NetShield runs a local VPN on your Android device to intercept DNS queries at the network level. Block ads, trackers, malware, and telemetry - all without root access.
No root required - Android 10+ - Open source
NetShield uses Android's VpnService to create a local DNS resolver. Every DNS query from your apps passes through it. Domains on your blocklist never leave the device - they get a null response. Everything else goes to your chosen upstream resolver.
Tap the start button. Android asks for VPN permission. That's it - NetShield begins intercepting DNS traffic immediately.
Each DNS query is checked against your allowlist, blocklists, and custom rules using a reversed-domain trie for fast matching.
Blocked domains get a null response. Allowed domains are forwarded to your upstream resolver and cached according to DNS TTL.
Every DNS query is logged. Every rule is yours to edit. Every domain can be tested before it matters.
See every query in real time - domain, action, and which rule matched. Search, filter, and clear on demand.
System safety, user allowlist, user blocklist, imported lists, default allow. Allowlist always wins over blocklists.
Add exact domains or suffix rules. Categorize as ads, trackers, malware, or telemetry. Toggle individual rules on or off.
Import blocklist files from local storage. Remote sources can be added in future releases.
In-memory cache respects DNS TTL. Reduces upstream queries and speeds up repeated domain lookups.
Enter any domain to see the DNS response, IP addresses, rule match, and response time - before it matters in production.
Export your allowlist, custom rules, blocklist sources, and settings as JSON. Restore on a new device.
Use system default, or configure your own UDP/TCP upstream. DoH and DoT support is planned for future releases.
VPN status, DNS engine state, query count, cache size, rule count, memory usage, and last DNS error - all visible.
NetShield ships with 630+ default blocked domains across four categories. Every domain can be individually toggled, edited, or removed. You own the rules.
View the full default listDoubleClick, AdSense, Taboola, Outbrain
Google Analytics, Hotjar, Mixpanel, Segment
Known C2 servers, phishing domains, botnets
Microsoft, Mozilla, Crashlytics, Flurry
NetShield operates entirely locally. DNS logs are stored only on your device and are never sent to an external server. No analytics are collected. DNS queries for allowed domains are forwarded to your selected upstream resolver, which may log them according to its own privacy policy.
Blocks any domain identified at the DNS level - ad servers, tracker endpoints, known malware C2 domains, and telemetry endpoints.
Works without root, using Android's official VpnService API.
Cannot block ads served from the same domain as content. If an ad and a page load from the same domain, DNS filtering cannot distinguish them.
Per-app DNS attribution is only available where Android's VPN API reliably provides it. NetShield does not fabricate attribution when it cannot be determined.
Install NetShield, tap start, and grant VPN permission. That's it. Every DNS query from every app passes through your rules.
Download for AndroidAndroid 10+ - 6MB - No root - No analytics