A Modern Guide to Blocking Ads on Android

Android phone protected by a glowing green shield against advertising screens

Android ad blocking is no longer a choice between one browser extension and one hosts-file app. Modern tools work at different layers, and each layer can stop a different part of the problem.

The practical setup is usually simple: choose one system-wide tool, use browser content blocking for the web, and add a root solution only when root is already part of the phone’s configuration.

The modern topology

Layer	What it can do	What it cannot do well	Good fits
Private DNS	Applies a filtering DNS resolver across most of the phone without taking Android’s VPN slot.	Works at the domain level; it cannot remove page elements or reliably stop ads delivered from the same domain as wanted content.	ADNS with a filtering resolver
Local VPN filtering	Filters DNS or connections across apps without root and can add per-app firewall controls.	Normally occupies Android’s single VPN slot, so it may conflict with a separate VPN application.	Athena, Rethink, DNSNet, InviZible Pro
Browser content filtering	Blocks web requests, hides page elements, and applies scriptlet or cosmetic rules inside the browser.	Does not filter traffic from other applications.	IronFox with uBlock Origin
Root hosts filtering	Blocks listed hostnames system-wide without consuming the VPN slot.	Requires root and remains domain-based, so it does not replace browser filtering.	Re-Malwack

Android permits only one active VPN service per user or profile. Starting another VPN service stops the first one. That means several no-root blockers should not be installed and activated together: pick the system-wide engine that matches the rest of your network setup.

System-wide options

Athena

Athena combines DNS blocklists with per-app network controls. It can operate in VPN, Shizuku, or root modes, making it useful when you want one interface that can adapt to different phone configurations.

Choose Athena when you want blocklist management and firewall controls together. Decide which operating mode you will use before configuring another VPN or root-level network tool.

ADNS

ADNS manages Android’s native Private DNS setting and includes direct NextDNS management. Direct control of the system setting requires a one-time Shizuku or ADB setup, but it does not run a local VPN in the background.

Choose ADNS when preserving Android’s VPN slot matters. The actual blocking comes from the Private DNS provider you select, so configure that provider’s blocklists and privacy settings as well as the app.

Rethink

Rethink combines DNS selection, DNS blocking, per-app firewall rules, connection logs, and WireGuard support. It is the broadest option here for someone who wants to inspect and control which applications can connect.

Choose Rethink when you want DNS filtering and a firewall in one place, or when its integrated WireGuard handling fits your VPN setup better than running separate applications.

DNSNet

DNSNet is the focused option. It creates a local VPN, applies hosts-format filter lists, and allows application or hostname exceptions.

Choose DNSNet when you primarily want straightforward system-wide domain blocking without the larger control surface of a full firewall and routing suite.

InviZible Pro

InviZible Pro combines DNSCrypt, Tor, I2P, and firewall features. It can work through a local VPN or use root when available.

Choose InviZible Pro when encrypted DNS, Tor or I2P routing, censorship resistance, and application firewalling are part of the requirement. It is a networking toolkit, not merely an ad blocker, so configure only the modules you understand and need.

Browser-based blocking

System-wide DNS or hosts filtering stops requests to known domains. A browser extension can also hide empty ad containers, apply site-specific filters, and block scripts that a domain list cannot distinguish.

IronFox is the maintained recommendation in this family. It includes a configured copy of uBlock Origin by default, so there is no reason to install a second copy. Keep IronFox and its included extension updated.

Mull was the earlier hardened Firefox-based option, but its original project is archived. An existing Mull installation can still run uBlock Origin, but it should not be treated as a maintained choice for a new installation. Migrate to IronFox rather than continuing indefinitely on an unpatched browser.

For another compatible Firefox-based browser, install only the official uBlock Origin published by Raymond Hill. Start with its default filter lists. Adding every available list can create duplicate work and unnecessary breakage.

Root-based blocking with Re-Malwack

Re-Malwack is a systemless hosts-based blocker for Magisk, KernelSU, APatch, and related root environments. It provides selectable blocking profiles, automatic hosts updates, custom sources, allowlists, blocklists, and a WebUI where the root manager supports one.

Use Re-Malwack when the device is already rooted and you want blocking that does not occupy Android’s VPN slot. Do not combine it with another hosts-modifying blocker or systemless-hosts module. The project explicitly warns against running overlapping ad blockers because the mounts and generated hosts files can conflict.

A sensible starting process is:

Install the current release from the project’s official repository.
Begin with the default or balanced profile rather than the largest possible list.
Reboot if required by the root manager, then confirm the module reports active protection.
Test normal browsing, messaging, banking, media, and captive-portal sign-in.
Allowlist only the specific domain that breaks a required function.
Keep uBlock Origin in the browser for cosmetic and site-specific filtering.

Choose a setup

Simple, no root: DNSNet plus IronFox with its included uBlock Origin.
Firewall and connection visibility: Rethink plus IronFox.
Keep the VPN slot available: ADNS with a filtering Private DNS provider, plus IronFox.
Flexible VPN, Shizuku, or root modes: Athena plus IronFox.
Tor, DNSCrypt, I2P, or censorship-resistance needs: InviZible Pro plus browser filtering.
Phone already rooted: Re-Malwack plus IronFox; avoid a second system-wide hosts blocker.

These are starting points, not components to install all at once.

What will still get through

DNS and hosts filters make decisions by hostname. They cannot reliably block an advertisement delivered from the same hostname as the content you requested. Sponsored posts inside a social feed, server-inserted video ads, and promotions drawn directly by an application may remain visible.

Browser content blocking can handle more page-level cases, but it still cannot rewrite native applications. When a required service breaks, review the blocker’s log and make the narrowest possible exception instead of disabling protection globally.

Check F-Droid before choosing

This category changes quickly. Before installing, search F-Droid for current DNS, firewall, tracker-blocking, and ad-blocking applications. Check the latest release date, supported Android versions, source-code link, permissions, anti-features, and recent issue activity.

Some projects publish through their own F-Droid-compatible repository or directly from their source repository rather than F-Droid’s main catalog. Follow the project’s official installation instructions and verify the package name and signing certificate when that information is provided. Revisit the catalog periodically: the best-maintained option today may be replaced or superseded later.