NetShield 100% Automatic Encrypted DNS Armor

Automatic protection across every device.

Install the 1-tap profile once and browse normally—NetShield automatically kills pop-under ad networks, CNAME-disguised trackers, fake virus alerts, and malware redirects in the background.

Active Block Rules 112 Auto-Synced Feeds + CNAME Uncloak
Threats Sinkholed 0 0 DNS lookups inspected
RAM Cache Hits 0 0ms TTL prefetch active
Links & Pages Cleaned 0 Cloudflare 1.1.1.2 + Quad9

iPhone & iPad — 1-Tap Set & Forget

One install activates automatic system-wide DNS blocking (including CNAME-cloaked pop-under scripts + 300k+ live threat domains) and adds your pre-signed NetShield icon to your Home Screen. Zero pasting links or keys.

  1. Tap Install iPhone / iPad Automatic Shield below in Safari and tap Allow.
  2. Open Settings → Profile Downloaded → Install once. Everything runs 100% automatically on Wi-Fi & 5G from that point on.
  3. For your iPad: tap Copy 1-Tap iPad Link, open it in iPad Safari, and tap Install—both automatic DNS and your signed-in Home Screen app install together.

Google Pixel 10 & Android Setup

Lock in automatic encrypted DNS filtering across Android apps, Chrome, and Brave with zero battery drain.

Option A — Android System Private DNS (Port 853 DoT)

Open Settings → Network & internet → Private DNS → Private DNS provider hostname:

shield-85-239-249-225.nip.io
Option B — Chrome / Brave Secure DNS (Port 443 DoH)

Open Browser Settings → Privacy and security → Use secure DNS → Custom:

https://shield-85-239-249-225.nip.io/dns-query/YOUR_TOKEN
Apple TV (tvOS 17+)

Paste the 1-Tap Profile URL in Settings → General → Privacy & Security → Share Apple TV Analytics → Add Profile to strip Smart TV telemetry and ad beacons automatically.

1-Command Contabo VPS Deployment (Co-Hosts Safely with ReelVault & Plex)

Zero-touch co-hosting via Caddy Admin API, automatic 15-minute GitHub updates, and Linux TCP BBR low-latency congestion control.

curl -fsSL https://raw.githubusercontent.com/davidscottballard1-png/NetShield/main/server/setup.sh | sudo bash

Optional: Direct Video Stream Extractor (De-Trapper)

Your DNS profile already blocks pop-unders and ad domains automatically as you browse. Only use this box if you ever want to pull a raw .mp4 / .m3u8 video link out of a page.

CleanLink Tracker & Redirect Stripper

Strips utm_*, fbclid, gclid, ttclid, igshid, and unwraps redirect shorteners before sharing links.

Instant Domain Threat Check

Verify whether any ad broker, popup domain, or scareware hostname is sinkholed by your active rules.

Threat & Ad Blocklist Feeds

Subdomain-aware DNS sinkholing (`0.0.0.0` / `::` + `NXDOMAIN` on `HTTPS` records so Safari never leaks via ECH).

    Custom Allowlist & Denylist

    Allowlist rules always override blocklists for instant site fixes; Denylist rules block any domain and all its subdomains.

    Custom Blocked Domains (0)
    Custom Allowed Domains (0)

    Live Encrypted DNS Inspection Log

    Recent DNS-over-HTTPS and DNS-over-TLS lookups kept strictly in volatile RAM (never written to disk).

    Time Domain Type Verdict Reason Quick Rule
    Connect your NetShield VPS (or run a query in Preview) to inspect live encrypted DNS traffic.