It's worth noting that iOS has something similar within its Profiles framework, though not nearly as comprehensive. You can create profiles that restrict the D

It's worth noting that iOS has something similar within its Profiles framework, though not nearly as comprehensive. You can create profiles that restrict the DNS servers the client can use as well as the domains those servers can resolve, with exceptions. I've used this approach for years to implement DNS-level ad/tracker blocking without resorting to a loopback VPN. This site makes creating these profiles easy: https://dns.notjakob.com/ https://dns.notjakob.com/