Documentation

This is the full user manual for the current app line 3.11.93: what each module does, how to use it step by step and which features belong to Free or Premium.

1. Getting started and the home screen

The home screen keeps the essentials in one place: DNS VPN state, selected resolver, quick shortcuts to the main modules and the current Free/Premium status.

• Connect / Disconnect starts or stops the local DNS VPN. The app uses Android `VpnService` only for device-side DNS handling, not for country switching or for routing all traffic through a remote VPN server.
• Servers is where you choose classic DNS, DoH, DoT or a custom resolver.
• Apps lets Premium users decide whether DNS covers all apps or only selected apps.
• Tools is the diagnostics area: Wi‑Fi Analyzer, Speed Test, SSH, LAN discovery, Wake-on-LAN, Stability Monitor and other network tools.
• On Android TV the home screen also shows launcher guidance and remote-friendly navigation helpers.

The simplest start is: pick a DNS server, press Connect, verify the status, then move into advanced modules only when you actually need them.

2. What is Free and what is Premium

If you only want to switch DNS and run a quick network check, Free is enough. If you want per-app control, local domain filtering, room-by-room Wi‑Fi diagnostics, SSH or configuration transfer, Premium Lifetime is the complete toolbox.

3. Classic DNS, encrypted DNS, profiles and automation

The app can still stay simple, but it now has several layers of DNS control. The easiest way to understand it is to separate four levels.

• Classic DNS means manual IPv4/IPv6 resolvers or ready-made providers from the built-in library. This is the best choice when you only want a different resolver without extra logic.
• DNS-over-HTTPS and DNS-over-TLS encrypt DNS queries. DoT needs a hostname, while DoH needs a full HTTPS `dns-query` URL; the app warns when the selected address format does not match the transport.
• DNS profiles and app groups save ready-made setups. You can jump back to a “home”, “child”, “streaming” or “testing” setup with one tap.
• Smart Profiles automate switching. You define a time window, the profile that should become active and, optionally, a return profile after the window ends.

Child profile is a special Premium profile type. It saves the current DNS and app selection, and leaving that mode requires a 4-digit exit code. A separate recovery PIN exists only for regaining control if the exit code is forgotten.

DNS switches and fields that can change or break resolution

• Classic DNS / UDP is the safest mode for manually typed IP resolvers. It does not encrypt queries, but it is also the least likely to break connectivity when you enter custom values.
• DNS-over-TLS (DoT) requires a hostname, not a raw IP and not a full HTTPS URL. A wrong format is one of the easiest ways to lose internet access because the TLS certificate does not match the typed address.
• DNS-over-HTTPS (DoH) requires a full https://.../dns-query URL. A bare host or bare IP may be rejected by many providers, so presets are the safest option unless you know the exact endpoint.
• NextDNS ID is only a helper that builds the correct DoH URL from your configuration ID. The app does not create an account and does not manage rules from the NextDNS dashboard.
• Custom Control D accepts either a DoT hostname or a full DoH URL from your own account. It is flexible, but it is also easy to paste the wrong format and break DNS resolution.
• All apps / selected apps decides whether the local DNS VPN covers the whole device or only the chosen apps. In selected-app mode, anything outside the chosen list keeps using the normal network path instead of this DNS profile.
• IPv6 DNS enables DNS handling for IPv6-oriented networks and resolvers. It helps when your ISP or router really uses IPv6, but on poorly configured networks it can increase wait time or reduce stability.
• TCP fallback allows the app to retry DNS over TCP when UDP responses are truncated or fail. That can rescue restrictive networks or large DNS answers, but it may be slightly slower.
• Autostart restores the current settings or a chosen profile after Android TV boots. It is convenient, but if you save a broken setup the TV can come back to the same broken DNS state after every reboot.
• Kill Switch Assist is not a real system kill switch. It only helps you open Android VPN settings and resume the profile; hard traffic blocking requires Android Always-on VPN plus Block connections without VPN.
• Smart Profiles can switch DNS automatically on schedule. If DNS seems to change “by itself”, check the active schedule and the return profile first.

Important from the app code: when a DoT/DoH address does not match the selected transport, the app shows a warning and can suggest an automatic fix for known providers. In the Google Play build, the “selected apps” list is also limited to apps Android exposes to the app, so some system packages may never appear for manual split selection.

4. Own DNS: the new local DNS firewall

Own DNS is not just “another server preset”. It is a separate Premium mode that behaves like a small on-device DNS firewall.

• The app checks local rules and filter lists first.
• Only allowed domains are sent to the encrypted DoH or DoT upstream.
• Built-in categories include ads, trackers, malware and telemetry.
• You can add HTTPS sources, create custom `allow / block / host / redirect` rules, test a domain and refresh filters manually.

Safest first setup:

1. Open Own DNS settings.
2. Press Apply preconfigured profile to load a working base.
3. Check the encrypted upstream and correct the DoH/DoT address if needed.
4. Enable only the filter lists you actually want.
5. Run Test configuration or Test upstream connection.
6. Only after a successful test press Connect.

How to read the Own DNS screen:

• Dashboard shows active rules, today’s blocks, cache hit, queries, upstream latency, errors and the last update time.
• Test domain explains whether a domain will be blocked, allowed, redirected or answered by a custom host entry.
• Import domain list lets you paste hosts or domain lines and shows a preview of accepted and rejected entries.
• Auto-update filter lists enables background refresh of active filter sources.

Own DNS privacy: full domain logging is off by default. If you enable it, logs stay local for up to 7 days. You can clear them, export a full JSON file or export an anonymized version. Nothing is uploaded automatically.

Own DNS: switches and actions that affect the final result the most

• Apply preconfigured profile loads a safe starting point with working DoH and sample rules. It is a baseline for testing, not a finished policy for every home.
• Built-in ads / trackers / malware / telemetry are separate local block lists. Telemetry is often the most aggressive category because some apps reuse similar domains for diagnostics, configuration or sign-in flows.
• Auto-update filter lists refreshes active sources in the background. That keeps blocking fresh, but behavior can change without manual editing because a list may add or remove domains.
• HTTPS sources let you add external lists. The more lists you enable, the higher the false-positive risk, so Test domain and local allow exceptions become more important.
• Allow lets a domain pass locally even if wider filters would block it. This is the main tool for fixing false positives.
• Block blocks a domain locally before it ever reaches the upstream. It is the safest protection rule because it does not rewrite traffic.
• Host answers with a fixed IP directly on the device, without asking the upstream. It is useful for your own LAN hostnames, but a wrong IP immediately sends apps to the wrong place.
• Redirect rewrites a domain to another IP. It is the strongest and riskiest action because it can easily break sign-in, CDNs or app behavior when that domain normally resolves to multiple changing addresses.
• Decision order inside Own DNS is exceptions/allow → host → redirect → block → built-in lists → cache → encrypted upstream. That means an allow can unblock a listed domain, while host and redirect win before traffic reaches the external resolver.
• Test configuration / Test upstream connection should be run after every upstream or rule change. The app deliberately marks such a profile as needing a retest because skipping the test is one of the easiest ways to end up with no DNS.
• Domain logging stores allowed and blocked domains locally for up to 7 days. It does not break connectivity, but it does make the device more privacy-sensitive.
• Top blocked stats gives a lighter summary of the most frequently blocked domains without storing the full log. That is useful when you want diagnostics without full history.

Important from the app code: “Save configuration” only stores the profile, but it does not start filtering. “Connect” is the step that actually enables Own DNS. “Update filters now” downloads current sources immediately, and “Preview” shows which imported lines will be accepted or rejected before saving. Built-in telemetry is the only built-in category that is off by default.

5. Expert DNS

Expert DNS is for users who want local DNS overrides without switching to the full Own DNS workflow. It is still Premium, but more tool-like than protection-like.

• Custom Hosts maps local names to LAN IPs, for example `nas.local → 192.168.1.10`.
• Local DNS rules lets you add `allow`, `block` or `redirect`, including wildcards and limited regex rules.
• Test domain checks whether a domain would match a host entry or a rule.
• Import / export rules moves hosts and rules as JSON between devices.

If you do not need manual host or redirect overrides, keep Expert DNS off and use normal DNS switching or Own DNS instead.

6. Import, export, QR and TV transfer

The import/export area exists so you do not have to retype complex DNS settings with a TV remote.

• Import from code accepts a configuration code or QR generated on another device.
• Import from URL downloads app JSON, hosts, domain lists or local rules from HTTP/HTTPS once. It is not background sync.
• Import list/file uses the Android document picker.
• Receive on TV starts a temporary local receiver. The TV shows IP, port and PIN.
• Send to TV on the phone sends the current setup to the TV inside the same trusted LAN.

Cloud Backup Beta is still only roadmap. Real transfer today happens locally through export, QR or LAN transfer.

7. Wi‑Fi Analyzer and room scans

This is one of the modules that grew the most. The key is to separate two modes.

• Basic Wi‑Fi scan is available in Free. It is a quick stationary scan around the current device and it does not save history.
• Room Wi‑Fi scanner is Premium. It lets you walk through the house with a phone or tablet, save measurement points, name them and compare complete sessions.

What are rooms and points? A “room” is not a cloud object or a device group. It is simply a saved measurement point from a physical place, for example “living room”, “bedroom”, “TV shelf” or “kitchen”. Each point remembers what the phone saw there: signal level, current channel, number of visible APs and channel recommendations.

How to run a full room scan:

1. Open the room scanner on a phone or tablet. On Android TV this mode is intentionally limited because the TV stays in one place.
2. Press Start walk scan.
3. Stand in the first place and save a point. The app can ask for a point name immediately.
4. Move to the next room or position and use Save room point again.
5. If needed, tap the last point and use Rename last point.
6. After covering the route, choose Finish and analyze.

How to read the results:

• Recommendation highlights the least congested channels based on visible networks and their strength.
• Why this channel? shows the score derived from overlap. On 2.4 GHz the key channels are usually 1 / 6 / 11.
• Detected networks lists SSIDs/BSSIDs with RSSI, channel, band and width.
• Heatmap shows which channels look cleaner and which are more crowded.

A/B comparison is for comparing two saved sessions, for example before and after changing the router channel, or one router position versus another. The app explains whether more neighboring APs appeared, whether the current network moved channels and whether the 2.4/5 GHz recommendation changed.

New scan from zero clears only the currently visible on-screen results and starts a fresh scan. It does not delete saved room history.

DFS on 5 GHz means high channels that are often cleaner, but routers may be forced to move away when radar is detected, and some TVs do not support every DFS channel. If streaming is unstable, a stable non-DFS channel near the router can be the safer choice.

On phones and tablets Android usually requires location permission or “Nearby Wi‑Fi devices” plus location services enabled. On Android TV the system often exposes only the current connection, so full house scanning is meant for a mobile device.

8. Internet Speed Test

The Speed Test has two levels.

• Quick test in Free gives a short sample and uses less data.
• Detailed test in Premium measures download, upload, latency and jitter and stores local history.

Premium also lets you choose Auto, EU, US or a custom URL. A custom test URL is useful when you want to compare behavior against a specific server or your own endpoint.

History makes sense after changing Wi‑Fi channels, switching DNS, moving the router or checking how the line behaves at different times of day.

Remember that detailed testing transfers real data. On a mobile plan it can consume quota.

9. Network tools and local statistics

The Tools section is now a real diagnostics package, not just a side add-on to DNS.

• DNS Speed Test compares latency of different resolvers from your current network. It measures speed, not privacy quality.
• Website reachability checks DNS resolution and basic HTTP/HTTPS reachability for a domain or URL.
• Network inspector / My address shows local addresses, gateway, active DNS and general network state.
• Quick LAN snapshot is a light overview of interfaces, gateway and ARP cache.
• Deep LAN scan actively looks for hosts in the local subnet and performs light checks of common ports. It still stays inside the LAN and does not require root.
• Wake-on-LAN sends a magic packet to a device that supports WoL.
• Stability Monitor collects latency samples to the gateway and DNS so you can spot spikes caused by Wi‑Fi congestion, the router or the internet line itself.

Local DNS statistics are optional local-only history. If you enable them, the app stores DNS activity and top domains only on the device. That is a conscious choice because domain history can be private.

10. SSH Client and tunnels

SSH is a Premium tool for your own servers, NAS devices, routers and other trusted systems.

• SSH profiles store host, port, user, password or private key.
• Quick commands are saved macros that stay usable with a TV remote.
• Run command executes one command and shows the result without opening a full shell.
• Open terminal starts an interactive SSH shell session.
• SSH tunnel creates local forwarding `127.0.0.1:localPort → remoteHost:remotePort` through the selected profile.
• Reverse SSH tunnel exposes a port on the SSH server back to this device without using a public `0.0.0.0` bind.

This feature is not intended for random public servers. Credentials stay local, so it is best used only with systems you own or manage.

11. Walkie Talkie Free and Walkie Beta QR Premium

The app now has two different conversation modules, and they should not be confused.

Walkie Talkie Free is the classic Bluetooth module. First pair the phones in Android Bluetooth settings, then put one device into waiting mode and connect from the other device through the paired conversation list. It offers chat, photos, call alert, speaker toggle and half-duplex hold-to-talk. Newer updates also added conversation lists, nearby BLE discovery and lighter battery behavior.

Walkie Beta QR is the new Premium module, separate from classic Walkie.

• It works only on compatible phones and tablets from Google Play. It does not launch on Android TV.
• The host creates a room and shows a QR code or invite code.
• A participant scans the live QR, picks a QR photo from the gallery or pastes the code manually.
• The connection runs locally through Nearby Connections, without an app cloud and without a public room directory.
• Voice is half-duplex hold-to-talk: only the person currently holding the button speaks.
• It also includes call alert, chat, photo sharing and a speaker toggle.

Most common Walkie Beta QR requirements: Premium, Google Play Services/Nearby, Bluetooth, microphone, camera and on some Android versions also location or nearby-device permission.

If Nearby is not available on the phone, classic Bluetooth Walkie remains the fallback path.

12. Android TV, launcher, widgets and Auto/Bluetooth

• Pin to Home / Add to Favorites: some TVs, including selected Sony models, do not add new apps to the home row automatically. Open Apps, long-press OK and pin the app manually.
• Leanback shortcut: the app also publishes a launcher shortcut that may appear separately.
• Autostart: after Android TV boots, the app can restore current DNS settings or a selected profile.
• Widgets: DNS start/stop widgets and a DNS profile widget are available.
• TV recording helper and on-screen remote are testing tools for capturing clean TV-style screenshots and videos.
• Android Auto compatibility tries to reduce conflicts between DNS VPN and Android Auto.
• Auto/Bluetooth rules let you choose a car Bluetooth device and decide whether DNS should disconnect automatically when the car connects and whether the previous DNS state should be restored later.

13. Privacy and key notes

The app is designed around a local-first model: no account, no general-purpose app cloud and no ads. That still does not mean every tool is permanently offline. The practical meaning is important.

• DNS queries go to the resolver selected by the user.
• Own DNS logs full domains only after the user explicitly enables that option.
• SSH profiles, Wi‑Fi history and Speed Test history are stored locally on the device.
• Walkie Beta QR and classic Walkie operate locally/offline without an app cloud.
• Premium purchases and Google Play modules are handled by Google Play, not by a custom in-app payment backend.

This documentation describes the current user-visible behavior of the app modules and their limits on phone, tablet and Android TV.