Set Up a DNS‑over‑HTTPS Resolver on Android with dnscrypt‑proxy (No Root)

Why Use DNS‑over‑HTTPS on Android?

Standard DNS queries travel in clear text, allowing anyone on the same network—Wi‑Fi routers, ISPs, or malicious hotspots—to see which domains you request. DNS‑over‑HTTPS (DoH) encrypts those queries, protecting privacy and reducing the chance of DNS‑based attacks. Running a dnscrypt‑proxy instance locally gives you full control over which DoH server you trust, without needing a rooted device.

Before You Start

• Device requirements: Android 9 (Pie) or newer for native Private DNS support. Older versions can use a third‑party app like Intra.
• Apps needed: Termux (available on Google Play) and optionally Termux:Boot for auto‑start.
• Network: A stable Wi‑Fi or mobile data connection for downloading packages.
• Backup: While this tutorial does not modify system partitions, it changes your DNS settings. Note your current Private DNS mode (usually “Automatic”) so you can revert if needed.

Overview of the Process

1. Install and update Termux.
2. Install dnscrypt‑proxy inside Termux.
3. Configure dnscrypt‑proxy to listen on 127.0.0.1:53 and select a trusted DoH resolver.
4. Point Android’s Private DNS to localhost (or use a helper app on older Android).
5. Verify that DNS queries are now encrypted.
6. (Optional) Set the resolver to start automatically on boot.

Step 1 – Install Termux and Prepare the Environment

pkg update && pkg upgrade -y

pkg install wget curl git unzip -y

Step 2 – Get dnscrypt‑proxy Inside Termux

mkdir -p $HOME/dnscrypt-proxy && cd $HOME/dnscrypt-proxy

wget https://github.com/DNSCrypt/dnscrypt-proxy/releases/download/2.1.5/dnscrypt-proxy-linux-arm64-2.1.5.tar.gz

tar xzf dnscrypt-proxy-linux-arm64-2.1.5.tar.gz --strip-components=1

chmod +x dnscrypt-proxy

Step 3 – Configure dnscrypt‑proxy

cp example-dnscrypt-proxy.toml dnscrypt-proxy.toml

nano dnscrypt-proxy.toml

listen_addresses = ['127.0.0.1:53']

server_names = ['cloudflare']

require_dnssec = true
require_nolog = true

Step 4 – Run dnscrypt‑proxy and Test Locally

./dnscrypt-proxy -config dnscrypt-proxy.toml

pkg install dnsutils -y
 dig @127.0.0.1 example.com +short

Step 5 – Point Android’s DNS to the Local Resolver

Android 9+ includes a built‑in Private DNS feature that accepts a hostname. Unfortunately, it does not accept raw IP addresses. However, you can work around this by creating a local “hostname” using the dnscrypt‑proxy built‑in DNS‑over‑TLS server on a separate port, or by using an app that allows custom DNS servers.

Method A – Use Android’s Private DNS with a DoH hostname (simpler)

If you prefer not to run a local resolver, you can skip steps 2‑4 and directly set Private DNS to a trusted DoH provider (e.g., dns.cloudflare.com). This tutorial, however, demonstrates the local approach for maximum control.

Method B – Use a helper app (Intra) for pre‑Android‑9 devices

Install Intra (free, no‑root). Intra can forward DNS queries to 127.0.0.1:53. After installing:

1. Open Intra → Settings → DNS → Custom DNS.
2. Enter 127.0.0.1 and port 53.
3. Enable the service.

Now Android will route DNS through your local dnscrypt‑proxy instance.

Method C – Use Termux:Boot to start dnscrypt‑proxy on boot and keep it running

For a truly native solution on Android 9+, you can use the “Private DNS” field with a localhost hostname trick: create a tiny DNS‑over‑TLS server inside dnscrypt‑proxy that listens on 127.0.0.1:853 and then set Private DNS to localhost. This requires editing the config to enable the TLS listener:

# Add at the end of dnscrypt-proxy.toml
listen_addresses = ['127.0.0.1:53', '127.0.0.1:853']
# Enable TLS (DoT) for the second listener
tls_server_name = 'localhost'

After restarting the resolver, go to Settings → Network & internet → Private DNS → “Private DNS provider hostname” and type localhost. Android will now forward DNS over TLS to your local resolver.

Warning: Not all Android builds accept localhost as a valid hostname. If you get an error, fall back to Method B.

Step 6 – Verify That DNS Is Encrypted

pkg install tcpdump -y
 sudo tcpdump -i any port 443 -nn -vv

Optional – Auto‑Start dnscrypt‑proxy on Boot

If you want the resolver to be available after a reboot without manually launching Termux, install the Termux:Boot add‑on.

1. Install Termux:Boot from the Play Store.
2. Create a script in $HOME/.termux/boot (the folder is created automatically after first launch of Termux:Boot). Example script start-dnscrypt.sh:

#!/data/data/com.termux/files/usr/bin/bash
cd $HOME/dnscrypt-proxy
./dnscrypt-proxy -config dnscrypt-proxy.toml &

3. Make the script executable:

chmod +x $HOME/.termux/boot/start-dnscrypt.sh

4. Reboot the device. After the boot sequence, Termux:Boot will launch the script, and dnscrypt‑proxy will be listening on 127.0.0.1:53 automatically.

Tip: Use logcat | grep dnscrypt-proxy to verify that the service started correctly.

Troubleshooting Common Issues

• Port 53 already in use – Some VPN or ad‑blocking apps bind to port 53. Stop those apps or change the listen_addresses to an unused port (e.g., 127.0.0.1:5353) and adjust the Private DNS/Helper app accordingly.
• Private DNS rejects localhost – Android may require a fully qualified domain name. In that case, use Method B (Intra) or install a local DNS‑over‑TLS forwarder like stubby and point Private DNS to 127.0.0.1 on port 853.
• No response from dig – Verify that dnscrypt‑proxy is still running (use ps aux | grep dnscrypt). If it exited, run it again with the -config flag and check the console for error messages.
• Resolver reports “blocked” or “refused” – Some DoH providers block queries from non‑standard user‑agents. Ensure you are using a recent resolver version; updating the binary (download the latest release) often fixes this.
• Battery drain – Running a persistent network service can keep the radio active. Enable Android’s “Battery optimization” whitelist for Termux (Settings → Battery → Battery optimization → All apps → Termux → “Don’t optimize”).

Security and Privacy Considerations

• Only use DoH servers you trust. Public providers like Cloudflare, Google, and Quad9 publish transparency reports.
• Keep dnscrypt‑proxy up to date. The project releases security patches regularly.
• Running a local resolver means your device’s DNS queries never leave the phone unencrypted, but the upstream DoH server still sees the domain names. If you need end‑to‑end privacy, consider a VPN that supports DNS over TLS in addition to the local resolver.

Wrap‑Up

By following these steps you have turned an ordinary Android phone into a privacy‑focused DNS client without rooting. The local dnscrypt‑proxy instance encrypts every DNS lookup, giving you visibility into which resolver you trust and the flexibility to switch providers at any time. Because everything runs inside Termux, you can easily script changes, add blocklists, or integrate the resolver into other Termux‑based networking projects.

Enjoy a safer browsing experience, and feel free to experiment with custom blocklists or alternative DoH endpoints to tailor the DNS behavior to your needs.