Your ISP still reads the DNS queries your phone sends every time you open an app. A recent XDA piece put it plainly: please stop using your ISP’s DNS. Android 9 shipped Private DNS in Settings six years ago, and most people have never opened that screen. Encrypted DNS is the cheapest privacy win on a phone, and it takes about a minute to set up.
We looked at seven apps for encrypted DNS on Android, from the simple one-tap toggles to the ones that also filter ads, trackers, and per-app traffic. Every one of them wraps queries in DNS over HTTPS or DNS over TLS so nobody on the LAN, the ISP, or the coffee-shop router can log them. What differs is filtering depth, telemetry policy, and whether the app uses your one Android VPN slot.
What to look for in an Android DNS app
Six things separate a good pick from a bad one.
- Protocol support. DoH and DoT are table stakes. DoQ (DNS over QUIC) is a bonus for spotty mobile networks.
- Filtering. Some apps only encrypt; others also block ads, trackers, malware, and adult content.
- VPN slot use. Android allows one VPN service at a time. If the DNS app runs a local VPN, it blocks your real VPN.
- Private DNS support. Setting the hostname directly in Android Settings skips the VPN slot entirely.
- Logging policy. A no-logs stance in writing, ideally with third-party audits.
- Per-app rules. Being able to route one app through a different resolver, or block an app from the network entirely.
Quick comparison
| App | Best for | Platforms | Free plan | Starting price/mo | Rating |
|---|---|---|---|---|---|
| 1.1.1.1 + WARP | The simplest one-tap DoH | Android, iOS, Windows, macOS, Linux | Yes, unlimited | Free (WARP+ from $4.99/mo) | 4.6 |
| NextDNS | Cloud filtering with dashboards | Android, iOS, all major desktops, routers | 300k queries/mo | $1.99/mo | 4.5 |
| Control D | Per-app resolvers, family profiles | Android, iOS, desktop, routers | Yes, free resolvers | $2/mo | 4.4 |
| AdGuard DNS | Ad blocking without the ad-blocker VPN | Android, iOS, cross-platform | Public resolver free | $2.49/mo | 4.5 |
| RethinkDNS | Per-app firewall + DNS on device | Android | Full app free | Free | 4.5 |
| Nebulo | Open-source DoH/DoT client | Android | Yes | Free | 4.4 |
| Intra | Google’s DoH-only client | Android | Yes | Free | 4.3 |
| Personal DNS Filter | Local host-file filtering, no VPN needed | Android | Yes | Free | 4.2 |
The apps
1. 1.1.1.1 + WARP – Best overall for the simplest one-tap DoH
1.1.1.1 + WARP is Cloudflare’s client for Android and the fastest way to move a phone off ISP DNS. Toggle it on and every query goes to 1.1.1.1 over DoH. WARP mode adds a lightweight VPN that also encrypts the rest of your traffic to Cloudflare’s edge. The 1.1.1.1 for Families variant blocks malware (via 1.1.1.2) or malware plus adult content (via 1.1.1.3), also selectable in-app.
Where it falls short: WARP is not a privacy VPN. Cloudflare still sees your traffic; it just is not your ISP. The free tier throttles on some plans.
Pricing: Free for 1.1.1.1 DoH and standard WARP. WARP+ (faster relay routing) is available as a subscription starting around $4.99/mo.
Platforms: Android, iOS, Windows, macOS, Linux, ChromeOS.
Download: Aptoide, Google Play, App Store
Bottom line: Install this first if you have never used encrypted DNS. Anyone can flip it on in seconds.
2. NextDNS – Best free option with real filtering
NextDNS is what people mean when they say “encrypted DNS with a dashboard.” Every profile gets custom blocklists, allowlists, TLD blocking, safe search, YouTube restricted mode, and per-device logs. The Android app supports DoH, DoT, and DoQ, and it can run in Private DNS mode without using a VPN slot at all.
Where it falls short: Configuration is a rabbit hole. The 300k query monthly cap on the free plan is fine for one phone, but a family runs through it in days.
Pricing: Free up to 300k queries/mo. Paid starts at $1.99/mo unlimited.
Platforms: Android, iOS, Windows, macOS, Linux, browsers, routers.
Download: Aptoide, Google Play, App Store
Bottom line: The best free encrypted DNS app for Android if you want filtering, not just encryption.
3. Control D – Best for per-app resolvers
Control D treats DNS like a router. You build profiles, assign resolvers per app or per hostname, and toggle whole categories from a phone dashboard. The Android client can drop into Private DNS mode without a VPN slot. Profiles sync across devices, so a phone, laptop, and router all share the same rules.
Where it falls short: The lifetime free resolvers (p0, p1, p2) are useful but generic. Custom profiles require a paid plan.
Pricing: Free public resolvers with fixed filtering. Paid plans start around $2/mo.
Platforms: Android, iOS, Windows, macOS, Linux, routers, browsers.
Download: Google Play, App Store
Bottom line: Pick Control D when you want the same filtering on every device you own without paying per install.
4. AdGuard DNS – Best if you want ad blocking without a filtering VPN
AdGuard DNS is the DNS-only sibling of the full AdGuard app. It blocks ads and trackers at the query level, so most ads never load, and you keep your Android VPN slot free for a real VPN. Public resolvers (94.140.14.14) are free; a paid plan adds custom filters, per-device logs, and parental controls.
Where it falls short: DNS filtering can’t strip in-app ads that hit their own domains for content and ads. YouTube ads still get through.
Pricing: Public resolver free. Personal plans start at about $2.49/mo.
Platforms: Android, iOS, cross-platform, routers.
Download: Aptoide, Google Play
Bottom line: The right pick when you want most ads gone and the VPN slot still available for a proper VPN.
5. RethinkDNS – Best for on-device DNS plus per-app firewall
RethinkDNS does the most in one app. It runs a local DoH/DoT/DoQ client, blocks ads and trackers with community lists, and adds a per-app firewall so any Android app can be cut off from the network entirely. It is open source, works without root, and stores logs on the device.
Where it falls short: The UI is dense. It uses the local VPN slot because the firewall needs it.
Pricing: Free, open source. A paid RethinkDNS+ cloud tier is optional.
Platforms: Android.
Download: Aptoide, Google Play, F-Droid
Bottom line: Advanced users pick RethinkDNS because it is one app that replaces three others.
6. Nebulo – Best open-source DoH/DoT client
Nebulo is a minimal open-source Android app for DoH, DoT, and DNSCrypt. Pick a resolver from the built-in list (Cloudflare, Quad9, Mullvad, dnsforge, and more) or paste your own. Local blocklists and query logging are optional.
Where it falls short: No cloud sync, no per-app rules, no filtering dashboard. It is a client, not a service.
Pricing: Free. Donations optional.
Platforms: Android.
Download: F-Droid
Bottom line: Nebulo is what you install when you already have a resolver picked and just need a clean client.
7. Intra – Best minimal DoH-only pick
Intra is Jigsaw’s DoH-only client. It routes queries to Cloudflare, Google, or Quad9, verifies TLS, and shows a simple query log. That is the whole app.
Where it falls short: No filtering, no DoT, no per-app rules. Intra ends at “queries are encrypted.”
Pricing: Free, open source.
Platforms: Android.
Download: Aptoide, Google Play
Bottom line: Install Intra on a low-end phone or a work profile where you want DoH and nothing else.
8. Personal DNS Filter – Best pick when the VPN slot is off-limits
Personal DNS Filter filters DNS on device using a host file, without opening a VPN service. That is unusual and useful: it works on GrapheneOS work profiles and in places where the VPN slot is already taken. Filtering is host-file-based, so it catches obvious ad and tracker domains but not every embedded ad.
Where it falls short: No cloud logs, no dashboard. Host-file filtering is coarser than NextDNS or AdGuard DNS.
Pricing: Free, open source.
Platforms: Android.
Download: F-Droid
Bottom line: The last-resort option when you cannot spare an Android VPN slot but still want filtered DNS.
How to pick the right one
- If you have never used encrypted DNS: install 1.1.1.1 + WARP and flip the toggle. Done in a minute.
- If you want filtering without paying: NextDNS free tier or AdGuard DNS public resolver in Private DNS.
- If you want the same rules on every device: Control D or NextDNS on the paid tier.
- If you also want a per-app firewall: RethinkDNS.
- If you want open source only: RethinkDNS, Nebulo, Intra, or Personal DNS Filter.
- If you already run a full VPN and cannot free the slot: Personal DNS Filter filters DNS on device without one.
FAQ
What is the best encrypted DNS app for Android?
1.1.1.1 + WARP is the easiest to install. NextDNS and Control D are better if you want filtering, dashboards, and cross-device rules.
Do I need an app for encrypted DNS on Android?
Not always. Android 9 and later support Private DNS in Settings, and any provider with a dns.example.com hostname works there without an app. An app helps when you want per-app rules, logging, or filtering.
Does encrypted DNS replace a VPN?
No. Encrypted DNS hides only the domain lookups. A VPN hides the traffic itself. Use both if the goal is privacy from your ISP.
Which encrypted DNS is fastest on mobile?
Cloudflare’s 1.1.1.1 and Google’s 8.8.8.8 usually finish first in independent tests. Distance to the nearest resolver matters more than brand.
Can I use NextDNS without the app?
Yes. Copy the profile-specific DoT hostname into Android Settings > Network > Private DNS. That skips the app and the VPN slot entirely.
