RethinkDNS is a free, open-source Android app that combines an encrypted DNS proxy with a per-app firewall in a single interface. It supports DoH, DoT, DNSCrypt, and DNS Proxy, along with over 190 pre-built blocklists and on-device query logging. The firewall uses Android’s VPN slot to intercept and selectively block network traffic per app.
Reviewed by Marcus Holmberg
RethinkDNS
rethinkdns.com No ratings yet. Be the first.
Rate RethinkDNS: No account needed
Threat level
Hardened
A hardened pick. Worth the effort once you have chosen to shrink your footprint on purpose. Enough for most people. Threat levels
Our take
Having encrypted DNS and a proper per-app firewall in one open-source Android app with no account is genuinely unusual. The depth of the blocklist library and on-device logging make it appealing for users who want to audit what their apps are actually doing. The catch is the interface takes time to learn, and running both DNS and firewall through the VPN slot means you cannot use it alongside a real VPN simultaneously without workarounds. The right tool for privacy-minded Android users willing to invest setup time.
GitHub at a glance
celzero/rethink-app
Stars
5,118
+ 116 this week
Last commit
17d ago
healthy
License
Apache-2.0
Latest release
v0.5.5x
21d ago
Stars, last 30d
Website at a glance
rethinkdns.com
C score 55
Basic website security headers
Graded by Mozilla HTTP Observatory, tested 13d ago
Inspect this site yourself
Measures the security configuration of the tool's own website, not the privacy of the product itself. A strong tool can still score low here.
RethinkDNS alternatives
NextDNS The major advantage of NextDNS over AdGuard DNS is to be able to configure the service to your needs via parental controls, website restrictions or block whole categories of…
AdGuard DNS Easy to setup within minutes. Comes with setup guides for all systems. You only need to enter two IP adresses.
Mullvad DNS Free public encrypted DNS resolver from Mullvad VPN, supporting DoH and DoT. Available in six filtering variants including ad-blocking, malware, and family-safe options. No account required.
Quad9 Based in Switzerland. Supports: DNS-over-TLS (DoT), DNS-over-HTTPS (DoH) and DNSCrypt.
Nebulo (Android) Non-root, small-sized DNS changer utilizing DNS-over-HTTPS and DNS-over-TLS.
DNSCloak (iOS) Allows for the use for dnscrypt-proxy on an iPhone or iPad, which gives users the ability to encrypt their DNS requests through the use of an on-device VPN profile.
RethinkDNS license, in plain English
Apache-2.0 Permissive
Permissive like MIT, with an explicit patent grant and a requirement to flag any changes you make.
Permits
- Commercial use
- Modification
- Distribution
- Patent use
- Private use
Requires
- License and copyright notice
- State changes
Does not provide
- Trademark use
- Liability cover
- Warranty
Why it matters: Permissive licensing lets anyone reuse this, including inside closed products. That is freedom to build on, but no guarantee that downstream copies stay open.
Plain-language summary of the project's license, not legal advice. Read the full text for the exact terms.
* Average ratings will show on this page once the threshold of 5 ratings is reached.