Enable DNS‑over‑HTTPS (Private DNS) on Android

Most Android users assume the DNS server their phone uses is set by the carrier or Wi‑Fi router and never question it. In reality, that DNS traffic travels in clear text, allowing anyone on the same network to see which domains you query. Enabling DNS‑over‑HTTPS (DoH) or DNS‑over‑TLS (DoT) encrypts those lookups, protecting privacy and preventing DNS‑based attacks.

Before you start

• Android version: Private DNS is built into Android 9 (Pie) and later. If you run Android 8 or older, you’ll need a third‑party app or a custom ROM – see the “Alternative for older devices” section.
• Internet connection: Ensure you have a stable Wi‑Fi or mobile data connection. Switching networks during the setup can cause the settings to revert.
• Backup your network settings: While enabling Private DNS does not erase any data, some carriers lock DNS on their network. Note the original DNS (often visible in Settings > Network & internet > Wi‑Fi > Your network > Advanced > IP settings) in case you need to revert.
• Choose a DoH provider: The tutorial uses Cloudflare (1.1.1.1) and Google (dns.google) as examples. Both are free, support DoH, and have public endpoints.

Understanding Private DNS on Android

Android’s Private DNS feature implements two encryption standards:

• DNS‑over‑TLS (DoT): Queries are sent over a TLS‑protected TCP connection (port 853). The UI refers to this as “Private DNS mode”.
• DNS‑over‑HTTPS (DoH): Queries are wrapped in HTTPS requests, typically to the same hostname as the DoT endpoint. Modern Android versions treat DoH and DoT interchangeably – you only need to supply the hostname, and the system picks the best protocol.

The advantage is that the DNS traffic is no longer visible to the local router, ISP, or any attacker on the same Wi‑Fi. It also mitigates DNS spoofing attacks that rely on modifying plain‑text responses.

Step‑by‑step: Enabling Private DNS

1. Open Settings.

   Navigate to Settings > Network & internet. On some OEM skins the path may be Settings > Connections > More connection settings or similar; look for the section that groups Wi‑Fi, mobile network, and VPN.

2. Tap “Advanced”.

   Scroll down until you see Private DNS. If you cannot find it, use the Settings search bar and type “Private DNS”.

3. Select “Private DNS provider hostname”.

   Three options appear:

   • Off – default, unencrypted DNS.
   • Automatic – Android tries to use a DNS provider that supports DoH/DoT automatically (available on some devices).
   • Private DNS provider hostname – manual entry.

   Choose the third option.

4. Enter the provider hostname.

   For Cloudflare type 1dot1dot1dot1.cloudflare-dns.com. For Google type dns.google. These hostnames resolve to the DoH/DoT endpoints used by the providers.

   After typing, tap Save or the check‑mark icon.

5. Verify the connection.

   Android will instantly test the hostname. If the test succeeds, you’ll see a toast message “Private DNS mode active”. If it fails, the UI reverts to Off and shows an error.

Testing that DNS‑over‑HTTPS is really working

Even though Android reports success, it’s good practice to double‑check that your lookups are encrypted.

1. Open a browser and go to dnsleaktest.com.
2. Run the “Standard test”. The page will list the DNS servers it sees. You should see the IP addresses belonging to your chosen provider (e.g., Cloudflare’s 1.1.1.1 or 1.0.0.1).
3. If you see your ISP’s DNS or the router’s IP, the Private DNS setting didn’t apply. Proceed to the troubleshooting section.

Alternative methods for devices that lack built‑in Private DNS

Some older Android versions (8.x and below) or heavily customized OEM skins hide the Private DNS option. In those cases you can still achieve encrypted DNS without rooting:

• Use a DNS‑changing app: Apps like Intra (by Jigsaw) or Cloudflare 1.1.1.1 act as a local VPN and forward DNS queries over DoH. Install from the Play Store, enable the service, and the app will route all DNS traffic securely.
• Termux + dnscrypt‑proxy: For users comfortable with a command line, install Termux, then pkg install dnscrypt-proxy. Configure /data/data/com.termux/files/usr/etc/dnscrypt-proxy/dnscrypt-proxy.toml to use a DoH server, start the daemon, and enable “VPN mode” in Termux to route traffic.

Both alternatives create a virtual network interface that forces all apps to use the encrypted resolver, mimicking the system‑wide Private DNS.

Common pitfalls and how to fix them

1. Private DNS fails to connect

• Cause: The device cannot reach the provider’s TLS port (853) because the carrier blocks it.
• Fix: Switch to mobile data or a different Wi‑Fi network to test. If it works elsewhere, contact your carrier or use a DNS‑changing app that tunnels over standard HTTPS (port 443).

2. Apps still use ISP DNS

• Cause: Some VPN or firewall apps force their own DNS, overriding Private DNS.
• Fix: Disable the conflicting app temporarily, or configure its DNS settings to point to the same DoH provider.

3. Captive portals (e.g., hotel Wi‑Fi) break after enabling Private DNS

• Cause: Captive portals rely on DNS redirection to present the login page. Encrypted DNS bypasses that redirection.
• Work‑around: Temporarily set Private DNS to Off while you log in, then re‑enable it afterwards.

4. Battery drain concerns

• Reality: The extra TLS handshake adds negligible power consumption. Users report less than 1 % increase in daily battery use.
• Tip: Keep the device’s Wi‑Fi sleep policy set to “Never” only when you need constant connectivity; otherwise, let the OS manage Wi‑Fi power.

Advanced: Using a custom DoH server

If you run your own DNS resolver (e.g., dnscrypt‑proxy on a home server) you can point Android to it for a fully private setup.

1. Ensure your server is reachable from the internet (or via VPN) and supports DoH on port 443.
2. Obtain the FQDN and a valid TLS certificate for that hostname.
3. Enter the hostname in the Private DNS field exactly as it appears in the certificate (e.g., dns.myhome.net).
4. Test with dnsleaktest.com to confirm traffic is hitting your server.

Because Android validates the server’s certificate, self‑signed certificates will be rejected unless you install them as system certificates – a process that typically requires root.

Troubleshooting checklist

1. Confirm Android version (9+).
2. Verify the hostname is typed correctly, without trailing spaces.
3. Test connectivity to port 853 using a network utility app (e.g., PingTools Network Utilities → Port Scan).
4. Disable any VPN or firewall apps that could override DNS.
5. Restart the device – some OEM skins apply the setting only after a reboot.
6. If still failing, switch to a DNS‑changing app as a fallback.

When to keep Private DNS Off

While encryption is almost always beneficial, there are rare scenarios where you might need the default DNS:

• Corporate networks that enforce DNS‑based access control; using a third‑party DNS could break internal services.
• When troubleshooting network issues unrelated to DNS, disabling Private DNS removes one variable.

In those cases, simply revert to Off, resolve the issue, then re‑enable Private DNS.

Summary

Enabling Android’s Private DNS converts every DNS lookup into an encrypted TLS/HTTPS request, shielding your browsing habits from eavesdroppers and protecting against DNS spoofing. The built‑in UI makes the process straightforward on Android 9+, and alternative apps cover older devices. By following the steps, testing the result, and using the troubleshooting guide, you can secure your device’s name resolution without rooting or flashing custom firmware.