Apple Configuration Profile Editor

Create and edit .mobileconfig profiles for encrypted DNS (DoH/DoT) with Wi-Fi exclusions — everything stays in your browser

Import Existing Profile

Load a .mobileconfig to keep editing it. Profile, payload, declaration and activation identifiers are preserved (a declaration only gets a new ServerToken when its content changes). Everything is read locally in your browser.

DNS Providers

Add one or more DNS providers. Each one becomes its own NetworkDNSSettings declaration (DoH or DoT), and Apple applies multiple configurations separately.

or
Add a custom provider
Optional ServerAddresses, used to reach the server without a DNS lookup.
AllowFailover: if the server is unreachable, fall back to the default resolver.
  • No providers added yet. Add at least one DNS provider above.

Wi-Fi Exclusions

DNS over HTTPS will be disabled on these Wi-Fi networks, for all providers or only the ones you pick. Useful for networks with captive portals or corporate DNS.

    Profile Details

    Reverse-domain identifier, used by macOS/iOS to identify the profile

    Profile Preview

    This profile installs the com.apple.configuration.network.dns-settings declarative configuration (iOS, iPadOS, macOS and visionOS 27+), activated with com.apple.activation.simple and wrapped in a com.apple.declarations profile so it can be installed locally without MDM. It replaces the deprecated com.apple.dnsSettings.managed payload. Install it via Settings > General > VPN & Device Management on iOS, or double-click on macOS. The profile is unsigned — your device will ask you to confirm the installation. Wi-Fi exclusions use OnDemandRules.
    Configure your DNS settings and click Generate to preview the profile