Top Active Connections shows hundreeds of references to 8.8.8.8

[u17194907425]

The content below is being updated from below.

INITIAL POST 2026-02-28:

Good day, I am using v0.5.5u for several days now and I see a pattern like below and would like to know if that's an expected behavior.

• I go to Stats -> Top Active Connections
• I see apps qith tens and thousands active connections
• I open several apps and see something like this:

8.8.8.8                 573
<IP address>             10
<IP address>              2

Or like this (where no other active connection is shown except to 8.8.8.8)

8.8.8.8                  36

There are different apps like this. System apps or the apps I have installed myself. The situation does not change even if I kill an app. It remains in the Stats screen with all the Top Active Connections. Only closing the connections makes them gone.

Is that expected?

Upd. I use On-device blocklists, may it be the reason?

---

UPD 2026-03-06: A scenario I came up with:

• App is MX Player (1.87.2 just in case).
• RethinkDNS is v0.5.5u
• VPN is set to blocking mode in android settings
• DSN is configured to DNSCrypt over Quad9
• on-device blocklist is used (and it seems the issue happens when it is enabled)
• In every scenario I enable RethinkDNS, go into MX Player and watch a video (just scroll it back and forth for a little while). It looks like this app is collecting a lot of analytics which is being blocked by on-device blocklists. And I think that every DNS-request to a domain blocked by on-device blocklist becomes a forever-active connection to 8.8.8.8.

on-device blocklists ON

Screenshots when there are remaining active connections to 8.8.8.8 and they do not go away

on-device blocklists OFF

Screenshots when there are no long-lasting active connections to 8.8.8.8. They are used and successfully closed

See continuation in #2583

[Onxr]

I don't know if it will help or not. I have Block when DNS is bypassed enabled. I didn't notice active connections to 8.8.8.8 but I did notice in the logs. My understanding was some apps were trying to bypass my DNS so I toggled that settings and also isolated the apps that were requesting that IP.

Regarding DNS bypass block, some apps may hardcode the IPs and they will be blocked. Eg. Telegram. For telegram add the followings to trusted IP. You can use per app (in this case telegram) rules.

Regarding isolation, yes I have also isolated system apps. I just noticed the domains in logs and then only allowed the ones I want. But for you I will suggest you to be cautious don't follow my method as it might cause issues.

[u17194907425]

My understanding was some apps were trying to bypass my DNS so I toggled that settings and also isolated the apps that were requesting that IP.

Thanks for the idea. I will try and see if it changes anything

[ignoramous]

I've moved your issue to discussions, but feel free to create a new issue by copy pasting the same content if you think what you're seeing is an issue with Rethink after all. Or, comment here (that you need this discussion to be an issue instead) and I'll do that myself. Thanks.

[u17194907425]

I've moved your issue to discussions, but feel free to create a new issue by copy pasting the same content if you think what you're seeing is an issue with Rethink after all. Or, comment here (that you need this discussion to be an issue instead) and I'll do that myself. Thanks.

Hi and thank you. I am still looking for a solid reproduction scenario.

At this moment I have the following observation related to using the feature of "On-device blocklists"

When they are off, then I see no issue. As soon as I turn it on, I start seeing the initial issue.

[u17194907425]

So now I wonder... Maybe it's something with the way RethinkDNS replies to the requests about domain names found in on-device blocklists.

It sees the domain blocked, replies as 0.0.0.0 (or whatever) but does not close the connection.

[ignoramous]

Which app is making those 8.8.8.8 calls, assuming Rethink shows app identity in the Configure -> Logs?

When & as this issue happens the next time, will you go to About -> General or About -> Stats and tap on the "Copy" button & then email the contents to mz at celzero dot com? Do mention this GitHub discussion (a link the subject or body would do) so I can search for it in my otherwise unmanagable inbox.

[u17194907425]

Thank you. Will definitely do

[u17194907425]

When & as this issue happens the next time, will you go to About -> General or About -> Stats and tap on the "Copy" button & then email the contents to mz at celzero dot com? Do mention this GitHub discussion (a link the subject or body would do) so I can search for it in my otherwise unmanagable inbox.

I was able to make a good reproduction scenario. The app is MX Player. Stats are sent to the provided email for the two scenarios with on-device blocklists turned ON and OFF.

Please let me know if any other relevant information is to be collected.

[u17194907425]

Maybe this issue is a combination of two things:

• proxied DNS request
• request blocked by on-device blocklists

[u17194907425]

With the creation of #2583 this discussion is proposed to be closed

[ignoramous]

Thanks for your time and detailed analysis. Appreciate it. I'll see if I can fix this in time for v055v.