DNS
- Corrected sdns:// parsing to the current DNS stamp format with 8-byte little-endian properties while preserving compatibility with legacy one-byte HostShield-encoded stamps.
- DNSCrypt resolver stamps now retain and validate the required 32-byte provider public key instead of silently discarding it.
- Added Anonymized DNSCrypt relay stamp support (�x81) and a route planner that validates resolver/relay roles, rejects resolver-as-relay privacy collapses, and builds the relay prefix that targets the resolver while the network destination remains the relay.
- Added DoQ and ODoH stamp protocol identifiers in the shared parser so the next DNS protocol work can reuse the same spec-correct stamp layer.
Verification
- :app:compileFullDebugKotlin
- :app:testFullDebugUnitTest --tests com.hostshield.util.DnsStampParserTest --tests com.hostshield.service.DnsCryptRoutePlannerTest
- :app:assembleFullDebug
- :app:assembleFullRelease
- APK signature verified with Android �pksigner.
- Installed on connected devices R5CT139QJ5F and R5CY34G070L; both report versionName 6.5.9, versionCode 67, and launched without a fatal crash in logcat.
Artifact
- HostShield-v6.5.9-full-release.apk
- SHA-256: $hash
Remaining DNSCrypt transport work
Full DNSCrypt v2 query encryption/decryption is not wired yet. The parser and anonymized route layer are now correct, but production transport still needs an audited Android-compatible crypto/engine choice before exposing a user-facing DNSCrypt toggle.