2d ago

DNS Applications vs. Private DNS: Which is Better for Privacy and Security?

I'm often confused about whether to use apps like RethinkDNS, Invizible Pro, or AdGuard to manage DNS requests on my phone, or to simply rely on Private DNS.

Are there any privacy advantages or security concerns associated with using these apps? When I use an app, can all DNS queries be routed through my preferred DNS provider (which helps block tracking requests on a bloated phone)? Is Private DNS easier for the system to bypass?

I typically use RethinkDNS and block any bypassed DNS requests, so I believe that all my DNS traffic is routed through RethinkDNS, making it impossible for leaks to occur. Is this a misconception? Can any DNS app truly provide that level of privacy and security?

Additionally, how does an application firewall compare to a network-level firewall like NextDNS in terms of effectiveness?

Ultimately, should I opt for an application firewall or a network-level firewall?

5 comments

As best I understand it, running a private caching DNS server is the only guaranteed increase in privacy for DNS. That server still has to reach out to the net the first time a request is made, but will resolve all subsequent requests locally. DNSSEC to a privacy respecting DNS provider like quad9 at 149.112.112.112 from your local DNS server. Mayhaps the best you could do for a roaming device like a phone is to run a decent VPN with an option to prevent DNS leaks.

Is there any privacy advantage or security concern over them ?
This is more of a philosophical question than anything. If you trust that they're not using your data for anything nefarious, I really advocate for RethinkDNS. It's a really great service and truly fills a need between the clear-net and running your own DNS.
If you don't trust RethinkDNS, etc, etc, to not do anything nefarious, then it's time to setup your own.
I always use rethinkdns and block bypassed dns, so i think now every dns is routed through rethinkdns and its impossible to cause a leak. Is that a myth as no dns app can provide that much privacy or security ?
I wouldn't say it's a myth or anything, but to say you're 100% secure from leak? Probably don't trust that feeling. Keep it at 99% secure with 1% suspicion.
How effective is an application firewall than a network level firewall like nextdns ?
Like most security software, it depends on how you use them. If you use firewalls effectively, even software based firewalls can work exceptionally well.
may i use a application firewall or network level firewall ?
You can do both. Software based requires you to setup something on each device you want to firewall. Network is a blanket and will affect all of your devices with only one setup. But either works just fine--just depends on how much effort you want to put into it, I guess.
- When I'm using RethinkDNS, does it matter if I'm using RethinkDNS hosted on Cloudflare or Fly.io, or should I consider other DNS services like AdGuard, NextDNS, or Mullvad? Would using RethinkDNS in this way defeat the purpose of its privacy features?
  
  It really doesn't matter. It tells you the difference between the CDNs right on the usage page.

The Android private DNS setting is just for a DNS-over-TLS resolver. The only thing about it that's private is your queries are encrypted en route to the server (traditonal DNS is cleartext). There's no filtering or blocking.
Some Android versions also have a hard coded DNS server set to Google, which based on my tinkering uses DNS-over-HTTPS. Not only is it annoying but I find it awfully insecure - even if you think you have stuff locked down it might just not be. I fixed that issue by blocking all DNS-over-HTTPS servers in my router, and also have all outgoing requests to port 53 redirected to my local resolvers (Pihole + Unbound).