Features

DNS protection

While the tunnel is up, DNS can stay inside it. You choose a standard resolver, a malware-blocking resolver, or a tracker-blocking resolver.

Standard DNS is the default on every plan.
Malware-blocking and tracker-blocking resolvers are advanced DNS, included with Plus and above.
Off-tunnel DNS is blocked while the connection is protected, so a lookup does not slip out beside the tunnel.
IPv6 can be blocked on Windows for the same reason: an unused address family should not become a side path.

Create an account and connect a device.

The device keeps its private key. The API assigns a server that is actually online.