RethinkDNS can:
1. Prevent apps from doing their own DNS. Android's DoT can't do that.
2. Block TCP/UDP connections to IPs per-app.
3. Block all connections when device is locked.
4. Block connections from any app not in the foreground.
5. Forward DNS queries to DNSCrypt v3 endpoints (supports Anonymized Relays) or Tor (via Orbot).
6. Forward all connections over Tor (via Orbot).
RethinkDNS can:
1. Prevent apps from doing their own DNS. Android's DoT can't do that.
2. Block TCP/UDP connections to IPs per-app.
3. Block all connections when device is locked.
4. Block connections from any app not in the foreground.
5. Forward DNS queries to DNSCrypt v3 endpoints (supports Anonymized Relays) or Tor (via Orbot).
6. Forward all connections over Tor (via Orbot).