Rethink DNS review: control which apps go online

Rethink DNS is a free open-source Android firewall and encrypted DNS app.⁸¹ It is for people who want to stop apps that do not need the internet, and to encrypt site-name lookups. The project says it does not claim to protect your identity at all times.¹

Last checked October 28, 2026.

At a glance

What it is: An Android firewall, encrypted DNS client, and optional WireGuard tool¹

Works on: Android 6.0 or newer. An iPhone version is only planned⁴²

Price: The app and on-device firewall are free. Optional Rethink Proxy Network (RPN) starts at $1.75 a month⁸²¹

Licence: Apache License 2.0⁴

Best for: Android users who want app blocking and encrypted DNS together

Official site: rethinkdns.com

What Rethink DNS does (and how it protects your privacy)

Rethink DNS has three modes: VPN, DNS, and firewall.¹ In DNS mode it sends address lookups to a resolver you choose, using DNS over HTTPS, Oblivious DNS over HTTPS, DNS over TLS, or DNSCrypt.¹ Those protocols encrypt the lookup. A beginner’s guide to encrypted DNS explains why that matters. The default is the project’s blocker at sky.rethinkdns.com, on Cloudflare Workers in 300 or more locations, and you can change it.¹

Firewall mode can refuse the internet to a whole app when the screen is off, when the app is in the background, or on a metered connection. You can also block by store category, or by names and addresses you list.¹ Android’s VPN permission is how the firewall is built on the phone.² The project says this is not a remote VPN that carries all of your traffic.²

Privacy Guides says encrypted DNS will not hide your browsing activity.⁷ The project also says Rethink is not an anonymity tool, and not an antivirus.¹ A blocked name can be answered with 0.0.0.0, so the app never gets a usable address.² Some apps, including Instagram and YouTube, can still show ads.²

Key features of the Rethink DNS firewall

Per-app blocking. Stop an app when the screen is off, in the background, or on a metered connection.¹
A resolver you pick. Keep Rethink’s default, or point the app at another encrypted resolver.¹
Blocklists. The project says Rethink DNS supports over 190 blocklists.⁸
A log on the phone. It records when an app connected, how often, and where, including the DNS question and answer.¹
WireGuard and other tunnels. Traffic can use WireGuard, SOCKS5, or HTTP CONNECT, with different apps on different tunnels.¹
An optional paid proxy. RPN starts at $1.75 a month, with unlimited bandwidth and 5 of 80 or more locations.¹
No root. The project says features should not need root access.¹

Pros and cons of Rethink DNS

Pros

The app stays free and open source, and the on-device firewall is free.⁸²
Firewall rules and encrypted DNS live in one app, and you can swap the default resolver.¹
F-Droid added version 0.5.8 on 16 October 2026. The download page lists v058 on 14 October 2026.⁴⁵
The privacy policy says the F-Droid flavour has no trackers, ads, or loggers.³
Privacy Guides says that, while Rethink holds the VPN slot, you can add WireGuard or set Orbot as a proxy.⁷

Cons

It is Android only. The project says it plans to start an iPhone version.²
Privacy Guides says Rethink takes Android’s VPN slot.⁷
On Android 9 and older, DNS and firewall cannot run together. From Android 10, the project says they can.²
The Play flavour follows Google’s rules against interfering with monetisation, which the project calls ad-blocking. On-device blocklists are not possible in a build that must stay on the Play Store.²¹
Without WireGuard or RPN, allowed traffic is not sent through a remote tunnel.²¹
The project says it has had no third-party audit, and that Cloudflare can see requests to the resolvers it hosts, including the contents.²

Is Rethink DNS safe and private?

The privacy policy says the app does not collect, sell, license, or share data, and does not send debug information unless you choose to.³ It describes the F-Droid flavour as free of trackers, ads, and loggers. The Play flavour includes Crashlytics, a crash reporter, off unless you opt in under Configure, Settings, Stability program. Purchases use Stripe and Google Play services.³² The v057 notes say Crashlytics was removed from the GitHub and website flavours.⁵ Play’s data-safety form, filled in by the developer, says no data is collected or shared. The developer is Celzero Private Limited, in Coimbatore, India, and Play shows an update on 24 October 2026.⁶

The policy says the resolvers do not log requests, and do not collect personally identifiable information. sky.rethinkdns.com runs on Cloudflare. max.rethinkdns.com runs on Fly.io.³ Logs stay off unless a paying user turns them on, then kept at Cloudflare in Western Europe.² Cloudflare can see requests that reach the resolvers it hosts, so pick another resolver if you want a different operator.²¹

The project says there has been no third-party audit, and that one is planned when the budget allows.² Background rules use the Accessibility permission, and the FAQ says that information is not sent to Rethink’s servers.² Privacy Guides says DNS queries are logged locally.⁷

How to get started with Rethink DNS

Install from F-Droid (version 0.5.8, signed by F-Droid, Android 6.0 or newer) or Google Play.⁴⁶ The website build shares Play’s signing key, so it can update a Play install. IzzyOnDroid uses another package name.²⁵
Allow the VPN connection when Android asks. That permission is how the firewall and DNS steering work on the phone.²
Check the DNS setting. The default is Rethink’s resolver, and you can select another.¹ For encrypted DNS without a firewall, use the phone’s Private DNS setting, covered in Private DNS on a mobile plan.
On Android 10 or newer, DNS and the firewall can run together. On Android 9 or older, you get one mode at a time.²
Block apps that work offline, such as a calculator or a file manager.⁶ Background rules need Accessibility. The project says that information is not sent to its servers.²
Add WireGuard only if you want a remote tunnel. RPN starts at $1.75 a month.¹ Orbot can be a proxy when selected apps should use Tor.⁷
Read the connection log.¹ Allow an app or a name again if something you need stops loading.

Who should use Rethink DNS (and who might prefer something else)

Rethink DNS fits Android 10 or newer when you want the firewall and encrypted DNS together and can spare the VPN slot.²⁷ The F-Droid build is the flavour described as free of trackers. The Play build has limits on ad-blocking.³²

NetGuard is simpler when you only want an on or off switch per app. Private DNS in Android settings is enough when encrypted lookups are the only goal. Orbot fits better when selected apps should use Tor, and Rethink can point at Orbot as a proxy if you want both.⁷

Frequently asked questions

Is Rethink DNS free?

The app is free and open source, and the on-device firewall is free.⁸² The content-blocking resolver has a free public beta and a paid private beta. The project says pricing is not in place yet, so that private beta is free for now.² RPN starts at $1.75 a month.¹

Is Rethink DNS safe?

The source is public under the Apache License 2.0. The project says resolvers do not log requests unless a paying user opts in, and that there has been no third-party audit.⁴³² On Play, crash reporting stays off until you opt in.²

Does Rethink DNS work on iPhone?

No. The current F-Droid build requires Android 6.0 or newer.⁴ The project says an iPhone version is something it plans to start.²

Does Rethink DNS hide browsing from my internet provider?

The app can send lookups through an encrypted DNS protocol.¹ The project says ordinary DNS requests are not encrypted.² Privacy Guides says encrypted DNS does not hide browsing as a whole.⁷ Without WireGuard or RPN, the app does not relay the rest of your traffic to a remote server.²¹