iPhone, iPad and Mac: DNS profile

Apple devices accept a small configuration profile that routes every DNS lookup to Die Ratel over HTTPS. Generate one below; it is built in your browser and never leaves your device.

Filter Profile name

Install on iPhone or iPad

Download the profile in Safari. Tap Allow when asked.
Open Settings; a Profile Downloaded entry appears at the top. Tap it, then Install.
Go to Settings → General → VPN & Device Management → DNS and make sure the Die Ratel profile is selected.

Install on a Mac

Double-click the downloaded file, then approve it under System Settings → Privacy & Security → Profiles.

Lock it for a child

With Screen Time → Content & Privacy Restrictions → Account Changes / Passcode Changes set to Don't Allow, the profile cannot be removed without the Screen Time passcode. Schools can push the same profile as non-removable with Apple Configurator or an MDM.