You don't want to switch to GrapheneOS, but stay in the Apple universe? Understandable. With the right settings you can squeeze a lot more privacy out of an iPhone. Here's the compact checklist to work through – sorted by area.
The Apple account is the biggest lever – this is where most of the effort pays off. Work through the items at your own pace; you don't have to change everything at once, and every checkmark already gets you a step further.
Settings → [Name] → iCloud → Advanced Data Protection. This brings end-to-end encryption to backups, photos, notes, reminders, Safari history, Wallet and much more.[Name] → iCloud → all services off) and in particular turn off iCloud Backup ([Name] → iCloud → iCloud Backup → off). Then also don't sync Photos, Contacts, Calendars, Notes & iCloud Drive to the cloud.[Name] → Sign-In & Security → Security Keys.Face ID & Passcode → Stolen Device Protection.Settings → Privacy & Security
Lockdown Mode is Apple's strongest protective feature – but it is not a default tip for everyone. It's specifically meant for people who have to reckon with sophisticated, targeted attacks.
If you could realistically be a target of targeted attacks – or if pronounced "paranoia" 🙂 simply makes you want maximum peace of mind:
In everyday life the mode is overkill. The reason is simple:
Privacy & Security → Lockdown Mode (a restart is required). So you can test it without risk – and selectively exempt individual websites/apps as needed.
You don't have to sacrifice location entirely – usually it's enough to decide deliberately per app. Path: Privacy & Security → Location Services
This is about voice and AI features that are convenient but can carry data off the device. Whatever you don't need, you can switch off with peace of mind – you can always turn it back on later.
Settings → Apple Intelligence & Siri). Even with "Private Cloud Compute," data leaves the device.Keyboard → Dictation).Radio interfaces that are off can't give you away. Relax and turn off whatever you're not currently using – in everyday life you'll barely notice it.
Settings → Cellular → [SIM] → Voice & Data
Only relevant if you actually use Safari – in which case a few switches already get you a lot.
The rule of thumb is relaxed: each app gets only what it really needs – everything else can happily stay off.
General → Background App Refresh).The most convenient path to encrypted, ad- and tracker-filtering DNS on the iPhone: a ready-made configuration profile from dnsforge.de. It applies system-wide (DoH/DoT), not just in the browser – no App Store, no extra app needed.
The ready-made iOS profiles are available directly from the provider. Open the iOS section there and pick a variant – each variant offers two profiles: DoH (HTTPS, the recommended default) or DoT (TLS, the alternative).
How to find the right profile:
Tap the downloaded .mobileconfig file once in Files → Downloads, until the notice appears that the profile must be installed in Settings.
Open Settings → Profile Downloaded, tap Install at the top right, confirm the "network traffic" warning and tap Install again.
The most recently installed profile is active automatically. Check under Settings → General → VPN, DNS & Device Management → DNS.
Toggle Airplane Mode on and off once so the DNS cache is rebuilt.
Note: The profiles come directly from the provider dnsforge.de (servers in Germany, no logging). Only install configuration profiles from sources you trust.
If you have a Mac, you can set up your iPhone with Apple Configurator (free in the Mac App Store) as a supervised device and build your own configuration profile. This lets you enforce hardening instead of merely recommending it and bundle it cleanly into a single signed profile. This is the advanced route; for most people, steps 1–13 are enough.
If Apple Configurator and the terminal steps feel too clunky, use iMazing from Switzerland (DigiDNA). Two building blocks are relevant:
In short: creating the profile is free & convenient with the Profile Editor; signing works as described below; only the convenient supervising/rollout costs money.
Download Apple Configurator from the Mac App Store. Connect the iPhone by cable and confirm "Trust This Computer" on the iPhone.
Only needed for true Always-On VPN: right-click the device → Prepare → "Manual Configuration," create a local organization (without an MDM server). The device is erased in the process.
In Apple Configurator: File → New Profile. Then configure only the areas ("payloads") you need:
Save or export it as iPhone_unsigned.mobileconfig – that's the still unsigned profile I'm about to sign.
Add a Mail payload (classic IMAP/SMTP) or an Exchange payload (Exchange ActiveSync) to the profile. Tip: leave the password field empty – then the iPhone asks for it once securely at install time, instead of storing it in the profile.
| Provider | IMAP (incoming) | SMTP (outgoing) | Note |
|---|---|---|---|
| mailbox.org | imap.mailbox.org : 993 SSL | smtp.mailbox.org : 465 SSL | Exchange ActiveSync optional (enable in the web account) |
| Posteo | posteo.de : 993 SSL | posteo.de : 465 SSL | No ActiveSync; IMAP/SMTP & CalDAV/CardDAV |
| mailo | mail.mailo.com : 993 SSL | mail.mailo.com : 465 SSL | — |
| Proton Mail | not on iOS (Bridge desktop only) | not on iOS | Proton Bridge runs only on Win/Mac/Linux – on the iPhone, use the dedicated app |
| Tuta | no IMAP | no SMTP | Encrypted proprietary format – dedicated app only |
The username is usually the full email address. The current details in your provider's help are always authoritative. For Exchange ActiveSync (mail, calendar & contacts in one), enter the server, domain/user and SSL per your provider's documentation.
iOS shows an unsigned profile as "Not Verified." Signed with a trusted certificate, it shows up in green as "Verified." For this you do not need a paid Apple Developer account – a free European S/MIME certificate from Actalis is enough (valid for 1 year, one free certificate per email address).
Register with Actalis, request a free S/MIME certificate for your email address, and confirm the email address. You'll receive a ZIP with a .p12 file (here as certificate_s_mime_mv.p12) and its password.
Homebrew is the most popular package manager for macOS – a helper that installs and keeps developer and command-line programs (like OpenSSL here) up to date with a single command. It doesn't ship with macOS; you install it once from brew.sh (one command, ready to copy there). After that, the brew command is available in the Terminal:
brew install openssl@3OpenSSL is the tool I'll use in a moment to sign the profile. The version bundled with Apple is outdated – hence the fresh one via Homebrew.
So that ossl uses the Homebrew version (Apple Silicon path; on Intel Macs use /usr/local/opt/...):
alias ossl=/opt/homebrew/opt/openssl@3/bin/opensslPrivate key, your certificate and the CA chain (the .p12 password will be requested):
# private key
ossl pkcs12 -in certificate_s_mime_mv.p12 -nocerts -nodes -out signer.key
# your own certificate
ossl pkcs12 -in certificate_s_mime_mv.p12 -clcerts -nokeys -out signer.crt
# CA chain (intermediate certificates)
ossl pkcs12 -in certificate_s_mime_mv.p12 -cacerts -nokeys -chain -out chain.pemVerify holder, issuer, validity and intended use:
ossl x509 -in signer.crt -noout -subject -issuer -dates -ext extendedKeyUsageMake sure the profile is clean XML/plist:
plutil -lint iPhone_unsigned.mobileconfigThis produces the finished, signed profile iPhone.mobileconfig:
ossl smime -sign -in iPhone_unsigned.mobileconfig -out iPhone.mobileconfig \
-signer signer.crt -inkey signer.key -certfile chain.pem -outform DER -nodetachGet the signed iPhone.mobileconfig onto the iPhone (via Apple Configurator, AirDrop or email to yourself), then install it under Settings → Profile Downloaded. It should now appear in green as "Verified."
signer.key is your private key – keep it safe and don't share it. Delete the raw files after signing if you no longer need them.