Run a Local DNS‑over‑HTTPS Resolver on Android Using Termux (No Root)

Many Android users want every app and website to use encrypted DNS (DoH/DoT) but don’t want to rely on a third‑party app that may request extra permissions. By running dnscrypt‑proxy inside Termux you can create a local DNS‑over‑HTTPS resolver that listens on 127.0.0.1:53. Android’s built‑in Private DNS feature can then point to this local address, giving you system‑wide DNS encryption without rooting or installing any UI‑heavy apps.

Before you start

• Device requirements: Android 9 (Pie) or newer – Private DNS was introduced in Android 9. The steps also work on Android 10‑13, though menu wording may differ slightly.
• Internet connection: You need Wi‑Fi or mobile data to download Termux packages and the DoH server list.
• Battery: Keep the device plugged in or ensure at least 50 % charge; the resolver will stay active as long as Termux is running.
• Permissions: Termux will request storage access the first time you launch it. Grant the permission so you can edit configuration files.
• Backup: This tutorial does not modify system partitions, but it’s good practice to back up important data before changing DNS settings.

Step 1 – Install Termux and update the package index

1. Open the Google Play Store (or F-Droid) and install Termux. The F‑Droid version receives updates more frequently.
2. Launch Termux. The first run will set up the environment and ask for storage permission – type yes when prompted.
3. Update the package repository to the latest versions:

   pkg update && pkg upgrade -y

   This may take a few minutes.

Step 2 – Install required packages

dnscrypt‑proxy depends on a few utilities. Install them with a single command:

pkg install -y dnscrypt-proxy curl jq

If dnscrypt-proxy is not found in the default repository (some Termux releases), you can install it from the unstable-repo:

pkg install -y unstable-repo
pkg install -y dnscrypt-proxy

Step 3 – Choose a DoH server list

dnscrypt‑proxy ships with a list of public resolvers. We’ll pick a DoH‑only server for maximum privacy. The list is stored in /data/data/com.termux/files/usr/etc/dnscrypt-proxy.

1. Navigate to the configuration directory:

   cd $PREFIX/etc/dnscrypt-proxy

2. Open the server list with nano (or vim if you prefer):

   nano dnscrypt-resolvers.md

3. Search for entries that have type: "doh". Example entries:

   - name: cloudflare-dns.com
     stamp: "sdns://..."
     dnssec: true
     doH: true
     description: "Cloudflare DNS over HTTPS"
   

4. Pick one you trust (e.g., cloudflare-dns.com or dns.google). Remember the name value – you’ll need it in the next step.

Step 4 – Configure dnscrypt‑proxy to listen only on localhost

By default dnscrypt‑proxy may bind to all interfaces, which could expose the resolver to other devices on the network. We’ll restrict it to 127.0.0.1 and port 53 (the standard DNS port).

1. Edit the main configuration file:

   nano dnscrypt-proxy.toml

2. Find the listen_addresses line. If it’s commented out, uncomment and set it to:

   listen_addresses = ['127.0.0.1:53']

3. Locate the server_names array. Replace the default value with the name you chose in Step 3, e.g.:

   server_names = ['cloudflare-dns.com']

4. Save the file (Ctrl+O, Enter) and exit nano (Ctrl+X).

Step 5 – Start dnscrypt‑proxy and verify it works

1. Run the resolver in the foreground first to see any error messages:

   dnscrypt-proxy -config $PREFIX/etc/dnscrypt-proxy/dnscrypt-proxy.toml

   You should see a line similar to:

   dnscrypt-proxy[12345]: listening on 127.0.0.1:53 (UDP/TCP)

2. Open a new Termux session (swipe from left edge) and test DNS resolution using dig (install it if missing):

   pkg install -y dnsutils
    dig @127.0.0.1 example.com +short

   You should receive the IP address of example.com. If you get connection timed out, double‑check the listen_addresses setting and ensure no other app is already using port 53.
3. Once you’ve confirmed it works, stop the foreground process (Ctrl+C) and set it up as a background service. Create a simple script:

   cat > $HOME/start-dnscrypt.sh <<'EOF'
   #!/data/data/com.termux/files/usr/bin/bash
   nohup dnscrypt-proxy -config $PREFIX/etc/dnscrypt-proxy/dnscrypt-proxy.toml &>/dev/null &
   EOF
   chmod +x $HOME/start-dnscrypt.sh

   Run it:

   ~/start-dnscrypt.sh

   The resolver now runs silently in the background.

Step 6 – Point Android’s Private DNS to the local resolver

Android’s Private DNS feature expects a hostname that resolves to a DoT/DoH server. However, it also accepts localhost when you manually edit the system DNS settings via Wi‑Fi. We’ll use the Wi‑Fi advanced settings to force DNS to 127.0.0.1.

1. Open Settings → Network & internet → Wi‑Fi.
2. Long‑press your active network and choose Modify network (or the gear icon on newer Android versions).
3. Expand Advanced options and set IP settings to Static. (Don’t worry – you’ll keep the original IP address; we’re only changing DNS.)
4. Scroll down to the DNS fields and replace both entries with 127.0.0.1. Leave the rest of the network configuration untouched.
5. Save the changes. Android will now send all DNS queries to the local resolver.

   If you switch between Wi‑Fi networks frequently, you’ll need to repeat this step for each network. Alternatively, you can use a VPN‑style app that forces DNS to a specific address, but that would add a third‑party component.

Step 7 – Verify system‑wide DNS encryption

To confirm that Android is really using your local DoH resolver, perform a DNS‑leak test.

1. Open the browser and navigate to dnsleaktest.com (or any similar service).
2. Run the “Standard test”. The result should show the name of the DoH provider you selected (e.g., Cloudflare) and not your ISP’s DNS servers.
3. For an extra check, use dig again, but this time without specifying an address. The query will travel through Android’s DNS stack to your local resolver:

   dig example.com +short

   The answer should match the earlier test.

Step 8 – Keep dnscrypt‑proxy running after a reboot

Termux sessions disappear when the device restarts. To automate the start‑up, use Termux’s boot add‑on.

1. Install the add‑on from F‑Droid or the Play Store: Termux:Boot.
2. Open Termux and create a ~/.termux/boot directory if it doesn’t exist:

   mkdir -p ~/.termux/boot

3. Copy the start script into that folder and make sure it’s executable:

   cp $HOME/start-dnscrypt.sh ~/.termux/boot/

4. Reboot the device. After the boot completes, open Termux and run ps | grep dnscrypt-proxy to confirm the process is running.

Alternative: Using a DoT server instead of DoH

If you prefer DNS‑over‑TLS (DoT) because your chosen provider only offers it, you can still use dnscrypt‑proxy. The configuration steps are identical; just pick a resolver with type: "dot" in the dnscrypt-resolvers.md file. The rest of the workflow stays the same.

Troubleshooting

• Port 53 already in use: Some OEM ROMs ship a built‑in DNS cache that binds to 53. If you see an error like address already in use, change the listen port in dnscrypt-proxy.toml to 5353 and update the Wi‑Fi DNS entries accordingly.
• No internet after changing DNS: Verify that the Wi‑Fi static IP configuration still matches your network’s subnet. A typo in the IP address will break connectivity.
• Resolver fails to start after reboot: Ensure Termux:Boot has the READ_PHONE_STATE permission (Settings → Apps → Termux:Boot → Permissions). Without it, the boot script may be killed.
• Queries still go to ISP DNS: Some manufacturers force a private DNS server when “Private DNS” is set to “Automatic”. Disable Private DNS (Settings → Network & internet → Private DNS → Off) and rely solely on the Wi‑Fi static DNS entries.

Security and privacy considerations

• The resolver runs in user space, so it cannot intercept DNS traffic from apps that use VpnService to tunnel DNS elsewhere. Most apps use the system resolver, which is now encrypted.
• Because the resolver is local, your device’s IP address is never exposed to the DoH provider beyond the encrypted request – this is the same privacy model as native Private DNS.
• Keep dnscrypt‑proxy up to date (run pkg upgrade dnscrypt-proxy periodically) to receive security patches and updated resolver lists.

Wrap‑up

By following these steps you have turned an ordinary Android phone into a self‑contained DNS‑over‑HTTPS gateway. The solution respects the No Root constraint, avoids third‑party apps with opaque permissions, and gives you full control over which DNS provider encrypts your queries. If you ever need to switch providers, just edit dnscrypt-proxy.toml and restart the script – the rest of the system stays untouched.

Enjoy a more private browsing experience on Android, and feel free to experiment with other dnscrypt‑proxy features such as blocking known malicious domains or enabling DNSSEC validation.