DNS Security vs DNS Armor™

Make your DNS private. DNS Security helps protect your privacy by encrypting DNS queries with DNS over HTTPS (DoH) and DNS over TLS (DoT). Choose a provider, enable your DNS configuration, and manage your settings in one place—without routing your internet traffic through a VPN. WHY ENCRYPT YOUR DNS? HTTPS protects the content exchanged with websites, but traditional DNS lookups may still be unencrypted. These lookups translate domain names into IP addresses and can reveal the domains your device requests. Encrypted DNS helps protect queries between your device and your chosen DNS provider from eavesdropping and tampering. Your provider still handles those queries, so choose one whose privacy practices you trust. EVERYDAY DNS CONTROL • Use DNS over HTTPS or DNS over TLS. • Choose built-in profiles for providers including Cloudflare, Google, and AdGuard. • Enable or disable your DNS configuration from the app. • Choose whether DNS settings apply on Wi-Fi, cellular, or both. • Check DNS protocol and provider details in the Status tab. DNS SECURITY OR DNS SECURITY PRO? DNS Security includes the everyday DNS controls above at no cost. It offers an optional Pro in-app purchase for the advanced features below. DNS Security Pro is the paid edition. It includes the same everyday DNS controls plus these advanced features from the start: PRO FEATURES (IN APP PURCHASE) • Create custom DoH and DoT profiles. • Download updates to built-in DNS profiles. • Enable or disable DNS for specific Wi-Fi SSIDs. • Switch profiles with Shortcuts and URL schemes. The difference is advanced control: both editions support encrypted DNS. You can unlock the Pro tools inside DNS Security or choose DNS Security Pro with those tools already included. DESIGNED AROUND PRIVACY DNS Security manages your device's DNS configuration and does not collect personal information. DNS requests are handled by your selected provider under that provider's privacy policy. Encrypted DNS protects DNS queries; it does not make all browsing anonymous. Blocking malicious domains depends on the provider and profile you choose. AUTOMATE YOUR DNS With Pro, use Shortcuts or a compatible app to open a switch URL and select a DNS profile with your preferred network settings. Example: select google-DOH for Wi-Fi, with cellular disabled: dnsapp://switch?config=google-DOH&enableOnWifi=true&enableOnCellular=false Use the scheme for your installed app: • DNS Security Pro: dnssecuritypro:// • DNS Security: dnssecurity:// • Shared scheme: dnsapp:// Replace dnsapp in the example with your app's scheme. The requested profile must already exist in the app. Initial activation may require selecting DNS Security in iOS Settings. Choose your DNS. Control your settings. Add privacy to every lookup that uses your encrypted DNS configuration.

DNS Armor™ for iOS is the iPhone and iPad agent for the Secure Domains DNS Firewall — an enterprise DNS protection service that blocks phishing, malware, command-and-control callbacks, and policy-violating domains at the resolver layer. IMPORTANT — HOW DNS ARMOR WORKS ON iOS DNS Armor™ uses Apple's Network Extension framework (Packet Tunnel Provider, NEPacketTunnelProvider) to install a local on-device VPN. This on-device VPN is the only way Apple permits third-party iOS apps to apply DNS protection system-wide. The VPN exists for one purpose: to intercept DNS queries from every app on your device so they can be securely resolved through your organization's DNS firewall. To be explicit about what this VPN does and does not do: • It intercepts DNS traffic only. Every DNS query from every app — Safari, Mail, Messages, third-party apps, background services — is captured and forwarded to your organization's Secure Domains cloud resolver over an encrypted DNS-over-QUIC (DoQ, RFC 9250) channel with certificate pinning. • It does NOT proxy your web traffic. HTTPS, video, FaceTime, downloads, and every other non-DNS data flow goes directly from your device to its destination, unmodified and never read by DNS Armor™. • It does NOT inspect SSL/TLS, decrypt content, or log browsing activity. • It does NOT route traffic through any external VPN server. The "VPN" is purely an on-device mechanism iOS requires for DNS interception — there is no remote tunnel, no IP-address change, no anonymization. iOS will display the standard one-time system prompt asking you to allow the VPN configuration. This is required for DNS Armor™ to function. The DNS Armor™ agent integrates with Connect-On-Demand for auto-start after reboot, Per-App VPN for BYOD, and Apple's Managed App Configuration channel for MDM-driven zero-touch enrollment. WHAT YOU GET • System-wide DNS protection via on-device Network Extension VPN • Encrypted DNS-over-QUIC with certificate pinning • Cloud-managed policy — your admin controls the blocklist • Per-domain bypass for internal/corporate names that need private DNS resolvers • Auto-start at boot via Connect-On-Demand • Real-time block-page redirection so users see why a site was blocked • Operational status reporting back to your admin console • Full MDM Managed App Configuration support — Jamf, Intune, Workspace ONE, Kandji, Mosyle • Per-app VPN profile compatible for BYOD scenarios • Native IPv4 and IPv6 support end-to-end FOR WHO DNS Armor™ for iOS is built for organizations enrolled in the Secure Domains DNS Firewall. An API code issued by your IT administrator is required to onboard. Without one the app cannot connect — it is not a consumer DNS app. GETTING STARTED Your admin provides an API code. Paste it on first launch, tap Enable Protection, and accept the iOS VPN configuration prompt. From then on, DNS Armor™ stays connected silently and reconnects automatically after reboot. For MDM-managed devices, the API code, hostname, and protection toggle can be pre-populated via Managed App Configuration — first launch completes with no end-user interaction. PRIVACY DNS Armor™ does not log your browsing activity to any third party. Encrypted queries go only to your organization's Secure Domains tenant — never to advertising networks or consumer DNS providers. Non-DNS traffic is not inspected or routed through the agent. The app reports only the minimum operational telemetry needed for enrollment and admin visibility (synthesized device ID, public/private IP, current connection state). See secure-domains.org/privacy. REQUIREMENTS • iOS or iPadOS 16.0 or later • An active Secure Domains DNS Firewall tenant • An API code issued by your administrator DNS Armor™ is a trademark of Secure Domains.