An XDA writer pulled a Snapdragon 845 phone out of a drawer, installed Debian inside Termux, and ended up with a DNS server that handled the whole house better than the Raspberry Pi it replaced. The hardware was already overkill: 6GB of RAM, UFS storage, Wi-Fi built in, and a battery that keeps answering queries through a power cut. Total cost, nothing.
The hardware is the easy part. Picking software is where most people stall, because almost every DNS app on Android is built to protect one phone, not to answer questions for a house. We went through the Android apps that can genuinely put a resolver on your network, checked what each one actually serves, and ranked the best apps for running a DNS server on an old Android phone below.
One scope note before the list. This is not a comparison of DNS providers, and it is not another round-up of DNS changer clients. If you want those, we have AdGuard DNS vs NextDNS vs ControlD vs Quad9 and the Pi-hole alternatives round-up. Everything below is judged on one question: can the phone itself answer DNS for your TV, your laptop, and your flatmate’s tablet.
What to look for in an Android DNS server app
Six things separate a real network resolver from an app that just filters the phone it runs on.
- Whether it answers queries arriving from other devices, or only from the local app sandbox
- Whether it can claim UDP port 53, or gets pushed onto a high port your router cannot use
- What happens after a reboot, an OTA update, or an hour of Doze
- Blocklist handling: on-device lists, per-client rules, or nothing
- Upstream encryption, so the queries leaving your house are DoH, DoT, or DNSCrypt
- Whether it needs root, and what that costs you on a phone you might still care about
The first two matter far more than the feature lists suggest. Most Android privacy apps take the VPN slot, wrap the phone’s own traffic, and have no concept of a second device. That is fine for a daily driver and useless for a server.
The limits nobody puts on the box
Port 53 is the wall most projects hit. On Android, ports below 1024 are privileged, and proot (the compatibility layer Termux uses to run a Debian userland) cannot bind them at all, so it silently remaps privileged ports upward. Without root you end up serving DNS on something like port 5353, and most consumer routers only let you type an IP address for DNS, with no port field. Root, meaning an unlocked bootloader and Magisk, is what gets you port 53 and a resolver your router will accept. That also voids the warranty on most handsets, trips Play Integrity, and breaks banking and wallet apps, so use a phone you have written off rather than one still in service.
The rest of the plumbing is mundane but easy to forget. Give the phone a DHCP reservation or a static LAN IP, because a server whose address moves is a house-wide outage waiting to happen. Exempt the resolver from battery optimisation and hold a wake lock, or Android will suspend it after a few idle minutes. And do not leave the phone charging to 100% forever if you can avoid it, since a hot pouch cell sitting at full charge for months is how these builds end. Plenty of ROMs and OEM skins expose a charge limit; if yours does not, cycling the phone off the charger occasionally is better than nothing.
Quick comparison
| App | Best for | Serves | Needs root | Price |
|---|---|---|---|---|
| Termux | A real Pi-hole or AdGuard Home on the phone | Whole LAN | For port 53 | Free |
| personalDNSfilter | Network DNS without a terminal | Whole LAN | For port 53 | Free |
| Servers Ultimate | Form-based setup, no shell | Whole LAN | For port 53 | Trial, then paid |
| RethinkDNS | The phone itself, and pointing clients at your server | One device | No | Free |
| InviZible Pro | Devices on the phone’s hotspot | Hotspot clients | For the good parts | Free build available |
| Nebulo | Lightweight encrypted upstream | One device | No | Free |
| AdAway | Blocking on the server phone without the VPN slot | One device | Yes for hosts mode | Free |
| Termux:Boot | Surviving reboots | Support role | No | Free |
The apps
1. Termux, best for an actual network-wide resolver
Termux is the only option on this list that gets you the same software a Raspberry Pi would run. Install proot-distro, drop into a Debian userland, and AdGuard Home, Pi-hole, Unbound, or dnsmasq install the way they do anywhere else. AdGuard Home is the gentler of the two big ones: a single binary, a web dashboard on port 3000, blocklists and per-client rules included. Pi-hole works too, though FTL needs starting in the foreground with pihole-FTL -f inside a tmux session, because proot kills processes that daemonise and detach.
Where it falls short: port 53, as covered above. Without root you are serving on a high port that most routers will not accept, which turns a network resolver into a per-device one. The Google Play build is also a separately maintained fork with changes reverted from recent releases, so for a server you want the F-Droid or GitHub build.
Pricing: Free and open source (GPLv3).
Platforms: Android.
Download: Termux on Google Play · F-Droid · GitHub
Bottom line: Take this route if you want per-client blocking rules and a dashboard, and you have a rooted phone plus an evening to spend.
2. personalDNSfilter, best network DNS server without a terminal
personalDNSfilter is a small Java DNS proxy that hooks into name resolution and returns a loopback address for anything on its block list. What makes it unusual is that it was designed to run either locally on one device or centrally as the DNS server for a network, which is a sentence almost no other Android DNS app can say. Filtering happens entirely on the phone, it works with any upstream resolver you point it at, and the on-device mode runs without root.
Where it falls short: configuration reads like editing a config file rather than tapping switches, and the interface is a settings list plus a log window. Claiming port 53 is still a root question, so on a stock phone you are back on a high port.
Pricing: Free and open source.
Platforms: Android.
Download: personalDNSfilter on Google Play · F-Droid
Bottom line: The best pick if you want the phone to serve DNS for the network but have no interest in learning Termux.
3. Servers Ultimate, best point-and-tap server setup
Servers Ultimate runs more than 60 server types on Android, and both a DNS server and a dnsmasq server are among them. Everything is configured through forms, so there is no shell, no package manager, and no proot layer between you and the service. For a drawer phone that is also going to run a file share or an FTP endpoint, one app covers all of it.
Where it falls short: the free version caps you at two servers and stops working after a seven-day trial, so a paid unlock is required for anything permanent. It is closed source, and the settings screens pack a lot of fields into very little space. Port 53 remains a root-only privilege here as well.
Pricing: Free trial (two servers, seven days), then a one-off paid unlock.
Platforms: Android.
Download: Servers Ultimate on Google Play
Bottom line: Worth paying for if the command line is the thing stopping you, and skippable if you were going to install Termux anyway.
4. RethinkDNS, best resolver for the phone and the clients around it
RethinkDNS is the DNS and firewall app to run on the phone itself, and it plays a second role that is easy to miss: it supports a plain DNS Proxy resolver type where you type an IP address and a port. That is exactly how you point another Android device at the server phone, including when your server is stuck on a high port your router refuses to hand out. It also does DoH, DoT, DNSCrypt, and ODoH upstream, ships more than 190 on-device blocklists, and includes a per-app firewall with a connection tracker.
Where it falls short: it does not answer queries from other devices. Rethink protects the phone it runs on, and it does so through the VPN slot, which means the server phone cannot use that slot for anything else at the same time.
Pricing: Free and open source, no ads.
Platforms: Android 6 and newer.
Download: Rethink on Google Play · F-Droid · GitHub
Bottom line: Install it on the phones you want to point at your new resolver, not on the resolver itself.
5. InviZible Pro, best for serving devices over the phone’s hotspot
InviZible Pro bundles DNSCrypt, Tor, and I2P, and it is one of the few Android apps with real tethering support: turn on the tethering options, start DNSCrypt, and devices connected to the phone’s hotspot resolve through it. In root mode with the Fix TTL option enabled, it will also show a live DNS query log for the tethered clients, which is genuinely useful for catching a smart TV that phones home every thirty seconds.
Where it falls short: hotspot clients are not the same thing as your existing Wi-Fi network, so this covers devices you deliberately connect to the phone rather than everything already on the router. Root unlocks most of what makes it interesting, and running a hotspot plus Tor keeps the phone warm and the battery busy.
Pricing: Open source, with a free build on F-Droid.
Platforms: Android.
Bottom line: The right answer when the “network” you want to cover is a few devices you can connect to the phone directly, such as a travel setup or a guest room.
6. Nebulo, best lightweight encrypted upstream
Nebulo is a DoH, DoT, and DoH3 client from Frostnerd with no ads, no tracking, and a reputation for staying out of the battery stats. Its relevance here is an experimental non-VPN mode that runs a local DNS server instead of the usual dummy VPN, which leaves the VPN slot free on a phone already busy with other jobs.
Where it falls short: the non-VPN mode is experimental, and it expects a third-party app to forward queries to it rather than capturing them for you. Nebulo is also not in the main F-Droid repository, so installing outside Google Play means adding the developer’s own repo.
Pricing: Free.
Platforms: Android 6 and newer.
Download: Nebulo on Google Play · GitHub mirror
Bottom line: A good encrypted upstream for the client phones in the house, and a niche option on the server phone when the VPN slot is spoken for.
7. AdAway, best blocker for the server phone itself
AdAway takes a different route to the same result: in root mode it rewrites the system hosts file, so blocking applies system-wide without occupying the VPN slot. On a phone that is running Termux, a hotspot, or anything else that wants that slot, that difference is the whole point. A non-root VPN mode is available too, and the app has been maintained on F-Droid for well over a decade.
Where it falls short: hosts-file blocking covers the phone it runs on and nothing else, so it contributes nothing to the network side of the project. Root mode means an unlocked bootloader, and on most phones that ends the warranty, breaks Play Integrity checks in banking and wallet apps, and puts vendor security updates in your hands rather than the manufacturer’s. AdAway is also not on Google Play.
Pricing: Free and open source.
Platforms: Android 8 and newer.
Bottom line: Add it once the phone is already rooted, so the server keeps itself clean without stealing the VPN slot from anything else.
8. Termux:Boot, the difference between a server and a weekend demo
Termux:Boot is a small add-on that runs scripts from ~/.termux/boot/ when the phone starts. That is all it does, and it is the reason the XDA build kept working: after a power cut, an OTA reboot, or a crash, the resolver comes back on its own instead of waiting for you to notice the internet is broken and SSH in. Pair it with Termux’s wake lock notification and a battery optimisation exemption for Termux.
Where it falls short: it only handles startup. If Android decides to kill the process two hours later, the wake lock and the optimisation exemption are what save you, not this. Aggressive OEM skins from Xiaomi, Samsung, and Oppo also want their own autostart permission granted before boot scripts fire reliably.
Pricing: Free and open source.
Platforms: Android, alongside a Termux install from the same source.
Bottom line: Install it in the first ten minutes, not after the third time the house loses DNS.
How to pick the right one
If you want the full experience, per-client rules, a dashboard, query graphs, and the option to swap in Unbound later, use Termux with AdGuard Home inside a Debian proot, and root the phone so it can hold port 53.
If the terminal is the deal-breaker but you still want the whole network covered, use personalDNSfilter. It is the only no-shell app here that was actually designed to answer other devices.
If you would rather pay a few euros than configure anything by hand, Servers Ultimate gets a DNS or dnsmasq server running from a form, and it will run your other home-server odds and ends too.
If the phone is going to be a travel router or a guest-room box, InviZible Pro over the hotspot is simpler than any of the above and needs no router changes at all.
If you tried the Termux route and gave up at port 53, install RethinkDNS on your phones and point its DNS Proxy resolver at the server’s IP and high port. The router never has to know.
And whichever server you land on, add Termux:Boot, a DHCP reservation, and a battery optimisation exemption before you call the project finished.
FAQ
Can an old Android phone really replace a Raspberry Pi as a DNS server?
For DNS, yes. A phone from 2018 has more RAM and faster storage than most Pi models, plus Wi-Fi and a built-in battery that acts as a small UPS during power cuts. The trade-off is setup effort: Android is not built to be a server, so getting boot scripts, port binding, and background execution right takes longer than flashing an SD card.
Do you need root to run a DNS server on an Android phone?
Not to run one, but effectively yes to make your router use it. Android reserves ports below 1024, and proot cannot bind them at all, so an unrooted phone serves DNS on a high port that most consumer routers cannot be told to use. Root gets you port 53, at the cost of the warranty, Play Integrity, and vendor security updates.
Which app lets an Android phone serve DNS to other devices?
Termux (running AdGuard Home, Pi-hole, Unbound, or dnsmasq), personalDNSfilter in its network mode, and Servers Ultimate all answer queries from other machines. InviZible Pro covers devices connected to the phone’s hotspot. Rethink, Nebulo, and AdAway protect only the phone they run on.
Will Android battery optimisation kill the DNS server?
It will if you let it. Exempt the app from battery optimisation in Android settings, hold Termux’s wake lock from its notification, and grant any extra autostart permission your OEM skin demands. Without those, the resolver goes quiet during Doze and every device in the house loses name resolution at once.
Can you run Pi-hole on Android?
You can, through Termux and proot-distro with a Debian container. The one non-obvious step is starting FTL in the foreground with pihole-FTL -f inside tmux, because proot terminates daemonised processes that detach from the shell.
Is it safe to leave the phone plugged in permanently?
It is common practice, but heat and a battery held at full charge for months will swell the pouch cell eventually. Use a ROM or OEM feature that caps charging below 100% if one is available, keep the phone somewhere ventilated and out of a drawer, and check on the back panel every few months for any sign of bulging.