Enable Private DNS on Android – Complete Tutorial

Why you should care about DNS on Android

Every time you open a website or use an app that contacts a server, your device first asks a DNS (Domain Name System) server to translate the human‑readable domain (e.g., example.com) into an IP address. By default Android uses the DNS servers supplied by your carrier or Wi‑Fi router, which are often unencrypted and can be observed or manipulated by ISPs, public Wi‑Fi operators, or malicious actors.

Private DNS, introduced in Android 9 (Pie), encrypts those queries with DNS‑over‑TLS (DoT). The traffic is wrapped inside a TLS tunnel, preventing passive eavesdropping and many active attacks. Enabling it is a quick win for privacy without installing third‑party VPNs or rooting the phone.

Before you start

• Android version: Private DNS is available on Android 9 (Pie) and newer. If you run an older version, you’ll need a third‑party app (e.g., Intra) – see the “Alternative method” section.
• Network connection: Make sure you are connected to Wi‑Fi or mobile data that can reach the internet.
• Backup your settings: Changing DNS does not affect personal data, but note the current DNS configuration in case you need to revert.
• Choose a trusted DNS provider: You’ll need the provider’s DoT hostname (e.g., dns.google). The tutorial lists a few reputable options.

Understanding Private DNS modes

Android offers two modes under Settings → Network & Internet → Advanced → Private DNS:

1. Automatic: The system tries to use DNS‑over‑TLS if the network advertises it. This is the default and works on many modern Wi‑Fi routers.
2. Private DNS provider hostname: You manually enter a DoT hostname. The system forces all DNS queries through that provider, regardless of the network.

For most users the second option gives the most reliable privacy because it does not depend on the router’s capabilities.

Step‑by‑step: Enabling Private DNS

How to test that DNS‑over‑TLS is really working

Simply seeing the hostname in the settings does not guarantee that traffic is encrypted. Use one of the following methods to confirm.

Method A – Online DNS‑Leak test

1. Open a browser and go to dnsleaktest.com (or any similar site).
2. Tap Standard test. The result page lists the DNS resolvers that answered your queries.
3. If the listed IP addresses belong to the provider you configured (e.g., Cloudflare’s 1.1.1.1), the DoT tunnel is active.

Method B – Using Termux and dig

If you have Termux installed, you can query a domain directly over TLS:

pkg install bind-utils
 dig +tls=853 @dns.google example.com

The output should show an answer section with the IP address of example.com. If you get a timeout, the TLS connection failed.

Method C – Android’s built‑in network diagnostics

Some OEMs (e.g., Samsung) include a Network diagnostics tool under Settings → Developer options. Look for a line that says "Private DNS: dns.google (active)".

Alternative method for Android 8 and older

If your device runs Android 8 or earlier, the native Private DNS option is unavailable. In that case you can achieve similar protection with a lightweight app that creates a local VPN and forwards DNS over TLS.

• Intra (by Jigsaw) – free, no‑root, supports Cloudflare, Google, Quad9.
• Nebulo – offers custom DoT hosts and DNS‑over‑HTTPS fallback.

Install the app from the Play Store, grant VPN permission, and select the same provider hostname you would use in the native setting. The app will route DNS queries through TLS while leaving other traffic untouched.

Troubleshooting common issues

1. "Failed to connect" after saving the hostname

• Check network blocks: Some mobile carriers or public Wi‑Fi networks block outbound traffic on port 853. Switch to a different network or use a VPN that allows TLS.
• Typo in hostname: Ensure there are no spaces or extra characters. The hostname must be exactly as listed by the provider.
• Provider outage: Verify the provider’s status page; occasionally DoT servers experience downtime.

2. DNS queries still resolve to your ISP’s servers

• App‑specific DNS: Some browsers (e.g., Firefox) can be configured to use DNS‑over‑HTTPS independently. Check the app’s network settings.
• VPN interference: If a VPN is active, it may replace the DNS path. Disable the VPN or configure it to respect the system DNS.
• Device reboot: After changing the setting, a quick restart ensures all system services pick up the new resolver.

3. Certain websites fail to load

Occasionally a website’s CDN does not respond correctly to queries from a specific DoT provider. To isolate the problem:

1. Temporarily switch the Private DNS hostname back to dns.google (or another provider).
2. Clear the browser cache.
3. Reload the site. If it works, the issue is with the previous provider’s resolution for that domain.

If the problem persists across providers, the cause is likely unrelated to DNS (e.g., HTTP block, captive portal).

Advanced: Using Private DNS with per‑network overrides

Android’s native Private DNS applies system‑wide; you cannot set a different DoT server for a single Wi‑Fi network without third‑party tools. However, you can combine Private DNS with a per‑network static DNS configuration (available on some OEMs) to achieve a fallback strategy:

1. Enable Private DNS with a trusted provider (e.g., Cloudflare).
2. On a specific Wi‑Fi network, go to Settings → Network & Internet → Wi‑Fi, long‑press the network name, tap Modify network, expand Advanced options**, and set IP settings to Static. Enter the provider’s plain DNS IP (e.g., 1.1.1.1) as the primary DNS.
3. The device will first attempt encrypted DoT; if that fails, it falls back to the static IP, ensuring connectivity.