DoH non-standard port not respected by iOS device

[cyb3rz3us]

This is likely an iOS issue but because DoH is discussed widely here, I thought I would ask this community...

I have DoH configured on a non-standard port and despite the port being defined in the mobileconfig file, DNS requests are still sent to TCP:443. Does anyone have DoH via a non-standard port working with an iOS device (iPad or iPhone)?

[fernvenue]

@cyb3rz3us Actually you can, but iOS doesn't support it natively for now, you need to use a third-party app.

Personally, I use shadowrocket, It helps me to use DoH/DoT servers with non-standard ports. At the same time, it helped me implement some AdGuardHome features on iOS, which is able to use a proxy to retry or fallback to system DNS when all remote servers are not responding. And when configuring multiple remote servers, it can initiate requests to all servers at the same time and use the fastest response. Additionally, it has the option to use different DNS servers for different domains and their subdomains. There are many more, everything is like on AdGuardHome.

To be clear, I am not promoting or recommending any commercial app, just sharing my personal experience on this issue :)

[cyb3rz3us]

Thanks @fernvenue - I took a look at ShadowRocket but it is poorly documented so trying to find a config ref is an issue. I also checked out DNSCloak but seems to be a pretty buggy app...

[fernvenue]

Thanks @fernvenue - I took a look at ShadowRocket but it is poorly documented so trying to find a config ref is an issue. I also checked out DNSCloak but seems to be a pretty buggy app...

True, there is no documentation for shadowrocket, probably because most of the options are explained in the settings, and users can set their own configuration through the app UI.

Back on topic, I checked out more about iOS DoH/DoT settings and I see that some people do have the same problem as you, seems like you really have to use a third-party app.

[cyb3rz3us]

Looks like I have this solved - the trick is a nice little app called DNSCloak. So until Apple gets their act together and respects the port number in the mobileconfig file, this app does the trick.