# Devices

Point a whole household or fleet of devices at encrypted DNS, each under its own address, and see privately where their lookups go.

The console shows only the *names* a device asks to reach, never what it does there. Screens here are a demo household with illustrative data and redacted tokens.

## 1. Your devices

Each device with its own address and a protected badge, over a private map of which companies answer the household lookups.

![The Devices page, shown with demo data: three devices each with its own address and a protected badge, and a treemap of which companies answer the household's lookups.](/docs/shots/device-list.png)

*Each device with its own address and a private map of which companies answer its lookups. Demo household.*

## 2. Add a device

Pick a platform and name it, then install by QR code or profile link. The device comes up with its own identity address.

![The Add a device dialog: a platform picker (iPhone or iPad, Android, Mac, Windows, Linux, or something else) and an optional device name.](/docs/shots/device-add-modal-filled.png)

*Pick a platform and name it, or add nothing at all.*

![The device install dialog, shown with the enrollment token redacted: an install button, a QR code, setup steps, the device's identity address, and a shown-once enrollment token.](/docs/shots/device-add-reveal.png)

*Install by QR or profile link. The device gets an identity; the enrollment token is shown once and is redacted here. Demo.*

The manual panel lists every endpoint the profile configures: a Private DNS host, a DoH URL, a resolver address, and the profile link.

![The manual setup panel, shown with demo tokens: the endpoints the profile automates, including a Private DNS host, a DoH URL, a resolver address, and the profile link.](/docs/shots/device-add-manual-platforms.png)

*The manual panel lists every endpoint the profile sets for you. Demo tokens.*

## 3. A device up close

A protected summary, a per-company who-can-see-its-day view, and a live feed of lookups marked allowed or blocked.

![A device page, shown with demo data: a protected summary, a per-company view of who could see the device's day, and a live feed of allowed and blocked lookups.](/docs/shots/device-detail-overview.png)

*A device up close: the protected summary, a who-can-see-its-day view, and a live activity feed. Demo data.*

## 4. Controls

The account resolver policy and a per-device egress firewall keyed to the address. Resolver policy protects every device under your key today, not one device at a time.

![The Controls tab for a device: the account resolver policy (presets, toggles, and custom rules) and a per-device egress firewall, with a candid note that policy is account-wide today.](/docs/shots/device-detail-controls.png)

*Controls: the account resolver policy and a per-device egress firewall keyed to the address. The console is candid that policy is account-wide today, not per-device.*

## 5. Setup and keyless proof

The device endpoints, plus the reverse-DNS and RDAP commands anyone can run to confirm the address is the device. No account needed.

![The Setup tab for a device, shown with demo data: the device's DNS endpoints, its identity address, and the reverse-DNS and RDAP commands anyone can run to confirm the address belongs to the device.](/docs/shots/device-detail-setup.png)

*The device's endpoints, plus the dig -x and RDAP commands anyone can run to confirm the address is the device, no account needed. Demo address.*

## 6. Insights

Where the devices resolve, by jurisdiction, operator, and provider.

![The Fleet insights view, empty: a note that no destinations have been mapped yet in the selected time window.](/docs/shots/device-insights.png)

*Insights maps where devices resolve, by jurisdiction, operator, and provider. Empty in this demo window.*

## 7. Remove a device

Removing withdraws the address (AAAA and PTR) and de-provisions its encrypted DNS.

![A Remove device confirmation dialog explaining that removing withdraws the device's address and de-provisions its encrypted DNS.](/docs/shots/device-remove-confirm.png)

*Removing a device withdraws its address (AAAA and PTR) and de-provisions its encrypted DNS.*