iOS Roaming Client deployment guide

Install the iOS Roaming Client

All MDMs have different specifications for managing and installing apps. Consult the MDM provider's documentation for the specific steps required to deploy the iOS agent.

From the DNSFilter dashboard, navigate to Deployments and select Roaming Clients
Select Install Roaming Client
Select the Site
Select iOS
Copy the Site Key
Enable Auto Registration if applicable
Download the .mobileconfig file
Edit the KEYHERE field in the file to include the Site Key
Add any MDM-specific information such as permissions, groups, or licensing

To include a Client Name from the MDM, add a host_name key to the .mobileconfig file. In the example below, the Client Name appears as Test SERIALNUMBER in the DNSFilter dashboard. Tags can also be passed with this edit:
```
<key>ProviderConfiguration</key>
  <dict>
    <key>site_key</key>
    <string>YOUR SITE KEY HERE</string>
    <key>host_name</key>
    <string>Test {{serial_number}}</string>
    <key>dashboard_tags</key>
    <string>Tag1, Tag2, Tag3</string>
  </dict>
```
Device-specific variables such as {{serial_number}} may differ across MDM providers. Verify the correct variable syntax in the MDM provider's documentation before deploying. See examples for Microsoft Intune and Addigy.
Create an MDM profile and upload the file
Download the DNSFilter Roaming Client from the App Store
Push the app to devices

Once the app is pushed, devices register in the DNSFilter dashboard and the Filtering Policy associated with the Site applies.

DNS over TLS (DoT) default behavior

DoT is enabled by default on iOS devices and may cause DNS conflicts for some clients. To disable DoT, add the following key to the .mobileconfig file before deploying:

<key>dns_over_tls_enabled</key>
         <false/>

Additional MDM-specific deployment guides are available. Search the DNSFilter Help Center for example solutions including Jamf Pro and Intune.

Comments

4 comments

Lokken Wong

November 04, 2024 14:14
Thank you for providing an alternative solution.
I have been waiting for a long time to get this resolved!
0
Minetta Gould Community Team DNSFilter Staff

November 05, 2024 22:34
So glad this update helps you out, Lokken Wong ! The team was definitely excited to get this fix into everyone's hands, so they appreciate the feedback.
0
Avery Knox

July 08, 2025 20:39
I have some questions about this article. The Avoid filtering interruptions by encrypting DNS (DoT) article says:
With iOS agent version 1.0.8 and higher, DoT is enabled by default, no longer requiring the end-user to configure manually.
But at the beginning of this article, it mentions disabling DoT, almost as it needs to be done in preparation for installation. To me, that shouldn't be at the top, or perhaps the article should discuss why we would ever want to disable DoT.
0
Minetta Gould Community Team DNSFilter Staff

July 08, 2025 21:23
Thanks for the feedback! The option to disable DoT is available because some IT admins prefer the option for compatibility with internal DNS setups, easier troubleshooting, or better visibility into DNS traffic for security tools. It’s all about giving admins flexibility based on their network needs.
We make recommendations and set defaults, but want to make sure our customers are aware of default updates and changes, hence the callout at the top of the process steps like you see here: DoT wasn't enabled by default until recently.
Hope this helps!
0

Please sign in to leave a comment.

How can we help you?

Search

In this article

Install the iOS Roaming Client

DNS over TLS (DoT) default behavior

Comments