Video summary

iPhone Revokes? 4 Easy Tips to Stop iOS App Revokes Forever

Main summary

Key takeaways

Technology

Overview

The video provides a 4-tip post-install guide to prevent iOS enterprise-sideloaded apps (e.g., KSign, ESign) from being revoked/blacklisted. It also includes a bonus tip for handling iOS OTA updates safely.

Tip 1: Use trusted anti-revoke DNS (with an exception)

  • Use an anti-revoke DNS setup that blocks revocation/verification-related servers.
  • Important nuance: for the PPQ server (required for initial app verification), the PPQ domain should not be blocked during verification.
  • The creator’s approach uses a special DNS that:
    • unblocks PPQ only while the app is being verified, then
    • blocks it after verification completes.
  • The DNS can be obtained from the creator’s website (links are mentioned as being in the description) for KSign and ESign.

Tip 2: Use only one anti-revoke DNS profile

  • Avoid “stacking” multiple anti-revoke DNS services, as they may override each other and cause inconsistent blocking.
  • It also warns about potential DNS leaks.
  • Recommendation: use a single DNS profile, which includes multiple rule variants that can be switched in DNS settings.

Tip 3: Avoid device restarts

  • Restarting iOS can flush cached DNS rules, which may cause the anti-revoke protection to stop applying—potentially leading to revocation.
  • If the device must be powered off/shutdown:
    1. Disable Wi‑Fi and mobile data
    2. Enable airplane mode
    3. Turn off the device to prevent network activity/DNS leaks during boot cycles

Tip 4: Avoid VPN usage

Using a VPN alongside anti-revoke DNS is discouraged because:

  • The VPN can override custom DNS
  • Traffic is routed through VPN servers, which may expose the certificate verification endpoints
  • This could force apps to re-verify, increasing revocation risk

Bonus Tip: Handling iOS OTA updates

Before performing an OTA update:

  1. Turn on airplane mode and disable network
  2. Remove the DNS profile
  3. Delete/remove all sideloaded apps
  4. Run the OTA update

Additional info

  • The creator states they’ve made separate videos detailing the DNS method for KSign and ESign, and points viewers to end screen/description links.

Main speakers or sources

  • Single speaker/creator (unnamed) presenting the tips and promoting their custom anti-revoke DNS (KSign/ESign) and related videos.

Original video