Colitu Shield

Colitu Shield is an optional protection layer that works at the DNS level. Before your device connects to a site, it asks for the site's address. Shield answers that question on Colitu's own resolvers, and for addresses known to be harmful it answers 0.0.0.0, so the connection never happens. No extension or extra app is needed.

Shield is a switch in all four apps: Windows, Android, iOS and Linux. You turn it on in the settings under the name Ad blocking; Shield is the protection behind that switch. Shield used to be called the ad blocker; the protection against malware, phishing, scams and cryptomining was added on 7 October 2026.

#What Shield blocks

All five categories work together when Shield is on. The lists update themselves every 24 hours and hold about 380 thousand rules in total.

#How to turn it on

1. Open the settings in the Colitu app: Settings → Connection on Windows and Linux, Account → Features on Android and iOS.
2. Turn on Ad blocking.
3. The app reconnects for a moment. From then on, Shield works as long as you are connected.

To turn it off, switch it off again; the app reconnects once more. Today Shield is one switch for all categories; you cannot choose categories separately (see "Roadmap" below).

#How it works

• Device → encrypted tunnel → Colitu resolver → filters → answer. With Shield on, DNS lookups go through the VPN tunnel, encrypted with DNS-over-HTTPS, to Colitu's own AdGuard Home resolvers. The service can only be reached from inside the tunnel.
• On Android and iOS, and on Windows and Linux in TUN mode, this covers all DNS lookups of your device. In system proxy mode (the default on Linux) only apps that use the proxy are covered; turn on TUN mode for protection everywhere.
• A name on the lists gets the answer 0.0.0.0. The app can never reach that server, the dangerous page does not open and a tracker cannot send data.
• Names that are not on the lists are asked to Cloudflare and Quad9 over DNS-over-HTTPS. EDNS Client Subnet is off, so they see our server's address, not yours.
• Frequent names come from the cache, so pages often open faster.
• The resolvers are in Sweden, the United Kingdom and Poland. If one does not answer, the app moves to the next.

#Privacy

• The query log is off. Which names you ask for, and so which sites you open, is stored nowhere. We cannot see it either.
• Statistics are off. The resolvers keep no per-user counters and no lists of most-asked or most-blocked names.
• No new data is collected. Turning Shield on creates no extra record for your account.
• The same goes for the traffic itself: see Privacy.

#What Shield cannot do

• Ads served from the same domain as the content. YouTube video ads come from the same servers as the video and cannot be told apart at the DNS level. The same goes for ads inside Instagram or Twitch feeds.
• It does not replace antivirus software. Shield only stops connections to known bad addresses. It does not scan files on your device and cannot recognise new dangers that are not on the lists.
• The browser's own DNS. If Secure DNS (DNS-over-HTTPS) is on in Chrome, Edge or Firefox, the browser bypasses the system DNS and therefore Shield. Turn it off or set it to automatic.
• Occasional false positives. A legitimate site may be blocked by mistake. Turn Shield off for a moment, use the site and tell support so that it can be taken care of.

#Roadmap

These items are planned but not live yet, and we give no dates:

• an optional adult-content filter;
• a personal blocklist and allowlist;
• a "today N trackers blocked" counter that is computed on your device and never sent to us;
• per-category switches.

#How do I know it works?

The Ad blocking test at colitu.com/tools/ad-block-test shows in a few seconds whether well-known ad and tracker domains are blocked. With Shield on, almost every domain should show Blocked. The product page with the overview is at colitu.com/shield.

#Troubleshooting