DNSCrypt on Android: Apps without Root, Magisk or Private DNS

Private DNS or DNSCrypt on Android?

Android 9 added Private DNS, a setting under Network and internet that sends lookups over DNS over TLS (RFC 7858). It has three behaviours: off, automatic upgrade when the network’s resolver supports TLS, and a fixed provider hostname. With a hostname set, an unreachable server marks the network as having no internet access instead of falling back to plain DNS.

That is solid protection against snooping on café Wi-Fi, and it needs nothing installed. What it cannot do is speak DNSCrypt, route through Anonymized DNS relays, or block names locally. If those features are the reason you are here, read on; if you only wanted encrypted lookups to a resolver you trust, the Private DNS guide is the shorter path.

A rough rule helps. Choose Private DNS when you trust one resolver and want zero maintenance. Choose DNSCrypt on Android when you want relays that hide your address from the resolver, local blocklists, or a pool of servers the client picks from by speed. The second option is more work, and only pays off if you use those features.

DNSCrypt apps that work without root

Two open-source apps carry a DNSCrypt client and run without root. Both need the Android VPN permission, because that interface is the only way an unrooted app can see every lookup on the device. Android’s documentation is explicit that only one VPN connection runs at a time, so starting another VPN app switches the DNS app off.

InviZible Pro combines Tor, DNSCrypt and Purple I2P in one app and, according to its README, works on rooted and non-rooted devices. It is distributed through Google Play, F-Droid (stable), IzzyOnDroid (beta) and GitHub, where 2.7.6-beta appeared on 24 October 2026. The README notes that some blocking features are missing from the Google Play edition.

RethinkDNS (Rethink DNS + Firewall + VPN) describes itself as a DoH, Oblivious DoH, DoT and DNSCrypt client with blocklists, plus a per-app firewall and a WireGuard proxifier. Its DNS mode sends every app’s lookups to a resolver of your choice. Version 0.5.8 was released on 13 October 2026, and it ships through F-Droid and Google Play.

1. Install the app from F-Droid or Google Play.
2. Open its DNS section and choose DNSCrypt servers (InviZible starts its DNSCrypt module; RethinkDNS lets you pick a DNSCrypt resolver).
3. Accept the VPN permission prompt Android shows on first start.
4. Leave Private DNS set to off or automatic, so the system does not bypass the app.

The last step catches people out. A fixed Private DNS hostname gives the system its own encrypted path to a DoT server, while the app expects to see every lookup through its VPN interface. Two encrypted layers make results hard to read, so the clean setup without root is one path at a time.

DNSCrypt on Android with root: the Magisk module

The dnscrypt-proxy wiki lists two Magisk modules, the original dnscrypt-proxy-android and a maintained fork by Turbolqk. The fork takes its arm, arm64, x86 and x86_64 binaries from the project’s releases, and its latest release, 2.1.18 from 16 August 2026, trails the project’s 2.1.20 by two versions. The module only helps where Magisk is installed.

1. Download the latest dnscrypt-proxy-android-*.zip from the fork’s releases page.
2. In Magisk, open Modules, then Install from storage, and select the zip.
3. Reboot the phone.
4. Edit the configuration file the module installed if its presets do not suit you.

The fork’s presets are opinionated. It uses Anonymized DNS out of the box, names three servers in server_names, listens on 127.0.0.1:5354 to avoid conflicts while tethering, and sets doh_servers = false because it favours DNSCrypt v2. The magisk module leaves the VPN slot free, which is its main advantage over the apps above.

Checking that it works

Each app shows its own log or connection list; look for answers from DNSCrypt servers rather than from your carrier. For an independent view, run the queries on the DNS leak check page from a terminal app or a laptop tethered to the phone: the resolver address they report should belong to the server you picked.

Test on both Wi-Fi and mobile data, ideally on more than one network. Carriers and hotel networks behave differently, and a setup that looks clean at home can leak on a captive portal. The public Wi-Fi page explains what to expect from hotel and airport login portals and how they interact with encrypted DNS.

Troubleshooting

• No connection after enabling the app: another VPN app took over the VPN slot, or Private DNS points at a hostname.
• DNSCrypt servers time out while DoH ones work: the network may block UDP 443; allow DoH servers or switch networks.
• Magisk module installed but nothing changes: reboot again and check that the module is enabled in Magisk.
• Tethered devices lose DNS: keep the module on a port other than 53, as the fork’s preset does.

If the trouble persists, strip the setup back. Disable blocklists, use one well-known DNSCrypt server, and confirm that a single lookup works before adding relays or filters again. Most failures trace back to two layers fighting over the same traffic, and removing one of them is usually quicker than diagnosing both together.