System-level ad-blocking in Android

Android 系统级广告拦截

System-level ad-blocking in Android in 2026 The Internet has become an advertising platform. Users of mobile devices are acutely aware of this, because mobile operating environments and apps force ads on their users, in addition to those that pollute the Web. It’s getting harder to avoid the ads on Android handsets, as Android is increasingly locked down and difficult to customize. It’s certainly not in Google’s interest to make it easy to block ads. 2026 年的 Android 系统级广告拦截：互联网已经沦为一个广告平台。移动设备用户对此深有体会，因为除了充斥网页的广告外，移动操作系统环境和应用程序也会强行向用户推送广告。在 Android 手机上避开这些广告变得越来越困难，因为 Android 系统正变得日益封闭，且难以定制。显然，让广告拦截变得简单并不符合 Google 的利益。

It’s still possible, though, to suppress most advertising, even in 2026. This article is specifically about blocking ads at the system level, that is, in the Android platform itself, rather than in any particular app. Some Android apps, particularly web browsers, have their own methods of blocking ads, or can have such features added using third-party plug-ins. Oddly, though, the DuckDuckGo browser, whilst blocking the tracking that accompanies targeted advertising, doesn’t specifically block ads – you need something more. 不过，即便是在 2026 年，拦截大部分广告依然是可能的。本文专门探讨如何在系统层面（即 Android 平台本身，而非针对某个特定应用）拦截广告。一些 Android 应用（尤其是网页浏览器）拥有自己的广告拦截方法，或者可以通过第三方插件添加此类功能。奇怪的是，DuckDuckGo 浏览器虽然能拦截定向广告所伴随的追踪行为，但并不会专门拦截广告——你还需要更进一步的手段。

If you block ads at the system level, all apps – and the system itself – are protected. Moreover, methods for blocking ads can usually be extended to protect against trackers and other kinds of malware. 如果你在系统层面拦截广告，所有的应用程序乃至系统本身都能得到保护。此外，广告拦截的方法通常还可以扩展，以防御追踪器和其他类型的恶意软件。

Basic principles

基本原理

So far as I know, all system-level ad-blocking methods work by overriding DNS behaviour. DNS (domain name service) is the technology that maps hostnames to numeric IP addresses; a DNS lookup is the first step in almost all network operations. Blocking ads using DNS amounts to finding the hostnames of know advertising services, and mapping them to bogus IP numbers. This can be done in the Android handset itself, or in some external DNS server. 据我所知，所有系统级广告拦截方法都是通过覆盖 DNS 行为来工作的。DNS（域名系统）是将主机名映射为数字 IP 地址的技术；DNS 查询几乎是所有网络操作的第一步。使用 DNS 拦截广告，本质上就是找出已知广告服务的主机名，并将它们映射到虚假的 IP 地址上。这一过程可以在 Android 手机本地完成，也可以在外部 DNS 服务器上完成。

Returning a bogus IP number doesn’t prevent an app or browser trying to show advertising, or allow it to make better use of the screen space the ads take up. Apps vary in their responses to a failed attempt to display advertising – more on this later. 返回虚假 IP 地址并不能阻止应用或浏览器尝试显示广告，也不会让应用更好地利用广告所占用的屏幕空间。不同应用在广告显示失败时的反应各不相同——稍后会详细说明。

Blocking ads using DNS

使用 DNS 拦截广告

There are essentially four methods to block ads using DNS changes: 使用 DNS 变更拦截广告的方法主要有四种：

1. Use a commercial DNS service with ad-blocking features.
2. 使用带有广告拦截功能的商业 DNS 服务。
3. Use a commercial virtual private network (VPN) with ad-blocking features, like NordVPN.
4. 使用带有广告拦截功能的商业虚拟专用网络 (VPN)，例如 NordVPN。
5. Install an ad-blocking app that doesn’t require root access.
6. 安装无需 Root 权限的广告拦截应用。
7. Use an ad-blocking method that requires root access, with or without a supporting app.
8. 使用需要 Root 权限的广告拦截方法（无论是否配合辅助应用）。

Commercial ad-blocking DNS services

商业广告拦截 DNS 服务

In general, when you make a connection to the Internet on an Android device, the DNS name resolution (mapping a hostname to a numerical Internet addresses) is performed by a server hosted by the handset’s mobile carrier or Internet service provider. Android allows you to override this behaviour, and select a custom DNS server that blocks ads. Well, it won’t actually “block” anything – not really; the DNS server just returns a bogus IP number when your handset looks up the IP number that corresponds to the hostname of a known advertiser. 通常情况下，当你在 Android 设备上连接互联网时，DNS 名称解析（将主机名映射为数字互联网地址）是由手机运营商或互联网服务提供商托管的服务器执行的。Android 允许你覆盖此行为，并选择一个能拦截广告的自定义 DNS 服务器。实际上，它并不会真正“拦截”任何东西；当你的手机查询已知广告商的主机名对应的 IP 地址时，DNS 服务器只是返回一个虚假的 IP 地址。

Depending on the DNS service you use you may, or may not, get some control over exactly what it blocks. Some users choose also to block access to pornography or on-line gambling, for example, for child protection. How well these services work depends, of course, on how well the service’s operators maintain their lists of known advertising hosts. Advertising services come and go, and even long-standing ones change their servers from time to time. 根据你所使用的 DNS 服务，你可能会也可能不会获得对拦截内容的精确控制权。例如，一些用户为了保护儿童，会选择同时拦截色情或在线赌博网站。当然，这些服务的效果取决于运营商维护已知广告主机列表的水平。广告服务层出不穷，即便是老牌服务也会不时更换服务器。

There are many commercial DNS services that support ad-blocking, and I don’t endorse any in particular. Prices vary, and most services have a free trial. If you care about privacy, you’ll want to use a service that keeps no logs, and you might want to use one that supports encrypted DNS. A rogue DNS operator might get access to sensitive data in all kinds of ways. It’s possible, for example, for a DNS operator to direct requests for your on-line banking service to its own proxy, and slurp up your credentials when you log in. You should certainly be very careful and, while there are legitimate free DNS services, I’m rather suspicious of any service of this kind whose funding model is unclear. 市面上有许多支持广告拦截的商业 DNS 服务，我不特别推荐任何一家。价格各异，且大多数服务提供免费试用。如果你关注隐私，建议选择不保留日志的服务，并考虑使用支持加密 DNS 的服务。恶意的 DNS 运营商可能会通过各种方式获取敏感数据。例如，DNS 运营商可能会将你对网上银行服务的请求重定向到其代理服务器，并在你登录时窃取你的凭据。你务必保持警惕；虽然存在合法的免费 DNS 服务，但我对任何资金模式不明的此类服务都持怀疑态度。

Commercial VPNs with ad-blocking features

带有广告拦截功能的商业 VPN

For many people this will be the simplest solution. If you subscribe to a VPN service for general privacy, blocking ads will often come at no extra cost. Ad-blocking VPNs typically redirect DNS lookups to their own servers, and return dummy IP numbers for known advertisers, just as a commercial DNS service does. VPNs therefore have all the same advantages and disadvantages as an ad-blocking DNS service. A big VPN operator will usually provide an Android app that configures the handset to use its servers, so set-up is pretty trivial for most people. As with commercial DNS services, a rogue VPN operator can be very dangerous, and it’s important to choose a provider carefully. 对许多人来说，这是最简单的解决方案。如果你为了通用隐私而订阅了 VPN 服务，通常无需额外付费即可获得广告拦截功能。带有广告拦截功能的 VPN 通常会将 DNS 查询重定向到其自有服务器，并针对已知广告商返回虚假 IP 地址，这与商业 DNS 服务如出一辙。因此，VPN 具有与广告拦截 DNS 服务相同的优缺点。大型 VPN 运营商通常会提供 Android 应用来配置手机以使用其服务器，因此对大多数人来说，设置非常简单。与商业 DNS 服务一样，恶意的 VPN 运营商可能非常危险，因此谨慎选择服务提供商至关重要。

Non-rooted ad-blocking apps

无需 Root 的广告拦截应用

So far as I know, all these apps exploit a loophole (of sorts) in Android’s platform lock-down. Like all Linux-based operating systems, Android provides a way for a device to override the DNS mappings of the Internet service provider it is using. There will be, somewhere on the handset, a file that contains a list of preferential name-to-IP mappings. On a non-rooted Android device, the user won’t have permissions to change this file, so a simple method of blocking ads – maintaining a list of bogus DNS mappings for known advertisers in a file – is unavailable. 据我所知，所有这类应用都利用了 Android 平台封闭性中的一个（某种意义上的）漏洞。像所有基于 Linux 的操作系统一样，Android 提供了一种让设备覆盖其所使用的互联网服务提供商 DNS 映射的方法。在手机的某个位置，会有一个包含优先域名到 IP 映射列表的文件。在未 Root 的 Android 设备上，用户没有权限修改此文件，因此无法使用那种简单的广告拦截方法——即在文件中维护一份已知广告商的虚假 DNS 映射列表。

However, in a non-rooted device, you can install a VPN service. This has to be possible, if Android is to support VPNs at all. A non-rooted ad-blocking app will typically run a DNS server and a local (within the app) VPN host. The app will configure the handset to use its own VPN as the system VPN provider, which will make its own DNS server the system DNS. With control over DNS, the app can provide its own handling for name lookups, including those of know advertising servers. Google, being an advertising company, isn’t very keen on this kind of thing. It can’t easily prevent the use of “local” VPNs without crippling VPN functionality completely but Google can… 然而，在未 Root 的设备上，你可以安装 VPN 服务。如果 Android 要支持 VPN，这必须是可行的。无需 Root 的广告拦截应用通常会运行一个 DNS 服务器和一个本地（应用内）VPN 主机。该应用会将手机配置为使用其自身的 VPN 作为系统 VPN 提供商，从而使其自身的 DNS 服务器成为系统 DNS。通过控制 DNS，该应用可以提供自己的域名查询处理机制，包括针对已知广告服务器的查询。作为一家广告公司，Google 对此类做法并不热衷。如果不彻底废除 VPN 功能，Google 很难轻易阻止“本地”VPN 的使用，但 Google 可以……