Overview
PremierNexus is a DNS tunnel VPN for Android. It hides your internet traffic inside ordinary DNS lookups, so it keeps working on networks that block or slow down normal VPNs. The current version is 2.1.0. It's part of the PremierVPN family of apps.
Who it's for: people on restricted or unreliable networks, where WireGuard, OpenVPN and similar VPNs are blocked. A DNS tunnel is slower than a normal VPN; it's meant for staying online when nothing else connects.
What you need:
- An Android phone or tablet running Android 8.0 or later (the app targets Android 16)
- A server profile for a StormDNS, CottenDNS or SOAR server, usually a link you get from PremierVPN or your server administrator
- No account or sign-in. Everything you set up stays on your device.
What's new in 2.1:
| Area | Change |
|---|---|
| Log tab | A new Log tab in the bottom bar shows what the app and the tunnel are doing, live. You can copy it for support. |
| Resolver lists | Built-in WhiteDNS, SAMPA and SlipNet lists, plus Masir Sefid, verified Iranian resolvers, Iranian DNS ranges and public resolvers. |
| Scanner | No limits on how many resolvers you scan. Each engine tests resolvers the way it will really use them. |
| My resolvers | Several named resolver lists. Import and export them as .txt files. One active list is shared by all engines. |
| StormDNS | A new default preset tuned for restricted networks (the original StormDNS values are still available). New DNS record types: TXT, NS, CNAME, SRV and Auto. XOR is the default encryption for new servers. |
| CottenDNS | Choose any of 14 DNS record types. |
| Connection check | After connecting, the app checks the tunnel can actually reach the internet, and shows how many resolvers are active and valid. |
| Fixes | Fixed SOAR freezing on disconnect, and StormDNS "connection refused" errors on slow networks. |
| Size | Smaller download. Android 16 support. |
How it works
PremierNexus wraps your traffic inside DNS lookups and sends them through a public DNS resolver to a PremierNexus-compatible server, which unwraps them and sends your traffic on to the internet. Networks that block VPNs usually still let DNS through, because almost everything needs it.
To the network it looks like ordinary DNS lookups going to an ordinary resolver.
The path your traffic takes:
- An app on your phone sends traffic. In Full VPN mode the app captures all of it; in Proxy mode only apps you point at the local SOCKS5 proxy.
- The tunnel engine encrypts it and splits it into many small DNS queries for the server's tunnel domain (for example
t.example.com). - The queries go to a DNS resolver: an ordinary DNS server on or near your network, such as your mobile operator's.
- The resolver forwards the queries to the PremierNexus server, because that server is in charge of the tunnel domain.
- The server decodes the queries, fetches what you asked for, and sends the replies back inside DNS answers, through the same resolvers.
Why resolvers matter. The tunnel is only as good as the resolvers carrying it. On restricted networks many resolvers are blocked, slow or tampered with. PremierNexus tests resolvers before and during each connection and only uses the ones that actually reach your server. Using many good resolvers at once makes the tunnel faster and more stable.
The three tunnel engines. Each server runs one engine. The engine is set in the server profile, so you don't need to choose it unless you enter details by hand.
| Engine | Best for | Key points |
|---|---|---|
| StormDNS | General use; the most tunable | Shared encryption key (XOR, ChaCha20 or AES-GCM). Record types TXT, NS, CNAME, SRV, Random or Auto. One set of tuning settings for all StormDNS servers. Also works with MasterDNS servers. |
| CottenDNS | Networks that filter particular DNS types or transports | 14 record types. Resolvers over UDP, TCP, DoT, DoH, DoH/3 or DoQ. Presets, rate limiting and timing masks. Optional CottenMax mode (beta). |
| SOAR | Networks with very few working resolvers | Signed server key. Keeps discovering new resolvers while connected. Direct backend (web traffic on ports 80 and 443) or SSH backend (any port). TCP only; UDP and QUIC aren't carried, so apps fall back to TCP. |
What to expect. DNS tunnels are slower than a normal VPN, and the first connection can take from a few seconds up to about two minutes while the engine tests resolvers and packet sizes. Browsing, messaging and email work well. Video calls and large downloads are slower.
Getting started
Most people are connected in three taps: add a server from a link, tap Connect, allow the VPN prompt.
1. Install and open the app. A short intro explains what the app does. You can skip it, and see it again later from Settings › Show intro again.
2. Add a server. You need a profile link from PremierVPN or your server administrator. Supported links start with stormdns://, cottendns://, soar://, slipnet://, masterdns:// or premiernexus://.
- Tap the link on your phone (in an email, a message or a web page). PremierNexus opens and adds the server.
- Or copy the link, open PremierNexus, tap + on the Home screen (or go to the Servers tab) and choose Import from clipboard or Paste link. You can paste several links at once.
- Or enter the details by hand with Enter details (see Server settings below).
3. Connect. On the Home screen, tap Connect. The first time, Android asks you to allow PremierNexus to set up a VPN connection: tap OK. The app then:
- Finds resolvers that reach your server (from your own list if you've turned that on, otherwise automatically).
- Starts the tunnel engine and waits until it's ready. This can take up to about two minutes on a slow network.
- Shows Protected and checks the tunnel can reach the internet. When the check passes, you'll see Verified.
4. Disconnect. Tap Disconnect on the Home screen and confirm.
Full VPN or Proxy only. You choose this in Settings › Tunnel mode. Disconnect before changing it.
| Mode | What it does | When to use it |
|---|---|---|
| Full VPN (default) | All traffic on the device goes through the tunnel. Android shows the key icon in the status bar. | Normal use. Recommended for privacy. |
| SOCKS only | Starts a SOCKS5 proxy at 127.0.0.1 (port 10880 by default). Only apps you set up to use the proxy go through the tunnel; everything else is unchanged. No VPN permission is needed. |
Using the tunnel for one app, such as a browser or Telegram, or alongside another VPN. |
The proxy only listens on the phone itself, so other devices on your Wi-Fi can't use it.
The app, tab by tab
The bottom bar has five tabs: Home, Servers, Resolvers, Log and Settings.
Home
Home is where you connect and see how the tunnel is doing.
- Connect / Disconnect button and the connection state: Not protected, Connecting, Protected, Reconnecting, Disconnecting or Couldn't connect.
- Server card: the server you'll connect to. Tap Change server to pick another. Tap + to add a server.
- Resolver source chip: where this connection's resolvers came from: your list, found automatically, or from server (the profile's own list).
- While finding resolvers: a progress line such as "Finding resolvers · 12 of 40 answered".
- Active resolvers / Valid resolvers (StormDNS and CottenDNS): Active are carrying traffic right now; Valid have passed the engine's checks. Tap either to see the full list with each resolver's response time.
- Connection check: Checking the tunnel reaches the internet…, then Verified or The tunnel is up but can't reach the internet. Tap Check again to repeat it.
- Details: server, domain, engine, encryption, resolvers, uptime, mode, ports, data transferred and a 60-second throughput graph.
In Signal style (Settings › Appearance) Home shows every detail live; Glass style keeps it calm with one big connect button.
Servers
Your saved server profiles.
- Search by name, domain or engine. Filter All or Favourites.
- Tap a server to make it the one Home connects to. If you're connected, the app switches to it.
- Long-press a server for actions: Add to favourites, Edit, Copy link (share the profile) and Delete.
- + Add opens the import sheet: paste one or more links, import from the clipboard, or enter details.
Resolvers
Everything about which DNS resolvers carry your tunnel. It has four parts.
Automatic. Used when Use my resolvers is off.
- Find resolvers automatically (on by default): before each connection, the app tests resolvers against your server and starts with the ones that answer. StormDNS and CottenDNS send a test query for the server's own domain through each resolver and keep the fastest. SOAR has the server check each resolver with its key, and keeps looking while connected.
- Network country: Iran (default), Russia, China or None. Choose the country your phone is in, not the server. It decides which built-in resolver lists are tried.
- Last found: the resolvers found last time. Tap Keep these to save them to your list.
My resolvers. Your own resolver lists. When Use my resolvers is on, the active list is used for every connection on every engine, instead of automatic finding. Each engine still tests the list its own way when you connect and only uses the resolvers that pass.
- List in use: pick which list is active. Use New list, Rename list and Delete list to keep several, for example one per mobile operator (Irancell, MCI, Home Wi-Fi).
- Import .txt / Export .txt: one resolver per line, as
IPorIP:port(port 53 if none is given). Lists can be any size. - Paste from clipboard, Add one, View all (search and remove), Clear list.
- When importing, choose Replace my list, Add to my list or Save as a new list.
Verified for Iran. A built-in list of resolvers known to work in Iran. Pick as many as you like, or Select all, then Use them.
Scanner. Tests a batch of resolvers and shows which work, fastest first.
| Setting | Choices | What it does |
|---|---|---|
| Resolvers to scan | Public DNS, Masir Sefid, WhiteDNS list (4,785), SAMPA-ASA Iran list (31,966), SlipNet list (60,370), Verified for Iran, Iranian IP ranges (random addresses in 474 networks), My resolvers, a .txt file, Paste | Where the addresses come from. |
| How many | A sample size, or All. Random order on or off. | How many to test. No upper limit. |
| Test for | Match the engine (a server), or Ordinary DNS | Match the engine tests each resolver the way that server's engine will use it, with all of its record types. Ordinary DNS passes any resolver that answers normally. |
| Transports | UDP, TCP, DoT, DoH | UDP and TCP use port 53, DoT 853, DoH 443. A resolver passes on a transport when every chosen record type works on it. |
| Record types | Any of the 14 types | Filled in automatically by Match the engine. |
| Workers | 16, 32, 64, 128 or 256 | How many resolvers are tested at once. More is faster but heavier on the phone and network. |
| Timeout | Default 2 seconds | How long to wait for each answer. |
While it runs you see "x of y tested · z working" and can Stop scan at any time. When it finishes, Keep the fastest 10, 50, 100, 500 or All, then Replace my list, Add to my list or Save as a new list. Copy all copies the working resolvers.
Log
The live log shows what the app and the tunnel engine are doing, as it happens. It's the first thing to check when a connection fails, and what support will ask for.
- Follow keeps the newest lines in view. Problems only hides everything except warnings and errors.
- Copy copies the log to paste into a support ticket. Clear empties it.
- Diagnostics opens the diagnostics page.
- The log stays on your phone and is cleared when the app closes.
Settings
Connection options, appearance, help and app information. Every option is described in the next section.
Every setting explained
Most users never need to change anything here: a server link sets up the server, and the defaults suit restricted networks. Changes apply the next time you connect.
Settings tab
| Setting | Default | What it does |
|---|---|---|
| Tunnel mode | Full VPN | Full VPN or SOCKS only (see Getting started). The SOCKS-only page also sets the Local SOCKS5 port (default 10880). Disconnect to change it. |
| StormDNS settings | PremierNexus · restricted networks | Tuning for all StormDNS and MasterDNS servers (below). |
| Connect on launch | Off | Connects to your last server when the app opens. |
| Reconnect automatically | On | Up to three tries if the tunnel drops or the network changes. |
| Kill switch | Set in Android | Shown in Full VPN mode. Opens Android's VPN settings, where you turn on Always-on VPN and Block connections without VPN for PremierNexus. |
| Appearance | Glass | Glass (calm, one tap to connect) or Signal (every detail live, for power users). Accent colour: Frost, Teal or Snow. Style only changes how things look. |
| Language | English | English or Persian (فارسی). |
| Diagnostics | – | Tunnel state, engine, last error, resolver report, engine versions. Copy diagnostics for support. Links to Live log and Connection history. |
| Live log | – | Opens the Log tab view. |
| Logs | – | Connection history: past sessions and connection events. |
| Servers saved | – | How many server profiles are on the device. |
| Show intro again | – | Replays the welcome screens. |
| Reset settings | – | Resets connection, resolver and tuning settings. Your servers stay. |
| Version, Engines | – | App version, and the engines built in (SOAR, StormDNS, CottenDNS). |
| Portal, Help and support, Privacy policy | – | Links to premiervpn.net. |
Server settings (Enter details or Edit)
These come from the profile link, so you only need them when adding a server by hand or fixing one.
All engines:
| Field | What to enter |
|---|---|
| Engine | StormDNS, CottenDNS or SOAR. Must match the server. |
| Name | Any name, for example "Frankfurt 1". |
| Tunnel domain | The server's tunnel domain, for example t.example.com. |
| Encryption key + Encryption method (StormDNS, CottenDNS) | The shared key from your provider, and the method the server uses: None, XOR (default), ChaCha20, AES-128-GCM, AES-192-GCM or AES-256-GCM. Both must match the server exactly. |
| Server public key (SOAR) | The Ed25519 key from your provider (base64 or hex). |
| Advanced › Server IP (optional) | The server's IP address, kept outside the tunnel. Leave empty if you don't know it. |
| Advanced › MTU | Tunnel interface MTU, default 1400. |
Resolvers aren't set per server any more. They're managed in the Resolvers tab.
SOAR servers:
| Field | Choices | What it does |
|---|---|---|
| Backend | Direct, SSH | Direct: the server opens each connection itself; usually only web ports 80 and 443 are allowed. SSH: connections run inside one SSH session on the server, so any port works. Use the backend your provider says; an SSH-only server set to Direct connects but loads nothing. |
| SSH host, Port, SSH username, SSH password | – | Only for the SSH backend. Use the SSH address your provider or SlipGate shows. |
| SOAR preset | Balanced (recommended), Conservative / restricted DNS, Fast / reliable DNS, Custom | Start with Balanced. Use Conservative when resolvers drop long names or large answers. |
| DNS resolver transport | Auto UDP with TCP fallback, UDP and TCP together, TCP only, UDP only | How SOAR talks to resolvers. |
| Discover additional resolvers | On / off, plus Network country | Keeps finding more resolvers that carry the tunnel while you're connected. |
| Advanced | Queries in flight, window per resolver path, maximum DNS answer, maximum and initial query name length, held poll budget, maximum TCP streams, receive window and send buffer per stream, idle session timeout, connection timeout, desired healthy paths, discovery concurrency and spacing | Expert tuning. Higher values use more memory and DNS traffic. |
CottenDNS servers:
| Field | Choices | What it does |
|---|---|---|
| Preset | Default, Speed, Survival, TCP Survival, Master / Storm DNS (compatible) | A starting set of transport, record types and label length. Master / Storm DNS is for connecting to those servers with CottenDNS. |
| CottenDNS mode | Normal CottenDNS, CottenMax (beta) | CottenMax needs an updated CottenDNS server. If it can't connect, choose Normal and reconnect. |
| Background scan resolvers | 1–32 (default 1) | How many resolvers are checked at once by the background scan after the tunnel is up. 1 keeps it out of the way of live traffic. |
| Advanced › Query rate limit | Off, 2, 3, 4, 6, 8, 12 or 16 per second; applied in total, per resolver or per domain | For networks that block DNS above a fixed rate. Start with 3 per second. |
| Advanced › Timing mask | Off, Light, Strong | Randomises query timing so it has no fixed rhythm. |
| Advanced › Transport | From preset, Auto (UDP + TCP/53 fallback), UDP/53 only, TCP/53 only, DoT, DoH, DoH over HTTP/3, DNS over QUIC | How CottenDNS reaches resolvers. |
| Advanced › Delivery | From preset, TXT only, TXT + CNAME, TXT + HTTPS, TXT + AAAA, All (TXT / CNAME / NULL / HTTPS / AAAA), Choose record types | Which DNS record types carry the tunnel. Choose record types lets you pick any of TXT, A, AAAA, CNAME, MX, NS, PTR, SRV, SVCB, CAA, NAPTR, SOA, HTTPS and NULL. |
| Advanced › IP mode | From preset, Auto (IPv4, IPv6 fallback), IPv4 only, IPv6 only | Which IP version is used to reach resolvers. |
| Advanced › QNAME reshaping | From preset, Off (63), Moderate (42), Aggressive (32) | Shorter query labels look less unusual and get through stricter filters, but carry less data. |
StormDNS settings (Settings › StormDNS settings)
One settings profile used by every StormDNS and MasterDNS server. Empty fields keep the value shown in grey, which is what runs now.
| Setting | Default | What it does |
|---|---|---|
| Start from a preset | PremierNexus · restricted networks | PremierNexus · restricted networks lowers the MTU so more resolvers work, sends downloads twice and uses lighter workers. StormDNS original uses the engine's own values. Other presets are tuned for speed or particular conditions. |
| DNS record type | TXT | TXT works with every server. NS when the resolver path blocks TXT. CNAME gives the most web-like queries. SRV when the other types are filtered. RANDOM mixes TXT, NS, CNAME and SRV. AUTO tests each resolver and picks its most reliable type from the ones you tick. NS, CNAME, SRV, RANDOM and AUTO need an up-to-date StormDNS server. |
| MTU: Min / Max upload, Min / Max download | 40 / 140, 300 / 3000 bytes | The packet sizes the engine tests on each resolver. Lower minimums let more resolvers qualify. |
| Resolver retries, Resolver timeout | 3, 2 s | How hard the MTU test tries each resolver. |
| Resolver MTU parallelism | 100 | How many resolvers are MTU-tested at once. Higher can connect faster but loads the phone. |
| MTU from logs | 5 retries, 2 s, 32 parallel | Re-testing of resolvers seen in earlier sessions. |
| Runtime workers, queues and timers | RX/TX workers 4, process workers 4, UDP pool 64, stream queue 128, orphan queue 32, DNS fragments 256 | Engine internals. Raise one value at a time; more uses more memory and battery. |
| Balancing strategy | Least loss | How traffic is spread across resolvers: Random, Round robin, Least loss or Lowest latency. |
| Upload dup, Download dup | 1, 2 | Sends each packet more than once, so lost queries don't stall the tunnel. Uses more DNS traffic. |
| Upload / Download compress | LZ4 | Off, ZSTD, LZ4 or ZLIB. |
| Base encode data | Off | Extra encoding for resolvers that mangle binary data. |
| Ping watchdog | 300 s | Restarts the session if the server stops answering for this long. |
| SOCKS5 authentication | Off | Asks apps using SOCKS-only mode for a username and password. Full VPN mode passes them automatically. |
| Reset StormDNS settings | – | Back to the PremierNexus · restricted networks defaults. |
Troubleshooting and FAQ
Most connection problems come down to resolvers: the fix is usually a fresh list of resolvers that work on your network right now.
Troubleshooting
| Problem | What to try |
|---|---|
| Stuck on Connecting or Finding resolvers | Wait up to two minutes: the first connection tests packet sizes on every resolver. If it still fails, go to Resolvers › Scanner, choose Match the engine with your server, scan the WhiteDNS or SAMPA list, keep the fastest 50–100, then turn on Use my resolvers and connect again. |
| Couldn't connect straight away | Check the server's details match what your provider gave you, especially the tunnel domain, encryption key and encryption method. Try another server. |
| The tunnel is up but can't reach the internet | On a SOAR server, check the backend: an SSH-only server set to Direct connects but loads nothing. Edit the server and set Backend to SSH with the SSH details. On StormDNS or CottenDNS, check the encryption key and method, then tap Check again. |
| Connects, then drops after a few seconds | The resolvers in use are being blocked. Scan for a new list and use it, and keep Reconnect automatically on. On StormDNS, make sure the preset is PremierNexus · restricted networks. |
| Very slow | DNS tunnels are slower than normal VPNs. Use more working resolvers (50 or more), and avoid Wi-Fi or mobile data that's congested. For CottenDNS, try the Speed preset. |
| Some apps or video calls don't work on SOAR | SOAR carries TCP only, so UDP and QUIC aren't carried; most apps fall back to TCP. SOAR Direct servers usually only allow web ports 80 and 443. Use an SSH-backend server for other ports. |
| StormDNS won't connect with NS, CNAME, SRV, RANDOM or AUTO record types | The server must run an up-to-date StormDNS build. Switch DNS record type back to TXT, or ask your provider. |
| CottenMax won't connect | CottenMax needs an updated CottenDNS server. Set CottenDNS mode back to Normal CottenDNS. |
| "VPN permission was declined." | Tap Connect again and choose OK on Android's prompt. If another VPN app is set as Always-on, turn that off in Android's VPN settings. |
| "The engine stopped responding. Close PremierNexus (swipe it away) and open it again." | Swipe the app away from Recent apps, open it again and reconnect. |
| A scan finds nothing | Your network may block that list's resolvers. Try another source, Iranian IP ranges, or Ordinary DNS to see whether any resolver answers at all. |
Sending details to support
- Reproduce the problem (try to connect).
- Open the Log tab and tap Copy.
- Open Settings › Diagnostics and tap Copy diagnostics.
- Paste both into your support ticket at premiervpn.net/support-help-centre.
Logs can include your server's domain and the resolvers you used. Send them to support only, not in public forums or groups.
FAQ
Do I need an account? No. PremierNexus has no sign-in. Server profiles, resolver lists and settings are stored only on your device.
Can I use servers from other providers? Yes, any compatible StormDNS, MasterDNS, CottenDNS or SOAR server, including SlipGate servers shared as slipnet:// links.
Which engine should I choose? Use whatever your server runs; the profile link sets it. If you have servers on several engines, try StormDNS first, CottenDNS where specific DNS types are filtered, and SOAR when very few resolvers work.
How do I use SOCKS-only mode with an app? Set Tunnel mode to SOCKS only and connect. In the app (for example Telegram or Firefox), set a SOCKS5 proxy at 127.0.0.1, port 10880 (or the port you set). If you turned on SOCKS5 authentication in StormDNS settings, enter that username and password too.
How do I stop apps leaking traffic if the tunnel drops? In Full VPN mode, open Settings › Kill switch. This opens Android's VPN settings: turn on Always-on VPN and Block connections without VPN for PremierNexus.
Should I use my own resolver list or automatic finding? Automatic finding works for most people. Use your own list when automatic finding is slow or fails, or when you already know resolvers that work on your network. Keep separate lists per network (for example one for mobile data and one for home Wi-Fi) and switch with List in use.
Why does the first connection take so long? The engine tests each resolver and the largest packet size it can carry before opening the tunnel. With a good resolver list, later connections are usually faster.
Does it use a lot of battery or data? More than a normal VPN, because every packet becomes several DNS queries, and settings like Download dup send data twice. Disconnect when you don't need it.
Which languages are supported? English and Persian (فارسی). Change it in Settings › Language.