diff --git a/app/src/main/java/eu/faircode/netguard/DatabaseHelper.java b/app/src/main/java/eu/faircode/netguard/DatabaseHelper.java
index 459be089..4b512fc9 100644
--- a/app/src/main/java/eu/faircode/netguard/DatabaseHelper.java
+++ b/app/src/main/java/eu/faircode/netguard/DatabaseHelper.java
@@ -34,7 +34,7 @@ public class DatabaseHelper extends SQLiteOpenHelper {
     private static final String TAG = "NetGuard.Database";
 
     private static final String DB_NAME = "Netguard";
-    private static final int DB_VERSION = 13;
+    private static final int DB_VERSION = 14;
 
     private static boolean once = true;
     private static List<LogChangedListener> logChangedListeners = new ArrayList<>();
@@ -116,6 +116,19 @@ public class DatabaseHelper extends SQLiteOpenHelper {
         db.execSQL("CREATE UNIQUE INDEX idx_access ON access(uid, daddr, dport)");
     }
 
+    private void createTableDns(SQLiteDatabase db) {
+        Log.i(TAG, "Creating dns table");
+        db.execSQL("CREATE TABLE dns (" +
+                " ID INTEGER PRIMARY KEY AUTOINCREMENT" +
+                ", time INTEGER NOT NULL" +
+                ", qname TEXT NOT NULL" +
+                ", aname TEXT NOT NULL" +
+                ", resource TEXT NOT NULL" +
+                ", ttl INTEGER NULL" +
+                ");");
+        db.execSQL("CREATE INDEX idx_dns ON dns(qname, aname, resource)");
+    }
+
     @Override
     public void onUpgrade(SQLiteDatabase db, int oldVersion, int newVersion) {
         Log.i(TAG, DB_NAME + " upgrading from version " + oldVersion + " to " + newVersion);
@@ -180,6 +193,10 @@ public class DatabaseHelper extends SQLiteOpenHelper {
                 db.execSQL("CREATE INDEX idx_log_dname ON log(dname)");
                 oldVersion = 13;
             }
+            if (oldVersion < 14) {
+                createTableDns(db);
+                oldVersion = 14;
+            }
 
             if (oldVersion == DB_VERSION) {
                 db.setVersion(oldVersion);
@@ -394,6 +411,34 @@ public class DatabaseHelper extends SQLiteOpenHelper {
         return db.compileStatement("SELECT COUNT(*) FROM access WHERE block >=0 AND uid =" + uid).simpleQueryForLong();
     }
 
+    public DatabaseHelper insertDns(ResourceRecord rr) {
+        synchronized (mContext.getApplicationContext()) {
+            SQLiteDatabase db = this.getWritableDatabase();
+
+            ContentValues cv = new ContentValues();
+            cv.put("time", rr.Time);
+            cv.put("ttl", rr.TTL);
+
+            int rows = db.update("dns", cv, "qname = ? AND aname = ? AND resource = ?",
+                    new String[]{rr.QName, rr.AName});
+
+            if (rows == 0) {
+                cv.put("qname", rr.QName);
+                cv.put("aname", rr.AName);
+                cv.put("resource", rr.Resource);
+
+                if (db.insert("dns", null, cv) == -1)
+                    Log.e(TAG, "Insert dns failed");
+                else
+                    Log.i(TAG, "Inserted " + rr);
+            } else if (rows != 1)
+                Log.e(TAG, "Update dns failed");
+            else
+                Log.i(TAG, "Updated " + rr);
+        }
+
+        return this;
+    }
 
     public void addLogChangedListener(LogChangedListener listener) {
         logChangedListeners.add(listener);
diff --git a/app/src/main/java/eu/faircode/netguard/SinkholeService.java b/app/src/main/java/eu/faircode/netguard/SinkholeService.java
index 1b5edfa2..778a656d 100644
--- a/app/src/main/java/eu/faircode/netguard/SinkholeService.java
+++ b/app/src/main/java/eu/faircode/netguard/SinkholeService.java
@@ -130,6 +130,7 @@ public class SinkholeService extends VpnService implements SharedPreferences.OnS
     private static final int MSG_STATS_STOP = 2;
     private static final int MSG_STATS_UPDATE = 3;
     private static final int MSG_PACKET = 4;
+    private static final int MSG_RR = 5;
 
     private enum State {none, waiting, enforcing, stats}
 
@@ -207,6 +208,10 @@ public class SinkholeService extends VpnService implements SharedPreferences.OnS
                     case MSG_PACKET:
                         log((Packet) msg.obj);
                         break;
+
+                    case MSG_RR:
+                        resolved((ResourceRecord) msg.obj);
+                        break;
                 }
             } catch (Throwable ex) {
                 Log.e(TAG, ex.toString() + "\n" + Log.getStackTraceString(ex));
@@ -705,6 +710,17 @@ public class SinkholeService extends VpnService implements SharedPreferences.OnS
             dh.close();
         }
 
+        private void resolved(ResourceRecord rr) {
+            synchronized (mapRR) {
+                try {
+                    mapRR.put(InetAddress.getByName(rr.Resource), rr);
+                    new DatabaseHelper(SinkholeService.this).insertDns(rr).close();
+                } catch (UnknownHostException ex) {
+                    Log.e(TAG, ex.toString() + "\n" + Log.getStackTraceString(ex));
+                }
+            }
+        }
+
         private void set(Intent intent) {
             // Get arguments
             int uid = intent.getIntExtra(EXTRA_UID, 0);
@@ -1045,13 +1061,10 @@ public class SinkholeService extends VpnService implements SharedPreferences.OnS
 
     // Called from native code
     private void dnsResolved(ResourceRecord rr) {
-        synchronized (mapRR) {
-            try {
-                mapRR.put(InetAddress.getByName(rr.Resource), rr);
-            } catch (UnknownHostException ex) {
-                Log.e(TAG, ex.toString() + "\n" + Log.getStackTraceString(ex));
-            }
-        }
+        Message msg = mServiceHandler.obtainMessage();
+        msg.obj = rr;
+        msg.what = MSG_RR;
+        mServiceHandler.sendMessage(msg);
     }
 
     public static ResourceRecord reverseDNS(InetAddress ip) {