, so the lookup is answered near you. Blocking, in fact, removes load from your device and speeds it up, for example blocking ads and trackers.

Does it work on mobile data, away from home?

Yes, when it is set on the device. Android’s Private DNS and an Apple configuration profile both stay in force on whether you are inside your home or outside and whether you are on mobile data or any Wi-Fi. A router setting, by contrast, only applies while the device is on that network.

Can I use it together with a VPN?

Yes, usually, but the VPN app you use controls that. Modern VPN apps, like OpenVPN, have specific settings that honors your device or network DNS settings (where DeCloudUs is already set).

What if a device ignores the setting?

Something else is answering your DNS queries. The usual causes are misconfigured VPN app or a browser with secure DNS still pointing at its default provider

Do I have to set up every device separately?

Only if you want each of them to have its own rules. One setting on the router covers the whole house at once; separate device profiles are what let a child’s tablet and your laptop be filtered differently.

What happens if your DNS resolver is unreachable?

We have many resolver nodes all over the world. While it is possible one of them may experience a temporary issue, you will not notice any impact because another healthy resolver closest to you will take over without you noticing.

How is this different from setting my DNS to a public resolver like 1.1.1.1 or 9.9.9.9?

A public resolver answers the same for everyone. Here the DNS profiles you create and configure are custom to you and your needs: your profiles carry your allow and block rules, your schedules and your safe-search settings, and create many different DNS profiles with completely different rules.

The walkthroughs go further for the things people most often want: parental controls, enforcing safe search, blocking TikTok, smart TV tracking, cutting out Google and the rest of the guides.