# Encrypted dns, rethink dns **URL:** https://discuss.privacyguides.net/t/encrypted-dns-rethink-dns/37331 **Category:** Questions **Tags:** please-eli5 **Created:** 2026-04-22T06:00:31Z **Posts:** 9 ## Post 1 by @hzko — 2026-04-22T06:00:31Z If i exclude the app from rethink dns it use the isp dns, my goal is using rethink dns with wireguard on and some apps exclude from wireguard. Is it possible that using rethink dns while wireguard on and some apps exclude from wireguard but using encrypted dns without private dns on? Example i excluded brave browser but i still need to input secure dns. I want to excluded the app and set encrypted dns without going to put secure dns in the browser setting. I hope i made it clear --- ## Post 2 by @notwithstanding — 2026-04-22T10:50:07Z This was a bit difficult to understand, but yes, you can route traffic from specific apps outside your VPN, while maintaining their encrypted DNS. The app may be able to manually use its own DNS though. I’ve seen a couple apps do that. --- ## Post 3 by @trilobyte — 2026-04-22T21:58:42Z As far as I know, every application can choose its own DNS. It’s just that many of them don’t and go with the OS DNS. The OS DNS can be set under the connection settings on desktop and android, where there’s a spot to input DNS address. It seems to be respected more on android. Browsers can be set either to use encrypted DNS of your choosing or to go with OS DNS. For a browser, using the OS DNS is set in the same place you would set secure DNS. Ultimately DNS is NOT a reliable filtering method unless it’s going through a second device that will reroute the DNS. Don’t rely on it for anything critical. If it’s a browser, you should probably just use secure DNS. --- ## Post 4 by @ignoramous — 2026-04-25T04:03:52Z > [@hzko](#): > > Is it possible that using rethink dns while wireguard on and some apps exclude from wireguard but using encrypted dns without private dns on? With Rethink? Yes. Use WireGuard in _Advanced_ mode. Then add apps to be routed through it using the “Add / Remove” button in "Configure → Proxy → Setup WireGuard → (tap on the particular WireGuard profile)\*. If you’re on Android 12+, turn ON _Configure → DNS → Split DNS_ if it isn’t, to make sure those apps setup to be routed through the WireGuard tunnel use WireGuard-provided DNS upstream. The rest of the apps not setup to be routed through WireGuard should continue to use DNS setup in _Configure → DNS_. --- ## Post 5 by @hzko — 2026-04-28T05:01:10Z I’m using rethinkdns android v0.5.5n My goal is using brave android with encrypted dns but without setting up secure dns inside the app and using cromite android on wireguard rethinkdns. I already try the methods on your reply but not working and not a line to my goal. I don’t know if rethink dns android have that feature. Already try lates beta version but not working to me. Sorry english is not my language. --- ## Post 6 by @ignoramous — 2026-05-19T02:19:56Z > [@hzko](#): > > already try the methods on your reply but not working and not a line to my goal. I don’t know if rethink dns android have that feature Gotcha. You’re on an older version. Please wait for `v055v`, which should launch in 3 to 5 days. --- ## Post 7 by @privacy.slouchy — 2026-05-19T02:35:07Z To be fair, every release since N has been labelled ‘prerelease’. I bet most users are still running N --- ## Post 8 by @hzko — 2026-05-20T07:24:26Z Example, i want to use facebook app excluded from wireguard but have setup encrypted dns. I don’t know if rethink have feature like you can setup encrypted dns on specific app. It would be nice that you can use facebook app while only using encrypted dns and other apps using wireguard. --- ## Post 9 by @ignoramous — 2026-05-21T05:32:37Z > [@hzko](#): > > I don’t know if rethink have feature like you can setup encrypted dns on specific app Yes multiple ways to achieve this (indirectly) in Rethink. One of the ways is [outlined above](https://discuss.privacyguides.net/t/encrypted-dns-rethink-dns/37331/4). This setting excludes an app from any proxy (WireGuard, SOCKS5, HTTP) you may have setup within Rethink: Configure → Apps → (choose a specific app) → Never proxy this app (turn it ON) This setting excludes all DNS queries from proxy (WireGuard & Orbot are the only “proxies” in Rethink that connect to DNS resolvers): Configure → DNS → Split DNS (turn it OFF) Or, [as mentioned above](https://discuss.privacyguides.net/t/encrypted-dns-rethink-dns/37331/4), you can run a proxy in “Advanced mode” (only supported for WireGuard & Orbot), whereby, one must explicitly set apps to be routed through these tunnels. Other apps are exempt from their tunnel, by default. Configure → Proxy → Setup WireGuard → (Advanced tab) → (turn ON any of the listed WireGuards or import them by tapping on the “+” floating action button in the footer) → (tap on “Add / Remove apps” button prominently displayed in the UI). * * * If you don’t see most or any of the settings discussed above, then wait for `v055v`.