Permissions and account access

Not all ADNS access uses the same model. Android grants INTERNET, ACCESS_WIFI_STATE, FOREGROUND_SERVICE, and RECEIVE_BOOT_COMPLETED at install time; they are not individually revoked in the ordinary Permissions UI. Turn off the related feature, block ADNS network access where your OS provides that control, or uninstall ADNS to remove that access. Runtime and privileged grants below are requested only when you use their related feature. You can manage a NextDNS account without granting device DNS control.

Device DNS control

WRITE_SECURE_SETTINGS lets ADNS read and change Android Private DNS mode and hostname for device DNS control and the Quick Settings tile. It is granted during activation through ADB or through Shizuku/Sui; it is not an Android runtime prompt. This access can expose and change the device’s current Private DNS mode and hostname.

To remove the Android grant while keeping ADNS installed, run:

adb shell pm revoke com.eyalm.adns android.permission.WRITE_SECURE_SETTINGS

Shizuku/Sui is a separate privileged broker: ADNS asks it for access during Shizuku activation, then its service grants WRITE_SECURE_SETTINGS. Revoking Shizuku access stops that broker access; it does not revoke an already granted WRITE_SECURE_SETTINGS permission. Use the command above, or uninstall ADNS, to remove the Android grant.

Network and account access

INTERNET is installed automatically and supports the NextDNS account requests you choose. The Normal build also checks GitHub Releases when it launches and only reports an available update; the FOSS build has no update check. Network requests can expose the account request or update check to the service receiving it. It cannot be separately revoked: block ADNS network access where your OS provides that control, or uninstall ADNS.

NextDNS account access is optional and is not an Android permission. ADNS accepts an email/password login (and a two-factor code when required), or a NextDNS API key you provide. The password and two-factor code are used transiently for sign-in and are not stored. The signed-in email (or account label for API-key sign-in) and API key are encrypted and persisted locally until you log out; the key is sent to NextDNS for the account requests you make. Sign out to remove the local account session; revoke an API key in your NextDNS account to stop its service access.

Wi-Fi rules and location

ACCESS_WIFI_STATE is installed automatically and declares Wi-Fi state access. Foreground location access (ACCESS_COARSE_LOCATION and ACCESS_FINE_LOCATION) is requested when you add the current network or enable Wi-Fi rules. Together, they let ADNS learn whether a Wi-Fi network is connected and read its connected Wi-Fi name/SSID. Location is used for the connected Wi-Fi name/SSID, not map coordinates. ACCESS_WIFI_STATE cannot be separately revoked; turn off Wi-Fi rules or uninstall ADNS to stop this use.

For continuous Wi-Fi rules, ADNS asks for background location (ACCESS_BACKGROUND_LOCATION) after foreground location. This lets the optional monitor continue to match the Wi-Fi name while ADNS is not open. A configured SSID and its rule state are stored locally; Android’s permission controls can also expose that the app has location access. Turn off Wi-Fi rules and remove foreground location and background location in Android Settings → Apps → ADNS → Permissions to stop this access.

Notifications and optional background work

On Android 13+, POST_NOTIFICATIONS is requested when you enable optional state notifications. It can show Private DNS state through Android notifications. Turn off State Notifications in ADNS, or revoke notification access in Android Settings → Apps → ADNS → Notifications.

State Notifications and Wi-Fi rules each independently start the foreground service (FOREGROUND_SERVICE, including its location and special-use types) when enabled. Its foreground-service notification can reveal that monitoring is active. RECEIVE_BOOT_COMPLETED runs the same plan after boot: State Notifications can restore independently, while Wi-Fi rules also need their location conditions. These install-time permissions cannot be separately revoked; turn off State Notifications and Wi-Fi rules to stop their work, or uninstall ADNS. Android lets you manage notification access separately.

REQUEST_IGNORE_BATTERY_OPTIMIZATIONS is used only if you choose the optional battery optimization exemption from Settings. It asks Android to reduce battery restrictions for ADNS; it does not grant data access. Remove that exemption in Android’s battery settings when you no longer want it.

For data handling beyond access and revocation, see the privacy summary.