Internet access that can't be blocked

DNSTT hides your internet traffic inside DNS queries — the system every device uses to look up website addresses. DNS is so fundamental to how the internet works that no government can block it without shutting down their entire network. Your encrypted data rides inside what looks like completely normal DNS lookups.

Each packet is encrypted with Curve25519 keys before being embedded in DNS records. The traffic pattern is indistinguishable from a busy DNS resolver handling millions of legitimate queries. DNSTT has been battle-tested in Iran through multiple internet shutdown events and has never been successfully blocked.

Best for: Everyday use in Iran, China, and any country that blocks VPNs. Start here — switch to others only if needed.

Slipstream is our fastest DNS tunnel protocol. It uses QUIC — the same protocol that powers HTTP/3 and Google's infrastructure — tunnelled inside DNS queries. The result is significantly higher throughput than DNSTT while maintaining the same DNS-based stealth.

QUIC's built-in multiplexing and connection migration mean Slipstream handles packet loss gracefully and can seamlessly switch between networks (e.g. Wi-Fi to mobile data) without dropping your connection. It's the best option when network conditions are good and you need speed for video calls or streaming.

Best for: Video calls, streaming, and large downloads on networks where DNS tunnels aren't yet detected.

VayDNS is our most advanced anti-detection protocol. It uses KCP (a UDP-based reliable transport) tunnelled through DNS, with a tunable wire format that can be adjusted to evade even the most sophisticated DPI systems. The protocol supports multiple DNS record types (TXT, CNAME, A, AAAA, MX, NS, SRV, NULL, CAA) and can switch between them on the fly.

When Iran or China upgrades their censorship infrastructure to detect one tunnelling pattern, VayDNS can be reconfigured to use a different record type, query size, and timing pattern — without changing anything on your phone. This adaptability makes it the last resort when everything else has been fingerprinted.

Best for: When DNSTT has been detected. Networks with advanced DNS tunnel detection. The hardest protocol to fingerprint.

NaiveProxy takes a completely different approach. Instead of DNS tunnelling, it disguises your traffic as normal HTTPS website browsing. It runs on top of Caddy (a production web server) with a real Let's Encrypt TLS certificate. When anyone — including a censor — connects to the server, they see a perfectly normal website.

The proxy uses Chromium's network stack internally, so the TLS fingerprint matches a genuine Chrome browser. Active probing (where censors connect to suspicious servers to test if they're proxies) returns a legitimate decoy website. NaiveProxy is also the only protocol in our suite that works on iOS via the Shadowrocket app.

Best for: When DNS-based tunnels are blocked. iOS users (via Shadowrocket). Networks that only allow HTTPS traffic.

StunTLS wraps an SSH tunnel inside TLS encryption, with optional WebSocket transport for CDN compatibility. Unlike the DNS-based protocols, StunTLS doesn't require any domain configuration — it connects directly to the server IP over port 8443. This makes it the simplest to deploy as a fallback.

The TLS layer ensures the connection looks like encrypted web traffic, while the SSH layer provides secure, authenticated tunnelling with zero DNS leaks. StunTLS is particularly useful in corporate environments where DNS traffic is filtered through local resolvers.

Best for: Corporate networks. Quick fallback when DNS tunnels aren't available. Environments with local DNS filtering.

NoizDNS uses the same server infrastructure as DNSTT but enables additional client-side obfuscation. The SlipNet app adds noise to the DNS query timing and size patterns, making it harder for statistical analysis to identify the tunnel. The server handles both DNSTT and NoizDNS clients on the same port — the difference is entirely in how the client shapes its traffic.

Best for: When DNSTT is detected via traffic analysis. Slightly slower than DNSTT due to noise injection, but significantly harder to fingerprint.