Android 9 and later include a setting called Private DNS that lets you point every app’s name lookups through a single encrypted resolver. Pick the right resolver and most ads on the device disappear, without installing an app, without rooting, and without burning the VPN slot that AdGuard and Blokada take. Four DNS services dominate this space in 2026: AdGuard DNS, NextDNS, ControlD, and Quad9. They share the same delivery model (Private DNS over TLS) but make different trade-offs on filtering, customization, logging, and free-tier limits.
Quick verdict
- Best free for most people: AdGuard DNS. Strongest default ad filtering, no signup, no query cap
- Best customizable: NextDNS. Configurable filter lists, but free tier caps at 300k queries per month
- Best when you want presets without a dashboard: ControlD. Pick a profile, paste the hostname, done
- Best for malware blocking specifically: Quad9. Does not block ads by itself, but blocks known threats and respects privacy
- Best if you also want per-app firewall: Rethink DNS (free, open source). Not a hosted service, but the cleanest local-app companion when you want more control
Quick comparison
| Service | Free tier | Blocks ads by default | Custom filters | Logs queries | Best Private DNS hostname (Android 9+) |
|---|---|---|---|---|---|
| AdGuard DNS | Unlimited | Yes | Premium only | No (free), optional (premium) | dns.adguard-dns.com |
| NextDNS | 300k queries/month | Yes (configurable) | Yes | Optional, per-profile | xxxxxx.dns.nextdns.io |
| ControlD | Unlimited (preset profiles) | Yes (most profiles) | Paid tier | No on free presets, optional on paid | p1.freedns.controld.com (Block Ads preset) |
| Quad9 | Unlimited | No (security only) | No | No | dns.quad9.net |
How Android Private DNS actually works
Android Private DNS routes every DNS query from every app through a single hostname over TLS (DoT). The setting lives in Settings > Network and internet > Private DNS (the exact path varies slightly by vendor). Switch from “Automatic” to “Private DNS provider hostname” and paste the resolver’s address. Save, and the encrypted connection is active immediately on Wi-Fi and mobile data.
The key consequence: every domain the device resolves now goes through your chosen filter. Apps that hardcode their own DNS, like Chrome’s DoH, can bypass this on a per-app basis, but the bulk of ad networks resolve through the system path and get blocked at the resolver. The filtering is invisible to apps. They see ad domains as unreachable, the same as if the network was offline for that single hostname.
This approach does not use the device’s VPN slot. NordVPN, Mullvad, Proton, or any other VPN keeps running alongside the Private DNS setting. The price is that you cannot do per-app firewalling or filter cosmetic in-page ads that share a domain with the host site. Most YouTube ads, for example, resolve through googlevideo.com, the same domain that serves the video itself, so DNS blocking cannot remove them without breaking the app.
The four services
AdGuard DNS, best free default
AdGuard DNS is the simplest of the four. The default resolver (dns.adguard-dns.com) blocks ads and trackers using AdGuard’s own filter lists with no configuration. There is no signup, no query cap, no dashboard required. Set the hostname in Private DNS and the device starts blocking ad traffic across every app.
AdGuard maintains a family resolver (family.adguard-dns.com) that adds adult-content blocking on top of ads, and an unfiltered resolver (unfiltered.adguard-dns.com) for diagnostics. For most users, the default is the one to use.
The paid tier (around $20 per year) unlocks a personal dashboard at adguard-dns.io with custom filter lists, query logs you control, and per-device statistics. It is worth paying for if you want visibility into what is being blocked. It is not necessary for the blocking itself.
Where it falls short: No customization on the free tier. You either accept the default filter set or pay for the dashboard. The default is good but you cannot whitelist a domain without going premium.
Cost: Free. Premium $1.99 per month or $19.99 per year for the dashboard, custom filters, and logs.
Bottom line: Use AdGuard DNS on the free tier as the default Android DNS for ad blocking. Upgrade only if you want a dashboard.
NextDNS, best customizable
NextDNS is the configurable option. Sign up for a free account, create a profile, toggle on the filter lists you want (AdGuard Base, EasyList, EasyPrivacy, OISD, Steven Black, plus dozens more), set up custom denylists and allowlists, decide whether queries are logged and for how long, and copy the unique hostname out to Private DNS.
The free tier covers 300,000 queries per month per profile. That sounds large but a heavy Android user can burn through it in two weeks if every device shares one profile. Once you hit the cap, the resolver keeps answering queries but stops filtering them until the next month. NextDNS Unlimited removes the cap for $1.99 per month or $19.90 per year.
The dashboard is the best of any DNS service we tested. You can see exactly which domains were blocked and why, set up scheduled rules (no social media after 11pm), and use parental controls without leaving the web UI.
Where it falls short: The free tier query cap is the only real downside. If you have a busy household and try to share one profile across multiple devices, you will hit it.
Cost: Free 300k queries per month. Unlimited $1.99 per month or $19.90 per year.
Bottom line: Pick NextDNS if you want to see what is being blocked and tune it. Pay for Unlimited if multiple devices share the profile.
ControlD, best preset experience
ControlD is run by Windscribe and takes a slightly different approach. The free service offers a handful of preset resolvers, each with its own hostname: Block Ads, Block Ads and Trackers, Block Malware, and Block Adult Content. Pick the preset that matches what you want, paste the hostname in Private DNS, and you are done. No account, no dashboard.
The paid tier ($2 per month personal, $4 per month for families with parental controls) opens up the same level of customization NextDNS has: custom profiles, per-device routing, scheduled rules, and detailed analytics. ControlD’s filtering is competitive with AdGuard DNS, sometimes catching slightly different ad networks because the filter lists differ.
The Windscribe ownership matters for privacy. Windscribe has a credible track record and ControlD inherits its no-logs policy on free presets.
Where it falls short: The free presets are not as aggressive as NextDNS’s tunable lists. Power users who want everything blocked end up on the paid tier.
Cost: Free presets. Personal $2 per month, Family $4 per month.
Bottom line: Pick ControlD when you want a clean preset and do not want to configure a thing. Pay if you need a custom profile.
Quad9, best for malware (not ads)
Quad9 is the outlier on this list. It is a Switzerland-based nonprofit DNS service focused on threat intelligence, not ad blocking. The default resolver (9.9.9.9, or dns.quad9.net as a Private DNS hostname) blocks domains tied to malware, phishing, and command-and-control traffic by partnering with security vendors.
Ads are not blocked. If you set Quad9 as your Private DNS and expect YouTube ads to disappear, they will not. What disappears is the small but ugly slice of traffic that points to known malicious infrastructure.
We include Quad9 because privacy and security users frequently ask whether they should combine it with the other three. The answer is no, not in the Private DNS slot, because you can only set one hostname. Pick AdGuard DNS, NextDNS, or ControlD for ad blocking. Use Quad9 on devices where threat blocking matters more than ad blocking, or pair it with the others through an app like Rethink DNS that supports multiple upstreams.
Where it falls short: It does not block ads. That is the entire reason we wrote this article.
Cost: Free, no paid tier.
Bottom line: Use Quad9 when malware blocking is the priority. For ad blocking, use one of the other three.
How to set Private DNS on Android
Open the Settings app and navigate to Network and internet > Private DNS (on Samsung devices: Connections > More connection settings > Private DNS). Tap Private DNS provider hostname and paste one of these:
- AdGuard DNS (free, ad blocking):
dns.adguard-dns.com - NextDNS (your profile hostname, copied from the dashboard):
xxxxxx.dns.nextdns.io - ControlD Block Ads preset:
p1.freedns.controld.com - Quad9 (malware blocking, not ad blocking):
dns.quad9.net
Tap Save. The setting takes effect immediately and persists across reboots and network changes.
To confirm the resolver is working, visit each service’s status page from the phone’s browser:
- adguard-dns.com/test
- test.nextdns.io
- test.controld.com
- on.quad9.net
A green status confirms encrypted DNS is going through that provider.
How to choose
Pick AdGuard DNS if you want the strongest free default with zero configuration. This is the right answer for most people.
Pick NextDNS if you want to see and tune what gets blocked, and you do not mind a free-tier query cap or paying $20 a year to remove it. Best for tinkerers and privacy enthusiasts.
Pick ControlD if you want presets without an account, or if you already use Windscribe VPN and want the same vendor handling DNS.
Pick Quad9 if malware blocking matters more than ad blocking. Pair it with one of the other three on devices that support multiple upstreams.
Pick Rethink DNS (a free, open-source Android app) if you want to combine multiple upstreams, per-app firewall rules, and a local query log without paying. Rethink uses the device’s VPN slot, the trade-off the four services above avoid.
FAQ
What is the best DNS for ad blocking on Android in 2026?
AdGuard DNS on the free tier covers most ads with no setup and no signup. NextDNS is the better pick if you want to see and customize what gets blocked. ControlD’s Block Ads preset is competitive with both.
Does Private DNS use the VPN slot?
No. Android’s Private DNS setting is separate from the VPN slot. You can run NordVPN, Mullvad, Proton, or any other VPN at the same time as AdGuard DNS, NextDNS, ControlD, or Quad9 in Private DNS.
Will DNS blocking remove YouTube ads?
No. YouTube ads are served from the same domain as the video itself (googlevideo.com), so a DNS blocker cannot remove them without breaking the app. For YouTube ad blocking on Android, use a client like NewPipe, ReVanced, or a browser-based alternative.
Does Quad9 block ads?
No. Quad9 blocks domains tied to malware and phishing, not advertising. If your goal is to remove ads, use AdGuard DNS, NextDNS, or ControlD instead.
Can I use more than one DNS service at the same time?
Android’s Private DNS setting accepts one hostname at a time. To combine multiple upstreams (for example AdGuard DNS for ads and Quad9 for malware), you need an app that supports multiple resolvers, like Rethink DNS or NextDNS configured with multiple filter lists. Rethink uses the device’s VPN slot, NextDNS does not.
Which of these DNS providers logs my queries?
None of the four log queries on the free tier by default. AdGuard DNS and ControlD make this explicit and verifiable. NextDNS offers optional logging that you control per profile. Quad9 is run by a Swiss nonprofit with a long-standing no-logs policy.
Related reading
- AdGuard vs Blokada vs RethinkDNS vs NextDNS: best Android ad blocker 2026
- Best Android ad blockers that do not take the VPN slot (2026)
- Best ad blockers and privacy apps for Android (no root)
Companion Android apps
When you want a local app on top of (or instead of) Private DNS, these are the official Android clients for the services above.
Rethink DNS + Firewall + VPN (the open-source local-app option)
NextDNS (official Android client, optional)
