# Set Up a Device

> Per-platform steps to put a phone or laptop behind your encrypted DNS: mint the credential, install it on Apple, Android, Windows or Linux, then verify it.

*Source: https://www.whisper.security/docs/network/devices/setup*

---
One device, start to finish. Do this once per machine; the credential is per device, so a
phone and a laptop get one each.

## 1. Mint the credential

```bash
whisper device add --label "work-laptop"
```

The response carries the device's routable address, its encrypted DNS URL, the Apple
one-tap profile URL, the Android Private DNS host, and the token itself. The token is
shown once, so capture it before you move on, and treat any URL that contains it as a
password: it lets the holder resolve names as this device, and it can touch nothing else on
your account. The Devices page in the console mints the same credential and shows a QR code
for the phone flow.

## 2. Install it on the device

On Apple platforms the credential arrives as a signed, DNS-only configuration profile named
*Whisper Encrypted DNS*. On Android it is a Private DNS hostname, so there is nothing to
install.

```whisper-code-tabs
{
  "Apple": "# open this on the device, then scan the QR code or tap Install\nhttps://resolver.whisper.online/apple/<your-token>\n\n# or fetch the profile directly\nhttps://resolver.whisper.online/apple/<your-token>.mobileconfig",
  "Android": "Settings > Network & internet > Private DNS\n  choose: Private DNS provider hostname\n  enter:  <your-selector>.dot.whisper.online"
}
```

The Apple profile needs iOS 14 or later, or macOS 11 or later, and it asks for the one
approval the operating system requires before a DNS profile takes effect.

On Windows and Linux a script does the work. The Windows one needs an elevated PowerShell.
The Linux one installs a small local forwarder on loopback and points the system resolver at
it, writing a drop-in at `/etc/systemd/resolved.conf.d/whisper-dns.conf` and leaving a copy
of the previous configuration at `/etc/resolv.conf.whisper-backup`.

```whisper-code-tabs
{
  "Windows": "# elevated PowerShell\nirm https://resolver.whisper.online/win/<your-token>.ps1 | iex",
  "Linux": "curl -fsSL https://resolver.whisper.online/linux/<your-token>.sh | sudo bash"
}
```

## 3. Confirm the device is behind Whisper

Open the device's own history page. It lists each lookup with the time, the name, the type,
the decision and the reason for it, which is the quickest confirmation that answers are now
coming from your account:

```text
https://resolver.whisper.online/logs/<your-token>
```

Add `.json` to the same path for a machine-readable copy.

## 4. Confirm the identity is published

The device has a routable address of its own, and anyone can check it with stock tools and
no key:

```bash
dig -x 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 +short
curl -s https://rdap.whisper.online/ip/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 | jq '.handle, .name'
```

## 5. Take the device back off

Releasing the identity withdraws its forward and reverse records and de-provisions its
encrypted DNS, so the credential stops resolving:

```bash
whisper kill --revoke <the device address>
```

Releasing it also locks that device's lookup history, after which every read of it is
refused, including yours. Export anything you still need from the history page first.

Then put the machine's own settings back. On Apple platforms remove the profile. On Android
set Private DNS back to automatic or off. On Windows:

```powershell
Get-NetAdapter | Reset-DnsClientServerAddress
Get-DnsClientDohServerAddress | Remove-DnsClientDohServerAddress
```

On Linux, remove the drop-in the script wrote and restore the configuration from the backup
it left beside it.

## What the device may resolve

Names are decided by the account, not by the device, so one change covers every machine you
have installed. That is [Resolver Policy](/docs/network/resolver/policy), and what happens
to a name before your own lists are consulted is
[How Resolution Works](/docs/network/resolver/how-it-works).