Stop the profile being switched off.

1. Back up the phone. Supervision erases it. This is the part that stops most people, and reasonably so.
2. Turn off Find My and sign out of your Apple Account, or Activation Lock will block the next step.
3. On a Mac, install Apple Configurator from the Mac App Store. It is free, and currently needs macOS 15.7 or later.
4. Erase the phone and connect it by cable at the Hello screen, before Setup Assistant runs.
5. Choose Prepare -> Manual Configuration, and tick Supervise devices.
6. Choose Do not enroll in Device Management. You do not need an MDM server, and there is a literal option for this.
7. Create an organisation and a supervision identity. Back this up. Changing it later means erasing and starting again.
8. Install your prepared profile over the cable, then restore your backup.
9. Confirm the DNS filtering actually applies on cellular once you are done, rather than assuming it.

One genuinely useful quirk: Apple documents that a manually installed DNS profile also applies to cellular, whereas one pushed by an MDM only covers managed Wi-Fi. A profile you push over a cable with Configurator is not going through an MDM, so it should count as manual, which would make this route better than a managed one rather than a compromise. Apple does not classify Configurator installs explicitly, so verify cellular coverage on the device.

This is the part most guides miss. Turning on Prohibit Disablement stops the DNS being switched to Automatic. It does nothing about the profile simply being deleted, and the profile generators do not add that protection for you.

Every row in that table is supervised-only on iPhone. That is the complete answer to why supervision is unavoidable here.

Since April 2026 Apple has folded Business Manager and Business Essentials into a single free Apple Business service that includes device management for up to 500 devices at no cost. It changes the ceiling above, because a device assigned to an organisation there re-enrols itself after any erase, including a DFU restore.

1. The trusted person signs up for Apple Business. Apple verifies an organisation, not a person: in the United States an EIN or D-U-N-S number plus a second check such as a domain record, and it can take weeks. Apple does not say whether an individual qualifies, so in practice this is for a trusted person who has a business, a church, or a charity.
2. Add your iPhone with the Apple Configurator for iPhone app, since it was not bought from Apple with the organisation attached. This erases the device, exactly as manual supervision does, so back up first.
3. In the free MDM, upload the profile from the profile builder or your provider as a Custom configuration, with ProhibitDisablement and the supervised restrictions from the section above added. Apple accepts any profile under 1 MB.
4. Know about the 30-day provisional period. For the first 30 days after enrolment, Settings shows a Leave Remote Management option. After that it disappears, and erasing or restoring the phone brings management straight back at the Hello screen.

This is the strongest position an iPhone can be in without belonging to an employer, and it is the only one where a DFU restore does not help you. The costs are real: the trusted person has to be willing to run an organisation account, and the profile it pushes is managed, so re-check that DNS filtering still applies on cellular rather than only on managed Wi-Fi. Paid alternatives that work the same way through Apple's device enrolment include Mosyle and SimpleMDM; a consumer service, Tech Lockdown, packages supervision and DNS locking for exactly this use.

1. Convert the daily account to Standard, with the trusted person holding the only administrator account. Everything else rests on this, so do it first and confirm no second admin account exists with a password you know.
2. Generate the DNS configuration profile from your provider, choosing Mac as the device type, and generate it unsigned so it can be edited.
3. Add PayloadRemovalDisallowed and a profile removal password known only to the trusted person. Both of these work on a normal Mac with no supervision and no MDM.
4. Have the trusted person install it for the whole machine, not just their user, through System Settings -> General -> Device Management, entering the admin password. Installing it system-wide is what makes removal require an administrator. It has to be the graphical route; the command-line tool has not been able to install profiles since macOS 11.
5. Give the profile a device name so its entries are attributable in the log.

Result: a standard user can neither remove the profile nor change DNS servers. An administrator can do both: Apple documents that an administrator password overrides a removal password, so the password is belt-and-braces against a standard user, not a second lock. The account split is the lock. Done properly that is a stronger position than an unsupervised iPhone and needs no erase. Done while you are still an administrator it is worth little, because you can simply authenticate your way past it.

Be realistic about the remaining gaps rather than assuming the profile settles it.

• Browser-level encrypted DNS is the big one. Chrome and Firefox can resolve names themselves, in-process, bypassing the system resolver without needing admin rights. Close this with browser policy and by turning on your provider's bypass-method blocking.
• Running apps from the home folder. A standard user can still run a browser or proxy tool out of Downloads without admin rights.
• Another device entirely, or a phone on cellular. No Mac setting addresses that.
• Anything you can authenticate. If you kept administrator rights for convenience, you have kept the ability to undo all of it, and no amount of profile hardening changes that.

Two things make this easier than the iPhone route, and three make it harder. Easier: you do not have to wipe the phone, and on Android 11 and later you may not need a computer at all, because a helper app can run the one privileged command over wireless debugging. Harder: you must first remove every account from the device, plus any work profile, private space, or cloned apps; you have to turn on developer options; and the result depends on your manufacturer.

1. Remove all accounts, work profiles, private space and cloned apps from the phone.
2. Turn on developer options and USB debugging.
3. Install a device-owner controller app and grant it the device owner role from a computer over USB. Check what signed the app first, and do not use a build labelled testkey. Do not grant the role through a privilege-helper app, or that helper ends up owning the device instead.
4. In Settings, set Private DNS to your filtering provider's hostname.
5. In the controller app, turn on the restrictions: no changing Private DNS, no VPN configuration, no unknown sources, no safe mode, no adding or switching users, no factory reset, and last of all no developer options.
6. Have the trusted person set the controller app's own password, so you cannot open it and undo the list.
7. Sign in a Google account the trusted person owns and controls, so reset protection has teeth.

Every route to changing DNS servers on Windows requires administrator rights: the Settings app, the old Control Panel dialog, the command line, PowerShell, and editing the registry directly. Microsoft's own policy documentation says it twice, noting that non-administrators can view the dialog but not change it regardless of any policy. The hosts file, firewall rules, and installing or stopping a service are all admin-gated too.

1. The trusted person creates their own administrator account with a password you never see.
2. Your daily account is changed to Standard.
3. Check your account is not in the Network Configuration Operators group, the one non-admin group permitted to change DNS. Run net localgroup "Network Configuration Operators" from any prompt; Home has no user-management console for this. It is empty by default, so this is a thirty-second confirmation rather than the likely problem. The browser gap below is the likely problem.

1. Easiest and most robust: install your provider's Windows client or command-line tool as a service. It needs an administrator to install, and a standard user cannot stop or remove a service.
2. Or add a catch-all name-resolution policy rule, which applies across every network rather than one adapter, and lives in a registry area a standard user cannot touch. One trap worth knowing: if anything ever writes one of these rules through Group Policy, and VPN or corporate agents do, Windows ignores your local rules entirely and says nothing. Two rules covering the same names also cancel each other out rather than one winning, and both failures leave you unfiltered rather than blocked.
3. If you want encryption enforced, register your resolver's encrypted-DNS address first, then set the machine policy to require encryption. Registering it is not optional: Windows only recognises Cloudflare, Google and Quad9 out of the box, so a filtering provider has to be added by hand or "require encryption" will stop name resolution altogether. Recent versions call the setting Configure encrypted name resolution. It fails closed, which for this purpose is a feature.
4. Then close the browser gap, or none of the above matters.

Silence tells you the phone stopped sending queries. It does not tell you the phone is running normally but unprotected, which is what actually happens when the DNS is switched to Automatic while everything else carries on. Those look different from the outside and only one of them is obvious.

Some providers publish a status endpoint that reports whether their filtering is in use for the request. Fetching that on a schedule turns "is the filter on right now?" into a question with a recorded answer, rather than something inferred from an absence.

1. Find whether your provider offers a test or status URL that reports whether traffic is going through them.
2. Set up a scheduled automation on the phone to fetch it, using the Shortcuts app and a Time of Day trigger.
3. Turn off Ask Before Running so it runs without prompting.
4. Have the result go somewhere the trusted person can see.