INAL DNS

1. Open Settings.
2. Tap Network & internet (on Samsung: Connections → More connection settings).
3. Select Private DNS.
4. Choose Private DNS provider hostname and enter: dns.inal.cloud
5. Tap Save. Done, this applies to Wi-Fi and mobile data.

Menu names differ slightly between manufacturers. The quickest way is to search the settings for “Private DNS”.

iPhone and iPad

1. Open this page in Safari and tap Download profile. Confirm “This website is trying to download a configuration profile” with Allow and close the notice.
2. Open Settings. Profile Downloaded appears at the top. Tap it (alternatively: General → VPN & Device Management, on older versions General → Profiles).
3. Tap Install in the top right, enter your passcode and confirm twice more with Install.
4. Done. The profile is active immediately and applies to Wi-Fi and cellular. Under General → VPN & Device Management → DNS, “INAL DNS” must be selected.

Mac

1. Download the profile and double-click the file in your Downloads folder. macOS reports “Profile installation”.
2. Open System Settings and go to profile management:
   • macOS 15 and later: General → Device Management
   • macOS 13 and 14: Privacy & Security → Profiles
   • macOS 11 and 12: System Preferences → Profiles
3. Double-click “INAL DNS”, click Install and confirm with your password.

“Unsigned” warning: The profile is not digitally signed, so Apple shows the warning “Unsigned” or “Unverified” during installation. This is normal for self-made profiles. The profile contains only the DNS setting, no certificates and no remote management. You can remove it at any time in the same place via Remove Profile.

1. Open Settings → Network & internet. For Wi-Fi click Wi-Fi → Hardware properties, for a cable connection Ethernet.
2. Next to DNS server assignment click Edit and switch to Manual.
3. Turn on IPv4 and enter as Preferred DNS: 148.251.162.153
4. Below it, set DNS over HTTPS to On (manual template) and enter as DNS over HTTPS template: https://dns.inal.cloud/dns-query
5. Set Fallback to plaintext to Off.
6. Leave Alternate DNS empty and IPv6 turned off, as INAL DNS does not offer IPv6. Click Save.

Afterwards, the connection overview shows “(Encrypted)” after the IPv4 DNS address. The setting applies per network: repeat the steps for any other Wi-Fi.

Alternative via command

In a Command Prompt run as administrator, this command registers the DoH template for the IP address. You still need to enter the DNS server for the connection as described above (steps 1–3).

netsh dns add encryption server=148.251.162.153 dohtemplate=https://dns.inal.cloud/dns-query autoupgrade=yes udpfallback=no

1. Open Settings → Privacy & Security (or type about:preferences#privacy into the address bar).
2. Scroll to the DNS over HTTPS section.
3. Select Max Protection.
4. Under Choose provider, select Custom and enter: https://dns.inal.cloud/dns-query

With “Max Protection”, Firefox uses INAL DNS exclusively and does not fall back to unencrypted DNS. Other programs on the device keep using the DNS server from the network settings.

Chrome

1. Open Settings → Privacy and security → Security.
2. Under Advanced, turn on Use secure DNS.
3. In the menu next to it, choose Custom and enter: https://dns.inal.cloud/dns-query

Edge

1. Open Settings → Privacy, search, and services → Security.
2. Turn on Use secure DNS and select Choose a service provider.
3. Enter in the field: https://dns.inal.cloud/dns-query

Brave

1. Open Settings → Privacy and security → Security.
2. Turn on Use secure DNS and choose Custom.
3. Enter in the field: https://dns.inal.cloud/dns-query

If the option is greyed out, the browser is managed by your organisation or a parental control program is active. Other programs on the device keep using the DNS server from the network settings.

1. Create the folder /etc/systemd/resolved.conf.d/ (if it does not exist yet) and, as root, the file inal-dns.conf in it with this content:

   [Resolve]
   DNS=148.251.162.153#dns.inal.cloud
   DNSOverTLS=yes
   Domains=~.

   Or all in one step in the terminal:

   sudo mkdir -p /etc/systemd/resolved.conf.d
   printf '[Resolve]\nDNS=148.251.162.153#dns.inal.cloud\nDNSOverTLS=yes\nDomains=~.\n' | sudo tee /etc/systemd/resolved.conf.d/inal-dns.conf

   The main file /etc/systemd/resolved.conf stays unchanged and must be a regular file, not a folder. Do not edit /etc/resolv.conf by hand either.

2. Restart the service:

   sudo systemctl restart systemd-resolved

3. Check with resolvectl status: under Global, Protocols must show +DNSOverTLS and DNS Servers must show 148.251.162.153#dns.inal.cloud. resolv.conf mode must be stub.

If resolv.conf mode shows foreign, programs bypass systemd-resolved. Link /etc/resolv.conf back to the stub:

sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf

INAL DNS only answers encrypted (port 853), not via classic DNS on port 53. If a connection, such as a VPN, sets 148.251.162.153 as its own DNS server and resolvectl status shows -DNSOverTLS there, queries go nowhere. In that case, turn on DNS-over-TLS for that connection:

sudo nmcli connection modify "CONNECTION_NAME" connection.dns-over-tls yes
sudo nmcli connection up "CONNECTION_NAME"

The part after # is the server name used for certificate validation. Domains=~. routes all queries preferentially to INAL DNS.

If your router hands out its own DNS servers via DHCP, systemd-resolved may use them as well. With NetworkManager you turn this off per connection (nmcli connection show lists the names):

sudo nmcli connection modify "CONNECTION_NAME" ipv4.ignore-auto-dns yes ipv6.ignore-auto-dns yes
sudo nmcli connection up "CONNECTION_NAME"

In GNOME you can also do this graphically: Settings → Network → gear icon of the connection → IPv4, then turn off the Automatic switch next to DNS.

If you set up INAL DNS directly in the router, all devices in your home network use the service automatically, including TVs, game consoles and guests. Queries are encrypted from the FRITZ!Box to INAL DNS.

1. Open fritz.box in your browser and log in.
2. Go to Internet → Account Information and open the DNS Server tab.
3. Under DNSv4 Servers, keep Use DNSv4 servers assigned by the internet service provider selected. This is how the FRITZ!Box finds the address of dns.inal.cloud.
4. In the DNS over TLS (DoT) section, enable Encrypted name resolution on the internet (DNS over TLS).
5. Enable Enforce certificate validation for encrypted name resolution on the internet.
6. Disable Also allow unencrypted name resolution on the internet. Otherwise the FRITZ!Box silently falls back to unencrypted DNS when problems occur.
7. Enter dns.inal.cloud under Resolution names of DNS servers and click Apply.

Menu names differ slightly depending on the FRITZ!OS version. On older versions, first turn on Advanced View in the bottom left. Keep in mind: the filters then apply to everyone in the home network. Devices that already use INAL DNS themselves (such as Android with “Private DNS”) keep working unchanged.

Your VPN connections to the FRITZ!Box benefit as well, see VPN via the FRITZ!Box.