Corral is now in beta on Android. It's a DNS filter that runs on the device, deployed and locked from your Appaloosa console, and it cuts every connection to a domain known for phishing, malware or command-and-control before the connection even starts. Here's why we built it, what it does, and how to join the beta.
In short: Corral blocks network access to malicious domains directly on managed Android devices, at the DNS level, with no traffic leaving the phone and no agent to babysit. It's included during the beta, deployed through Appaloosa only, and you can sign up here.
Why we built a network filter instead of an antivirus
We run an MDM. For years, the security question our customers asked most was some variant of "do you do mobile antivirus?". We didn't, and we kept looking at the numbers to decide whether we should.
The numbers say the app-scanning problem is largely solved by the platforms. In AV-TEST's endurance test of Android security apps (July to December 2025), Google Play Protect, which is already on every Play-certified device, detected 99.6% of malware in real time. On iOS, the sandbox doesn't even allow a classic antivirus to exist. Paying for an app scanner on top of that buys you very little.
What the numbers also say is that attacks don't come in through apps anymore. They come through links.
- In the Verizon Mobile Security Index 2025, user behavior is the top cause of mobile breaches (44%), ahead of app, network and web threats. 80% of organizations saw mobile phishing attempts against their employees. And when companies run their own smishing tests, 39% of them watch between a quarter and half of their staff tap the link.
- Verizon's 2025 Data Breach Investigations Report puts a human element in about 60% of confirmed breaches.
- Lookout counted more than 1.2 million enterprise-targeted phishing and malicious web attacks in a single quarter (Q3 2025), with roughly 13% of devices encountering one.
- Zimperium's 2025 Global Mobile Threat Report puts mobile phishing at about a third of all threats it detects, and SMS carries 69% of it.
So the hole isn't the app. It's the destination. An employee taps a link in a text message, lands on a fake Microsoft 365 page, types a password. No malware was involved, and no antivirus would have said a word.
Mobile EDR products do cover this. They also come with an agent, a console, a per-device price and a team to read the alerts. Most of the fleets we manage, 50 to 2,000 devices, are never going to run one. That's the gap: between what the OS already does for free and what an EDR does for a budget.
Corral fills it the simplest way we could find. If the domain is on a threat list, the DNS request gets an empty answer and the connection never opens. Nothing to inspect, nothing to decrypt, nothing to send to a cloud. One rule in the MDM console, pushed with the rest of your policies.
What Corral does on the device
Corral installs as a managed app from Google Play through Appaloosa and sets up a local, always-on VPN on the device. That VPN doesn't go anywhere: it stays on the phone and intercepts DNS requests (UDP and TCP on port 53, whatever resolver the app was trying to reach). Each domain is checked against the lists you've enabled. Blocked domains get a null answer; everything else resolves normally.
Three things follow from that design.
It sees nothing you'd worry about. Corral reads domain names and destination addresses, never page content, and there's no TLS interception. Logs stay on the device, purged after seven days, and nothing goes back to the console except a coarse health status (healthy, recovery, safe mode, MDM unreachable).
It closes the usual bypasses. DNS-over-HTTPS and DNS-over-TLS are blocked on three layers: by provider hostname, by answer IP and by connection IP on ports 443 and 853. Firefox's built-in DoH, for example, doesn't get around it. A user can't uninstall the app, can't turn the filter off, and if you set the recommended policy, can't force-stop it either. One deliberate exception, with the recommended policy: if a user switches on Android's encrypted Private DNS, Corral can't read the queries, so general traffic is restricted to company services (device management, Play, notifications), which always stay reachable, until Private DNS goes back to automatic. The device never locks itself out. Admins who prefer it can set a permissive policy instead, where Corral simply steps aside.
It fails open, on purpose. If the lists don't load, if the upstream resolver is down, even if the filtering engine dies, the device keeps its internet and falls back to plain DNS. A phone locked out of the network by its own security tool is a support ticket, not a feature. Your MDM and Google Play stay reachable in every case.
The lists come from the HaGeZi DNS blocklists (GPL-3.0), mirrored and validated by our own service before they reach your devices: 34 lists, about 17.8 million domains in total, refreshed from upstream every six hours, plus a dedicated list of 1,369 DoH and DoT endpoints. Every list is checked before publication (signature, minimum size, domain ratio, size variation) so a broken upstream file is rejected rather than served half-empty. On top of that you add your own allow and block lists from the console.
What it doesn't do
We'd rather you hear this from us.
- There's no branded "blocked" page. A blocked domain simply fails to resolve, so the browser shows its own "can't reach this site" error and apps fail quietly. The Corral app shows a counter of blocked requests and the recent events.
- A direct connection to a hard-coded IP address that's on no list isn't caught. DNS never sees it.
- Content isn't inspected, so a phishing page on a domain registered an hour ago may get through until the newly-registered-domain lists catch up. Corral reduces the surface; it's not a promise of zero.
- Android allows one VPN per profile. Corral's always-on VPN can't coexist with another always-on VPN in the same scope, so a corporate VPN on the same profile is a conflict, not a combination.
- Filtered apps run over IPv4 through the local tunnel; there's no IPv6 path for them.
Who can join the beta
The beta covers Android 11 and later, on two kinds of devices: managed devices and COPE (company-owned devices with a work profile). A work profile on a personal phone isn't filtered: the app installs, says "not filtered on this device", and does nothing. That's deliberate; we don't filter traffic on hardware the company doesn't own. iOS and iPadOS are in development and not part of this beta.
Corral deploys through Appaloosa only. If you're already a customer, the beta attaches to your account. If you're not, a 14-day trial is enough to test it. Either way we send you a beta key; you enter it once in your Appaloosa console and Appaloosa pushes it to the devices. Nobody types anything on the phone.
What we ask in return: run it on test devices, not on the production fleet, and tell us what breaks. Every report gets read, and fixes ship weekly during the beta.
FAQ
Does Corral replace a mobile antivirus?
It doesn't try to. Play Protect already scans apps on every Android device with Google services. Corral covers what an app scanner can't see: the link the user taps and the domain it leads to. Run both.
Does Corral replace a mobile EDR?
No. An EDR detects and investigates behavior on the device. Corral blocks known-bad destinations before the connection opens. If you have the budget and the team for an EDR, Corral is a cheap first layer under it. If you don't, Corral is the layer you can actually deploy.
Can Corral see what employees browse?
The app sees domain names and destination addresses on the device, and only those. No page content, no TLS interception, no browsing history sent to us or to you. Local logs are purged after seven days and can only be exported by an admin holding the admin code, as a diagnostic report that contains no visited-sites list.
What happens if a legitimate site gets blocked?
Add the domain to your allow list in the console; the change reaches the devices at the next sync. Our list mirror also has a public domain lookup that tells you which list flagged it, so you can report a false positive upstream.
Will it drain the battery or slow the phone down?
Corral is a small local DNS proxy; it doesn't proxy your traffic. We don't publish a latency or battery figure yet because we haven't measured one properly, and we'd rather give you a real number than a marketing one. Measuring it on your test devices is one of the things we're asking beta testers to do.
What does the beta cost?
Nothing during the beta. Pricing will be announced before general availability.
Is this the Google Play beta track?
No. The app on Google Play is a production release; the "beta" is our program. What's in beta is the feature set and the rollout, not the store listing.