AdguardTeam/AdGuardHome · warning

bad dns protocol %q

Error message

bad dns protocol %q

What it means

encodeMobileConfig was asked to generate an Apple mobile configuration profile for a DNS protocol that isn't DNS-over-TLS or DNS-over-HTTPS. The switch on proto fell through to the default case.

Source

Thrown at internal/home/mobileconfig.go:137

	case dnsProtoHTTPS:
		dspName = fmt.Sprintf("%s DoH", d.ServerName)
		u := &url.URL{
			Scheme: urlutil.SchemeHTTPS,
			Host:   d.ServerName,
			Path:   path.Join("/dns-query", clientID),
		}
		d.ServerURL = u.String()

		// Empty the ServerName field since it is only must be presented
		// in DNS-over-TLS configuration.
		d.ServerName = ""
	case dnsProtoTLS:
		dspName = fmt.Sprintf("%s DoT", d.ServerName)
		if clientID != "" {
			d.ServerName = clientID + "." + d.ServerName
		}
	default:
		return nil, fmt.Errorf("bad dns protocol %q", proto)
	}

	payloadID := fmt.Sprintf("%s.%s", dnsSettingsPayloadType, uuid.New())
	data := &mobileConfig{
		PayloadDescription: "Adds AdGuard Home to macOS Big Sur and iOS 14 or newer systems",
		PayloadDisplayName: dspName,
		PayloadType:        "Configuration",
		PayloadScope:       "System",
		PayloadContent: []*payloadContent{{
			DNSSettings:     d,
			OnDemandEnabled: 1,
			OnDemandRules: []*onDemandRule{{
				Action: "Connect",
			}},
			PayloadType:        dnsSettingsPayloadType,
			PayloadIdentifier:  payloadID,
			PayloadDisplayName: dspName,
			PayloadDescription: "Configures device to use AdGuard Home",

View on GitHub (pinned to b41aefbe51)

Solutions

1. Use the correct URL suffix: /apple/mobileconfig.doh.png or /apple/mobileconfig.dot.png
2. Configure at least one DNS-over-HTTPS or DNS-over-TLS upstream server before requesting a profile

Example fix

# before
GET /apple/mobileconfig.txt

# after
GET /apple/mobileconfig.doh.png

var validProto = map[string]bool{"dns-over-tls": true, "dns-over-https": true}
if !validProto[proto] { http.Error(w, "use .doh or .dot", http.StatusBadRequest); return }

func isMobileConfigProto(p string) bool { return p == dnsProtoTLS || p == dnsProtoHTTPS }

When it happens

Trigger: GET /apple/mobileconfig.proto (handleMobileConfig) with a .proto extension other than .dot (e.g. .txt, .doh with malformed upstream config, or empty protocol) so proto doesn't match dnsProtoTLS or dnsProtoHTTPS.

Common situations: Users typing the mobile-config URL manually with a wrong extension, or upstream DNS settings that leave the DoH server name empty causing earlier validation to misroute; also plain-DNS-only installs trying to fetch a profile.

Related errors

• unknown language: %q
• invalid theme %q, supported: %q, %q, %q
• duplicated values: %v
• unmarshalling json data into aghalg.NullBool: bad value %q
• json duration is nil

AI-assisted analysis of AdguardTeam/AdGuardHome@b41aefbe51 (2026-08-27). Data as JSON: /api/errors/a7a867b1573242f4. Report an issue: GitHub.