Privacy and security
How to Block Trackers on Android Without a VPN (2026)
By the llcloud team 5 min read
Quick answer
Set Android's Private DNS to a filtering provider such as AdGuard DNS or Quad9. It blocks tracker and malware domains for every app, keeps working in the background and uses no VPN. For your own blocklists, per-app rules or cutting an app off the internet, add an app like Repel, whose firewall also runs without the VPN slot.
Trackers in apps phone home to analytics and advertising domains many times a day. You can cut most of that off on Android without root, without a computer and without giving up the VPN slot. The free built-in way is Private DNS. An app helps when you want to see what is being blocked, make rules for one app, or cut an app off the internet entirely.
How does blocking trackers with DNS work?
Before an app talks to a tracker, it has to look up the tracker's domain name, such as analytics.example.com. A DNS filter answers those lookups with "nothing here" when the domain is on a blocklist. The tracker request never leaves the phone. Everything else resolves normally.
There are three common ways to put a filter in front of those lookups on Android:
| Method | Uses the VPN slot? | Your own lists and per-app rules? | Cost |
|---|---|---|---|
| Private DNS with a filtering provider | No | No | Free, built in |
| Local DNS filter app (VpnService) | Yes | Yes | Varies |
| App firewall that blocks internet per app | Depends on the app | Blocks whole apps | Varies |
The VPN in a local DNS filter is a trick to see the lookups. It does not send your traffic to a server abroad. But Android only runs one VPN at a time, so it collides with a privacy VPN. That is why the no-VPN options matter.
How do I block trackers with Private DNS?
Private DNS has been part of Android since version 9. It sends every lookup encrypted to the provider you name, and providers that filter will refuse tracker and malware domains.
- Open Settings > Network & internet > Private DNS. On some phones it sits under Settings > Connections > More connection settings, and older versions put it under Advanced. If you cannot find it, search Settings for "Private DNS".
- Choose Private DNS provider hostname.
- Type a filtering hostname, for example
dns.adguard-dns.com(blocks ads and trackers) ordns.quad9.net(blocks malware domains). - Tap Save.
That is all. It works for every app and keeps working with no app running. Our Private DNS guide lists more providers and what each one blocks.
What Private DNS cannot do
- You get the provider's list, take it or leave it.
- There is no log, so you cannot see which app looked up what.
- When a site or app breaks, your only fix is to switch the whole setting off.
- Most VPN apps use their own DNS while connected, so Private DNS may stop applying when your VPN is on.
- It cannot block an app from the internet. It only stops lookups for listed domains.
When is an app the better option?
Repel puts three layers in one app, and each of them can be used on its own.
One-tap Private DNS. Pick a provider such as AdGuard DNS, NextDNS, Quad9 or Cloudflare, and Repel switches Android's Private DNS for you. It keeps working with Repel closed and uses no VPN. This is the same no-VPN method as above, without typing hostnames.
The tracker and malware filter. A local, DNS-only VPN checks each lookup on the phone against community lists such as HaGeZi, OISD, 1Hosts and StevenBlack. Allowed lookups go out encrypted with DNS over HTTPS. Be clear on the trade: this layer does use the VPN slot. In return you get the activity log, which shows which app looked up which domain and whether it was blocked, and you can allow one domain when a list catches something you need.
The app firewall. This is the part that works next to your VPN. Repel's firewall blocks internet access for any app with one switch and does not use the VPN at all. It needs Android 13 or newer and a one-time pairing through Wireless debugging, with no computer and no root. Rules stay in place with Repel closed.
So a practical no-VPN setup looks like this:
- Turn on one-tap Private DNS with a tracker-blocking provider.
- Pair the firewall once through Wireless debugging.
- Switch off internet access for apps that have no reason to go online, like a flashlight, a calculator or an offline game.
Your own VPN stays connected the whole time. If you later want the activity log and your own lists, you can turn on the filter instead, as long as you can spare the VPN slot.
What can Repel not block?
Be realistic about DNS filtering. It works on domain names, so anything served from the same domain as the content gets through. That includes ads inside video streams, which Repel cannot remove, on phones or on Android TV. Some apps also fall back to hard-coded server addresses when a lookup fails.
The free version covers the filter with HaGeZi Light or Pro, the activity log with weekly stats, the app firewall, one-tap Private DNS, hosts mode and backup. Pro is a one-time purchase that adds larger lists, your own lists and DNS server, per-app domain rules, and firewall rules for Wi-Fi only, mobile data only, roaming, screen off and bedtime.
Why does my tracker blocker keep turning off?
A filter that runs as an app can be closed by your phone's battery management, especially on Samsung, Xiaomi, OnePlus and other skins that kill background apps hard. Our guide on why Android kills background apps explains what is going on and links to the fix for each phone maker. Private DNS and Repel's firewall are not affected, because neither needs an app running in the background.
Which setup should you pick?
| You want | Use |
|---|---|
| Fewer trackers, nothing to install | Private DNS with a filtering provider |
| The same, chosen in one tap | Repel's one-tap Private DNS |
| To see what each app looks up | Repel's filter (uses the VPN slot) |
| To cut an app off while your VPN runs | Repel's app firewall |
| One app allowed only on Wi-Fi | Repel Pro smart firewall rules |
If you are weighing Repel against an older firewall app, our Repel vs NetGuard comparison goes through the differences, including which one leaves your VPN free. To choose a provider by what it blocks, start with the provider table in how to set up Private DNS on Android.
Trackers are one part of phone privacy. If what worries you is someone scrolling through your gallery, our guide to hiding photos on Android covers Locked Folder, Secure Folder and Velum, an encrypted vault that is coming soon.
Sources
Questions
Can I block trackers on Android without installing anything?
Yes. Android 9 and newer has a Private DNS setting. Point it at a filtering provider, for example dns.adguard-dns.com, and lookups for known tracker and ad domains fail for every app on the phone. It costs nothing and uses no VPN. The limit is that you get the provider's list and nothing else, with no log of what was blocked and no way to make rules for one app.
Why do most tracker blockers use a VPN?
Android only lets an app see your phone's DNS lookups if it routes them through itself, and the VpnService API is the way to do that without root. The VPN in a local DNS filter stays on the phone and handles lookups only. The catch is that Android allows one VPN at a time, so a filter like this cannot run next to a privacy VPN you already pay for.
Does Private DNS work while my VPN is on?
Usually the VPN wins. Most VPN apps send DNS through their own servers inside the tunnel, so Android's Private DNS setting may not apply while the VPN is connected. Check your VPN app for a DNS or tracker blocking option, or pick a VPN that lets you set a custom DNS server.
Will blocking trackers break apps?
Sometimes. A blocklist can catch a domain an app needs, such as a login or image server, and the app then fails in odd ways. Lighter lists break less. With a plain Private DNS provider you can only switch the setting off to test. A filter with an activity log, like Repel's, lets you see the blocked domain and allow just that one.
Is blocking trackers the same as blocking ads?
No. Many tracker lists also catch ad servers, so you may see fewer ads in some apps, but ads served from the same domain as the content cannot be blocked by DNS. Video ads inside streaming apps are the best known example. Think of DNS filtering as tracker and malware protection, with fewer ads as a side effect at best.
