The problem
Give Android users understandable control over DNS filtering without disrupting ordinary web traffic.
The engineering
A narrow virtual DNS route keeps unrelated traffic outside the tunnel. Protected upstream sockets, response validation, bounded workers, and packet checksum tests support the networking layer.
The experience
Compose and Material 3 provide onboarding, protection controls, settings, and persistent lifetime counters. Optional domain history remains in memory; private browsing pauses domain logging.
The boundary
DNS filtering can be bypassed by encrypted or app-specific resolvers. This is not an encrypted VPN. Live filter downloads remained unverified on the connection documented in the latest README.