DNSSEC vs NoirShield

DNSSEC routes your device's DNS queries through a DNSSEC-validating resolver — in one tap, without a VPN. Modern DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) encrypt your queries in transit. DNSSEC validation at the resolver ensures the answers haven't been tampered with. Together they make DNS the private, trustworthy channel it was always meant to be. BUILT-IN DNS4EU PRESETS DNS4EU is the European Commission-backed public resolver network. Four presets ship with the app: • Protective — blocks malware and phishing domains • Protective + Ad Blocking — adds tracker and ad filtering on top • Protective + Child Protection — adds adult content filtering • Unfiltered — encrypted and DNSSEC-validating, no content filtering Pick a preset and tap Apply. iOS will prompt you once to allow the DNS profile, then it's active system-wide. YOUR OWN RESOLVER Prefer a different provider? Add any DoH or DoT endpoint: • Enter a DoH URL (https://…) or a DoT hostname • Optionally add fallback IP addresses for bootstrapping • Flag it as DNSSEC-validating to track which resolvers you trust Custom resolvers are stored on-device and never leave it. ONE TAP, SYSTEM-WIDE The profile installs via the operating system's built-in DNS Settings — no VPN tunnel, no proxy, no configuration profile to trust manually. Once applied, every app on your device uses the configured resolver. Remove it any time from within the app or from Settings › General › VPN & Device Management › DNS. WORKS EVERYWHERE Available for iPhone, iPad, Mac, Apple TV, and Apple Vision Pro.

NoirShield is a network tool that runs entirely on your device. It encrypts your DNS lookups and can match them against blocklists stored on the device. Your traffic is never routed through a server of ours: there is nothing to relay it through, and your IP address does not change. ENCRYPTED DNS Resolve names over DNS-over-HTTPS or DNS-over-TLS. Choose from built-in encrypted resolvers or enter your own custom endpoint. Measure them on the network you are on and switch to the fastest. ON-DEVICE FILTERING Optional lists for ads and trackers, malware, phishing and crypto mining — 470,943 domains, matched on the device. Every list is off until you turn it on. You can import your own list and add your own allow and block rules, which take priority. DIAGNOSTICS Fourteen checks: reachability, IPv4 and IPv6, captive portals, latency, DNS resolution, DNS interception, DoH, DoT, HTTPS, TLS, QUIC, WebSocket and UDP. AUTOFIX Measures the network, applies a compatibility profile, verifies the result and remembers what worked for that network. NO ACCOUNT No sign-up, no sign-in, no subscription. Nothing about your lookups is uploaded. The activity log stays in memory and is gone when the app closes, unless you switch on "Keep activity after restart" in Settings. The app reaches our server for two things only: signed blocklist updates, and the connection tests while you are running diagnostics. NoirShield is not a country-switching VPN. It has no relay or proxy server, does not change your IP address and never decrypts HTTPS. On iPhone and iPad, iOS shows its own VPN badge whenever an on-device tunnel is running; NoirShield uses that tunnel only to hand DNS queries to the resolver on your device.