How to Block Ads on Android Without Root: Private DNS, Blocker Apps and Browsers

Short answer: for the least effort, set Android’s Private DNS to an ad-blocking DNS service such as AdGuard DNS (dns.adguard-dns.com). For more control, use a blocker app that runs a local VPN on the phone: AdAway, NetGuard or Rethink. For ads on websites, add a content blocker to your browser. None of these needs root, and none of them can block every ad, YouTube’s included.

What “blocking ads without root” actually blocks

All the no-root methods below, except the browser one, work by DNS: when an app asks for the address of a known ad server, the blocker answers with nothing, so the ad never loads. That stops most banner and tracker requests across all apps. It can’t stop ads that come from the same address as the content. AdGuard’s FAQ: “any ad that shares a domain with content cannot be blocked by a DNS-level blocker, unless you are ready to block the content as well.” NextDNS says the same about YouTube: “It is unfortunately impossible to block them using DNS ad blocking at this time.” Apps that bundle their ads, or that look up addresses their own way, also get past DNS blocking.

Option 1: Private DNS (Android 9 and later)

Private DNS is a built-in setting that sends all of the phone’s DNS lookups, encrypted, to a server you choose. Pick one that filters ads and it blocks them for every app.

1. Open Settings › Network & internet › Private DNS. If you can’t find it, search the settings for “Private DNS”; the exact place varies by phone.
2. Choose Private DNS provider hostname.
3. Enter the hostname of an ad-blocking service and tap Save. From the providers’ own pages:
   • AdGuard DNS: dns.adguard-dns.com (“will block ads and trackers”).
   • Control D: p2.freedns.controld.com (ads and tracking).

If the server can’t be reached, Android marks the network as “No internet access”, so if pages stop loading, switch Private DNS back to Automatic. Private DNS Quick Toggle puts that switch in a Quick Settings tile; it needs one permission granted once through Shizuku or adb.

Limits: it is one setting for the whole phone, so there is no way to let one app through. Google’s own tip applies: “Private DNS helps secure only DNS questions and answers. It can’t protect anything else.” And whoever runs the server sees the addresses your phone looks up.

Option 2: a blocker app with a local VPN

These apps use Android’s VPN feature without sending your traffic anywhere: the “VPN” runs on the phone and filters DNS lookups against block lists. Two rules apply to all of them:

• One VPN at a time. Android’s documentation: “There can be only one VPN connection running at the same time.” So a blocker app and a real VPN app can’t both run, unless the blocker can pass traffic on to the VPN itself (Rethink can, see below).
• Turn Private DNS off. NetGuard warns: “Turn off “Private DNS” in Android network settings to use NetGuard in filtering mode”, and Rethink: its “DNS settings are overridden by Android’s Private DNS.”

AdAway

AdAway blocks with a hosts file when you have root and, since version 5.0, with a built-in local VPN when you don’t. It needs Android 8 or later. Its setup screen sums up the trade-off of the VPN mode: “Slower / Run in background / Compatibility”. It starts with three block lists (AdAway’s own, StevenBlack’s and Peter Lowe’s), and you can exclude apps that misbehave. AdAway’s help also notes that “Sometimes applications cache advertisements” and that some apps bundle their ad images.

NetGuard

NetGuard is a firewall that can also block ads, but only in the developer’s own build, the one hosted here: “ad blocking is not possible with the Play store version because Google does not allow ad blocking apps in the Play store”. The README’s steps, all of which are needed:

1. Turn on Filter traffic (Settings › Advanced options; off by default).
2. Make sure Block domain names is on.
3. Turn on Manage system apps (off by default).
4. Download the hosts file (Settings › Backup › Download hosts file; StevenBlack’s list by default).
5. Turn off secure DNS and data compression in your browser.
6. Wait about ten minutes for Android’s DNS cache to clear.

NetGuard’s own list of limits: “YouTube ads are not domain-based, and thus cannot be blocked”, the hosts file can’t be edited, and “you cannot exclude a single app from ad blocking”. If Google Play installs or updates NetGuard, the ad-blocking options disappear; the developer suggests turning off Play’s automatic updates for it.

Rethink DNS + Firewall

Rethink combines a DNS changer and a per-app firewall. Out of the box it doesn’t block ads: its default resolver, Rethink’s own, blocks phishing, malware and similar threats. To block ads, either choose block lists for a Rethink DNS address, or download its on-device block lists (“Choose from 195+ blocklists”, about 60 MB), which the version hosted here includes and the Google Play version doesn’t offer. Rethink lets you exempt single apps and set rules per domain, and it can forward traffic through a WireGuard tunnel, so you can keep using a VPN provider that offers WireGuard while it filters.

personalDNSfilter

personalDNSfilter only filters DNS, and starts blocking right away: on first start it downloads three block lists, 1Hosts Lite, StevenBlack’s and Hagezi Pro, and refreshes them every 7 days. Its local VPN carries nothing but DNS lookups, and you can exclude apps. By default it sends lookups to your network’s own DNS servers, unencrypted, and keeps a log of them on the phone; both can be changed. Its first-run message: “Please ensure private DNS is disabled in Android network settings. When enabled, personalDNSfilter might be bypassed!”

Intra

Intra encrypts DNS to protect against DNS-based blocking and tampering; it isn’t an ad blocker. Its built-in servers don’t filter ads, but it accepts a custom server URL, so a filtering service’s DNS-over-HTTPS address turns it into one.

Option 3: block ads in the browser

For websites, a browser content blocker catches what DNS can’t, because it can hide page elements, not just block addresses. uBlock Origin’s README says it “works best on Firefox”, which on Android supports add-ons. If you use Chrome with any of the methods above, check Chrome’s Use secure DNS setting (Settings › Privacy and security): NetGuard’s instructions ask you to turn it off, because a browser that does its own encrypted DNS goes around the blocker.

Which one to choose

	Private DNS	AdAway (VPN mode)	NetGuard (this build)	Rethink
Setup	One setting	Install, pick VPN mode	Several settings	Install, choose block lists
Per-app exceptions	No	Yes	No	Yes
Uses Android’s one VPN slot	No	Yes	Yes	Yes (can forward to WireGuard)
Edit what’s blocked	Depends on the service	Yes	No	Yes
Same-domain ads (YouTube)	No	No	No	No

When something stops working

Block lists sometimes catch addresses an app needs. AdAway’s help: “Some applications… refuse to work when the hostnames which should serve ads are not reachable.” In AdAway and Rethink you can exclude that app or allow the address; with Private DNS or NetGuard, switch the blocking off while you use the app. AdAway’s wiki also advises against stacking more lists than you need: “LESS is MORE!”

Common questions

Can I use an ad-blocking DNS and a VPN app together? Private DNS doesn’t use the VPN slot. Google’s DNS documentation notes that on Android 9 only, Private DNS settings “have no effect when you use a VPN”, which was fixed in Android 10. Some VPN apps have ad blocking of their own: Mullvad VPN, for example, offers DNS content blockers while connected. A local-VPN blocker can’t run alongside a VPN app at all, Rethink’s WireGuard forwarding aside.

Does any of this block ads inside YouTube? No. AdGuard, NextDNS and NetGuard all say DNS-level blocking can’t separate YouTube’s ads from its videos.

Is root still better? If you have it, AdAway’s root mode edits the system hosts file instead of running a VPN; its setup screen calls that “Faster / Battery friendly”. Everything else on this page works without root.