Notes 
RethinkDNS is a free, open-source Android app that combines an encrypted DNS proxy with a per-app firewall in a single interface. It supports DoH, DoT, DNSCrypt, and DNS Proxy, along with over 190 pre-built blocklists and on-device query logging. The firewall uses Android’s VPN slot to intercept and selectively block network traffic per app.
Reviewed by Marcus Holmberg
RethinkDNS
rethinkdns.com 4 ratings so far*
Rate RethinkDNS: No account needed
Threat level
Hardened
A hardened pick. Worth the effort once you have chosen to shrink your footprint on purpose. Enough for most people. Threat levels
Our take
Having encrypted DNS and a proper per-app firewall in one open-source Android app with no account is genuinely unusual. The depth of the blocklist library and on-device logging make it appealing for users who want to audit what their apps are actually doing. The catch is the interface takes time to learn, and running both DNS and firewall through the VPN slot means you cannot use it alongside a real VPN simultaneously without workarounds. The right tool for privacy-minded Android users willing to invest setup time.
GitHub at a glance
celzero/rethink-app Apache-2.0 androidandroid-appandroid-applicationandroid-firewallanti-censorshipanti-surveillancecensorship-circumventioncensorship-resistancednsdns-over-httpsdnscryptfirewallinternet-freedomopen-sourceprivacy-enhancing-technologieswireguard
Stars
5,841
+41 this week
Forks
373
63 watching
Last commit
8d ago
healthy
Latest release
v0.5.8
21d ago, 46 total
Star history
Issues
72% closed
648
open
1,661
closed
+62 / -56
opened / closed, last 4 weeks
Opened vs closed, last 12 weeks
Commits, last 26 weeks
1,504 commits, active 26 of 26 weeks
211 contributors since Jun 2020
Languages
- Kotlin 99.8%
- Java 0.2%
Updated daily from the GitHub API. Star tracking since Jun 22, 2026.
Website at a glance
rethinkdns.com
C score 55
Basic website security headers
Graded by Mozilla HTTP Observatory, tested 1d ago
Inspect this site yourself
Measures the security configuration of the tool's own website, not the privacy of the product itself. A strong tool can still score low here.
RethinkDNS alternatives
NextDNS The major advantage of NextDNS over AdGuard DNS is to be able to configure the service to your needs via parental controls, website restrictions or block whole categories of…
AdGuard DNS Easy to setup within minutes. Comes with setup guides for all systems. You only need to enter two IP adresses.
Quad9 Based in Switzerland. Supports: DNS-over-TLS (DoT), DNS-over-HTTPS (DoH) and DNSCrypt.
Nebulo (Android) Non-root, small-sized DNS changer utilizing DNS-over-HTTPS and DNS-over-TLS.
DNSCloak (iOS) Allows for the use for dnscrypt-proxy on an iPhone or iPad, which gives users the ability to encrypt their DNS requests through the use of an on-device VPN profile.
Control D Customizable encrypted DNS resolver supporting DoH, DoT, DoQ, and legacy DNS. Offers a free no-log tier and paid plans with a dashboard, per-device profiles, and content filtering.
RethinkDNS license, in plain English
Apache-2.0 Permissive
Permissive like MIT, with an explicit patent grant and a requirement to flag any changes you make.
Permits
- Commercial use
- Modification
- Distribution
- Patent use
- Private use
Requires
- License and copyright notice
- State changes
Does not provide
- Trademark use
- Liability cover
- Warranty
Why it matters: Permissive licensing lets anyone reuse this, including inside closed products. That is freedom to build on, but no guarantee that downstream copies stay open.
Plain-language summary of the project's license, not legal advice. Read the full text for the exact terms.
* Average ratings will show on this page once the threshold of 5 ratings is reached.