How to Set Up DNS‑over‑HTTPS (DoH) on Android Without Root

Before you start

DNS‑over‑HTTPS (DoH) encrypts the DNS queries your phone sends to resolve domain names. By routing those queries through HTTPS, your ISP or any on‑path observer cannot see which websites you are contacting. Android does not include a native system‑wide DoH setting, but you can achieve the same protection without rooting by using a local VPN app that forwards DNS to a DoH server.

Make sure you have the following ready:

• A device running Android 7.0 (Nougat) or newer – the VPN‑based approach relies on the built‑in VPN API introduced in this version.
• Stable Wi‑Fi or cellular data connection for the initial download.
• Google Play Store or F‑Droid access to install the helper app (Intra is the recommended free option).
• Optional but recommended: a recent backup of your important data, in case you need to reset network settings later.

Step‑by‑step setup using Intra

Verify that DoH is working

It’s important to confirm that your DNS queries are really going through HTTPS. Follow these checks:

• Online test: Open a browser and visit dnsleaktest.com. Run the “Standard test”. The displayed resolver should match the provider you selected in Intra (e.g., Cloudflare). If you see your ISP’s DNS, the tunnel is not active.
• Local log: Intra offers a simple log view. Tap Log in the app to see recent DNS queries and the response status. Entries marked HTTPS confirm encryption.
• Network settings check: Go to Settings > Network & Internet > Advanced > Private DNS. The field will still show Off because Private DNS uses TLS, not DoH. This is expected – Intra works independently of the system setting.

Alternative method: Using Nebulo

If you prefer a different UI or need per‑app DNS control, Nebulo is another open‑source VPN‑based DoH client. The steps are analogous:

1. Install Nebulo – DNS over HTTPS from Play Store or F‑Droid.
2. Open Nebulo, grant VPN permission, and pick a DoH server.
3. Enable "Force DNS over HTTPS" and start the service.

Nebulo also lets you set different DNS providers for Wi‑Fi and cellular networks, which can be handy if you travel frequently.

Troubleshooting common issues

VPN does not start or immediately disconnect

• Battery optimization: Some manufacturers (e.g., Xiaomi, Huawei) aggressively kill background VPN services. Open Settings > Battery > Battery optimization, find Intra, and set it to Not optimized.
• Conflicting VPN apps: Only one VPN can be active at a time. If you have a corporate VPN, a game‑related VPN, or a hotspot tethering app running, pause or disable them before starting Intra.
• Network change: Switching from Wi‑Fi to cellular (or vice‑versa) can briefly drop the VPN. Simply toggle Intra off and on again.

Some apps lose connectivity after enabling "Block unencrypted DNS"

• Open Intra, go to Settings > Exclusions, and add the problematic app to the list. This tells Intra to let the app use the system DNS (still encrypted via DoH if the app itself supports it) or to bypass the block entirely.
• If the app is a banking or payment app that refuses any VPN, you may need to temporarily disable Intra while using that service.

DNS resolution is slow or fails

• Test another DoH provider – latency can vary by region. Cloudflare is fast in many areas, but Quad9 or Google may be quicker for you.
• Check your internet connection; DoH requires a stable TCP/HTTPS link. A weak cellular signal can cause timeouts.
• Restart the device to clear any lingering network caches.

Maintenance tips

• Periodically open Intra and verify that the Provider field still shows the correct URL. Providers occasionally change endpoints.
• When you receive a system update, revisit the app’s permissions. Android sometimes revokes VPN permissions after a major OS upgrade.
• If you travel to a country with heavy internet censorship, consider switching to a DoH provider that supports DNS‑over‑TLS fallback, or combine Intra with a trusted VPN for full traffic encryption.

When to consider a full VPN instead of DoH only

DoH protects only the DNS lookup phase. Your actual data packets (HTTP, video streams, etc.) remain visible to your ISP or network observer. If you need to hide the content of your traffic, use a reputable VPN in addition to DoH. Intra’s VPN is lightweight and does not encrypt the payload, so it complements—not replaces—a full‑tunnel VPN.

Wrap‑up

By installing a free app like Intra or Nebulo and enabling its local VPN, you can secure every DNS request on your Android phone with DNS‑over‑HTTPS—no root, no custom ROM, and no complicated network configuration. The approach works across most manufacturers, respects battery life, and can be toggled on or off in a single tap. Keep the troubleshooting tips handy, and you’ll enjoy private, encrypted name resolution wherever you go.