Haven
Get Haven
Troubleshooting → Device protection

The phone is protected on Wi-Fi but not on mobile data

On Android this means Private DNS is set to Automatic rather than to the family resolver. On iPhone it usually means the profile is installed but a second profile or a VPN is winning.

What is probably going on

Most likely

Android Private DNS is on "Automatic". That setting encrypts DNS and filters nothing — it is the state most easily mistaken for protection, because the phone does say something reassuring about it.

Applies to: android
Check this firstSettings → Network & internet → Private DNS. If it says Automatic, or Off, this is you. It needs to say family.cloudflare-dns.com.
  1. Settings → Network & internet → Private DNS → choose "Private DNS provider hostname".
  2. Type family.cloudflare-dns.com exactly. A hostname the phone cannot resolve fails silently back to the carrier's DNS with no error shown.
  3. Open Compass and check the Protect tab — it reads the setting the phone actually holds and tells you which of the three states you are in.
Cause 2

On iPhone, a VPN profile takes priority over a DNS profile. If a VPN is installed and active, its DNS wins whatever the Haven profile says.

Applies to: ios
Check this firstSettings → General → VPN & Device Management. If a VPN is listed and connected, this is you.
  1. Disconnect the VPN and re-run the check.
  2. If you need the VPN, set the family resolver inside it, or accept that DNS filtering is off while it is connected.
  3. Confirm the Haven profile is still there and installed under Settings → General → VPN & Device Management → DNS.
Cause 3

The DNS profile was downloaded but never installed. iOS downloads a configuration profile and then waits for you to install it from Settings — a step people miss because nothing prompts you again.

Applies to: ios
Check this firstSettings → General → VPN & Device Management. If there is a "Downloaded Profile" waiting, this is you.
  1. Tap the downloaded profile, then Install, then enter the device passcode.
  2. Confirm it now appears as an installed DNS profile rather than a downloaded one.

Next door to this

Compass says it could not read this phone's DNS settingI followed the setup, but the check still says this device is not protected

Still stuck?

Two doors, and neither of them is a queue you never hear back from.

Report this — it did not work Have a technician do it with you Re-run the protection check My provider is the problem

Last checked 2026-08. Nothing on this page was written by a model — a made-up menu path is worse than no instruction at all, and this is the page somebody reads when they are already stuck.