Home Page » News » Tutorials » How to Set Up a Local DNS Resolver on Android Using Dnsmasq (No Root)

Set Up a Local DNS Resolver on Android with Dnsmasq (No Root)

11 min read Learn to run a local DNS resolver on Android with Termux and Dnsmasq, without rooting. Step‑by‑step guide for privacy‑focused users. October 03, 2026 06:00

Why run a local DNS resolver on Android?

Every time your phone looks up a website, it asks a DNS server for the IP address. The default DNS servers are usually provided by your carrier or Wi‑Fi router. Using a local resolver gives you three practical benefits:

Privacy: Queries never leave your device unless you forward them to an upstream server you trust.
Speed: Frequently visited domains are cached locally, cutting round‑trip time.
Control: You can add custom blocklists (e.g., for ads or trackers) directly in the resolver.

All of this can be achieved on a stock Android device without rooting, thanks to the lightweight dnsmasq package that runs inside Termux.

Note: Without root you cannot replace the system‑wide DNS settings directly. The guide shows two practical ways to make apps use the local resolver: (1) configure the Wi‑Fi network to point to 127.0.0.1 where supported, or (2) run a simple VPN that forwards DNS queries to dnsmasq. The VPN method works on virtually every device.

Before you start

Charge your phone to at least 50 % or keep it plugged in.
Connect to a stable Wi‑Fi network (cellular data may be throttled for DNS traffic).
Install Termux from F‑Droid (recommended for up‑to‑date packages) or Google Play.
Optional but helpful: install Termux:API for later VPN setup.

Step 1 – Prepare Termux

Open Termux and run the initial update commands:
```
pkg update && pkg upgrade -y
```
Install the core utilities you will need:
```
pkg install nano wget curl proot -y
```
Verify that the termux-wake-lock permission is granted (prevents the session from sleeping while dnsmasq runs). In Termux run:
```
termux-wake-lock
```
You can later release it with termux-wake-unlock.

These commands are safe on any Android version that supports Termux (Android 5.0+).

Step 2 – Install Dnsmasq

Install the dnsmasq package from the Termux repository:
```
pkg install dnsmasq -y
```
Confirm the binary is available:
```
which dnsmasq
```
You should see something like /data/data/com.termux/files/usr/bin/dnsmasq.

If the package cannot be found, run pkg install root-repo first – the dnsmasq binary lives in the root repository.

Step 3 – Create a basic dnsmasq configuration

Open a new configuration file with nano:
```
nano ~/dnsmasq.conf
```

Paste the following minimal configuration (feel free to adjust the paths later):

# Listen only on the loopback interface – keeps the resolver local
interface=lo
listen-address=127.0.0.1

# Cache size – 1000 entries is a good balance for a phone
cache-size=1000

# Use Google’s DNS over TLS as upstream (privacy‑preserving)
server=8.8.8.8#853
server=8.8.4.4#853

# Optional: load a hosts file for ad‑blocking (see step 4)
#addn-hosts=/data/data/com.termux/files/home/ads-hosts.txt

Save and exit (Ctrl + O, Enter, Ctrl + X).

This configuration tells dnsmasq to accept queries on 127.0.0.1, cache up to 1000 entries, and forward unknown names to Google’s DNS‑over‑TLS servers (port 853). Using TLS protects the upstream traffic from eavesdropping.

Step 4 – (Optional) Add a simple ad‑blocking hosts file

Download a public hosts list that contains known ad domains. For example:

wget -O ~/ads-hosts.txt https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts

Uncomment the addn-hosts line in ~/dnsmasq.conf (see step 3) and point it to the file you just downloaded.
Restart dnsmasq later (step 6) to apply the blocklist.

Because the list is stored locally, lookups for blocked domains are resolved instantly, saving data and improving page load times.

Step 5 – Start dnsmasq manually

Run dnsmasq with the configuration you created:
```
dnsmasq -C ~/dnsmasq.conf -k
```
The -k flag keeps dnsmasq in the foreground, which is useful for debugging.
You should see a line similar to:
```
dnsmasq: started, version 2.86 cachesize 1000, DNS servers 8.8.8.8#853, 8.8.4.4#853
```
If you see errors about “permission denied”, ensure Termux has storage permission (termux-setup-storage) and that the configuration file is readable.
Leave this terminal window open. dnsmasq will continue to run until you close the session or press Ctrl + C.

At this point the resolver is active on 127.0.0.1, but Android is still using the network‑provided DNS servers.

Step 6 – Route Android DNS queries to the local resolver

Because you cannot change the system DNS without root, you have two practical options.

Option 1 – Wi‑Fi network custom DNS (when supported)

Open Settings > Network & internet > Wi‑Fi.
Long‑press the connected network and choose Modify network (or the gear icon).
Tap Advanced options → IP settings → change from DHCP to Static.
Scroll down to the DNS fields and replace both entries with 127.0.0.1.
Save the changes.

Some Android skins (e.g., Pixel, OnePlus) accept 127.0.0.1 as a custom DNS. If the network refuses the address, use Option 2.

Option 2 – Simple VPN that forwards DNS to localhost

We will use the open‑source Termux:API helper termux-vpn (available in the termux-api package). The VPN runs in user space and does not require root.

Install the API package:
```
pkg install termux-api -y
```

Create a tiny VPN script that forwards DNS to 127.0.0.1. Save it as ~/dns-vpn.sh:

cat > ~/dns-vpn.sh <<'EOF'
#!/data/data/com.termux/files/usr/bin/bash
# Start a dummy VPN that only redirects DNS to 127.0.0.1
# The VPN interface will be tun0
termux-vpn -a tun0 -p 0 -d 127.0.0.1:53
EOF
chmod +x ~/dns-vpn.sh

Run the script in a new Termux session (you can split the screen with tmux if you like):
```
./dns-vpn.sh
```
You should see a message like “VPN started on tun0”.
Leave this session running. All DNS queries from apps will now be sent through the VPN tunnel to 127.0.0.1:53, where dnsmasq answers them.

If the VPN fails to start, make sure you have granted Termux the “Display over other apps” and “VPN” permissions. Android will prompt you the first time the script runs.

Step 7 – Verify the resolver works

Open a new Termux window and run a DNS lookup against the local server:
```
dig @127.0.0.1 example.com +short
```
You should receive the IP address of example.com. If you see “connection timed out”, double‑check that dnsmasq is still running and that the VPN (Option 2) or Wi‑Fi DNS setting (Option 1) points to 127.0.0.1.
On the Android side, open a browser and visit a site you know is blocked by your ad‑hosts file (e.g., ads.example.com). The page should fail to load, confirming the blocklist is active.
To see the cache in action, run the same dig command twice and note the response time. The second query should be virtually instantaneous.

Troubleshooting

Dnsmasq won’t start – “address already in use”: Another app (often a VPN) is already listening on port 53. Stop that app or change the dnsmasq listening port (e.g., listen-address=127.0.0.1#5353) and adjust the VPN script accordingly.
VPN refuses to start – “Permission denied”: Go to Settings > Apps > Termux > Permissions and enable “VPN”. Also ensure “Battery optimization” is turned off for Termux, otherwise Android may kill the process.
Websites load slowly or fail: Verify that the upstream DNS servers are reachable (ping 8.8.8.8). If your network blocks DNS‑over‑TLS, replace the server=…#853 lines with plain DNS (port 53) or use Cloudflare’s 1.1.1.1.
Ad‑blocking not effective: Make sure the addn-hosts line in dnsmasq.conf is uncommented and points to the correct file. Restart dnsmasq after any change.

Keeping dnsmasq running in the background

Manually keeping the terminal open works, but you may want a more hands‑free approach.

Install tmux (pkg install tmux -y) and start a session:
```
tmux new -s dns
```
Inside the tmux window, launch dnsmasq as in Step 5.
Detach from the session with Ctrl + B, D. The process keeps running even if you close the Termux UI.
To re‑attach later, run tmux attach -t dns.

For a fully automated start‑up, you can add the dnsmasq command to Termux’s ~/.bashrc or create a small cron job using the cronie package, but be aware that Android may still kill background processes to save battery.

When to stop the resolver

If you switch to a different Wi‑Fi network that does not allow custom DNS, or if you need to conserve battery, stop the services:

# Stop dnsmasq (if running in foreground, press Ctrl+C)
# Stop the VPN
pkill -f termux-vpn
# Release the wake lock
termux-wake-unlock

Summary

By installing Termux, adding dnsmasq, and routing DNS traffic through a local VPN or Wi‑Fi custom DNS, you gain a privacy‑first, cache‑enabled DNS resolver without ever rooting your device. The setup is reversible, works on Android 5.0+, and can be extended with custom blocklists or alternative upstream providers.

Tip: Pair this resolver with AdGuard Home on a home server for network‑wide ad blocking, and let your phone use the same upstream DNS for a consistent experience.

User Comments (0)

Add Comment

No comments added yet.

Add Comment

Your Name: *

Comment Title: *

Your E-mail: * We'll never share your email with anyone else.

Your Comment: *

Comments will not be approved to be posted if they are SPAM, abusive, off-topic, use profanity, contain a personal attack, or promote hate of any kind.