SparkleDNS

SparkleDNS encrypts every DNS lookup on your device with DNS-over-HTTPS (RFC 8484) and HTTP/3. It uses Android's VPN API only locally: just DNS requests go into the tunnel, all other traffic takes your normal connection, so speed and battery stay the same.

Servers

SkySparkle (default) with HTTP/3, run by the developer

Cloudflare, Google, Quad9, AdGuard, Mullvad

Any custom DoH server, with optional bootstrap IPs and HTTP/3

Features

One-tap connect, Quick Settings tile, Always-on VPN support

Live monitor: every query with its status and latency, filters, search and one-tap blocking

Per-app rules: apps grouped by category, chosen ones bypass SparkleDNS

Blocklists: your own domains plus hosts, plain domain, AdBlock and dnsmasq lists by URL, HaGeZi Pro++ and TIF one tap away. Subdomains are blocked too, changes apply instantly

Local DNS cache that honours TTLs

Server test showing the protocol (h3 or h2) and latency

Privacy

No analytics, no ads, no Google Play Services. The query log lives only in memory and never leaves the device. DNS requests go to the server you choose. The default SkySparkle server is run by the developer under this privacy policy: https://skysparkle.cc/privacy?lang=en

Permissions

VPN: a local tunnel that carries DNS only, nothing is routed to a remote VPN

Notifications: connection status with a Disconnect button

Network state: needed by Android's HTTP/3 engine and to detect Private DNS

Installed apps (launcher entries only): to list apps for per-app rules

HTTP/3 needs Android 14 or newer; older versions use HTTP/2. If Private DNS in Android settings is set to a specific hostname, Android sends DNS there instead; SparkleDNS shows a warning when that happens.