CSRF and DNS rebinding are basically both cross-site request, but done differently and targeted against different protection mechanisms.
With CSRF the browser is aware that this is a cross-site request. This means that the Same Origin Policy will be applied. Thus, the request will be executed and will usually also include the cookies for the target site (i.e. kind of authenticated) but the attacker will not be able to read the response.
With DNS rebinding the browser is not aware that this is a cross-site request since the DNS name stays the same and only the target IP address changes. This means that no Same Origin Policy will be applied and thus the attacker can read the response. But, the browser will also not send any credentials and cookies for the real target server since it accesses the server with a different domain name than usual (the attacker controlled name instead of the real domain name) - and credentials and cookies are bound to a domain and not an IP address. This means that the request will not be authenticated automatically.
CSRF tokens will help in both cases since the attacker does not have access to the proper tokens. In case of CSRF it also helps if the servers checks the origin of the request (i.e. Referer and Origin header) while in case of DNS rebinding the server should verify that the value of the Host header is actually the server itself instead of an attacker-controlled domain.