I’m often confused about whether to use apps like RethinkDNS, Invizible Pro, or AdGuard to manage DNS requests on my phone, or to simply rely on Private DNS.
Are there any privacy advantages or security concerns associated with using these apps? When I use an app, can all DNS queries be routed through my preferred DNS provider (which helps block tracking requests on a bloated phone)? Is Private DNS easier for the system to bypass?
I typically use RethinkDNS and block any bypassed DNS requests, so I believe that all my DNS traffic is routed through RethinkDNS, making it impossible for leaks to occur. Is this a misconception? Can any DNS app truly provide that level of privacy and security?
Additionally, how does an application firewall compare to a network-level firewall like NextDNS in terms of effectiveness?
Ultimately, should I opt for an application firewall or a network-level firewall?
The Android private DNS setting is just for a DNS-over-TLS resolver. The only thing about it that’s private is your queries are encrypted en route to the server (traditonal DNS is cleartext). There’s no filtering or blocking.
Some Android versions also have a hard coded DNS server set to Google, which based on my tinkering uses DNS-over-HTTPS. Not only is it annoying but I find it awfully insecure - even if you think you have stuff locked down it might just not be. I fixed that issue by blocking all DNS-over-HTTPS servers in my router, and also have all outgoing requests to port 53 redirected to my local resolvers (Pihole + Unbound).