Home Page » News » Tutorials » How to Turn Your Android Phone into a DNS‑over‑HTTPS Resolver with dnscrypt‑proxy (No Root)

Turn Android into a DNS‑over‑HTTPS Resolver Using dnscrypt‑proxy

16 min read Learn step‑by‑step how to install dnscrypt‑proxy on Android via Termux, configure it as a local DoH resolver, and route all device traffic through it without rooting. October 12, 2026 05:00

Before you start

This guide assumes you have a device running Android 8.0 (Oreo) or newer. All steps are performed without root access, using Termux – a terminal emulator that runs a minimal Linux environment on Android.

Battery: Keep the phone plugged in or at least 70 % charged.
Network: Use a stable Wi‑Fi connection; mobile data may incur extra charges when testing DNS queries.
Backup: Although the procedure does not touch system partitions, it is good practice to back up any important data.
Permissions: You will need to grant Termux permission to access storage (for configuration files) and to allow network access.

Overview of the process

We will install dnscrypt-proxy inside Termux, configure it to use a public DNS‑over‑HTTPS (DoH) resolver, and then point Android’s network settings to the local address 127.0.0.1. The result is that every DNS request from apps and browsers will be encrypted, protecting you from ISP‑level snooping and many forms of DNS‑based attacks.

Step 1 – Install Termux and update the package repository

Open the Google Play Store (or F-Droid) and install Termux. The F‑Droid version is recommended for the latest updates.
Launch Termux. The first launch will set up a minimal Linux filesystem.
Update the package list and upgrade existing packages:
```
pkg update && pkg upgrade -y
```
This may take a few minutes as it downloads the latest repositories.
Install the proot-distro helper (optional but useful for managing isolated Linux distributions later):
```
pkg install proot-distro -y
```

Step 2 – Install required tools

Install git and curl – they will be used to fetch the dnscrypt‑proxy source and configuration files:
```
pkg install git curl -y
```
Install the dnscrypt-proxy binary from the official releases. The easiest way is to download a pre‑compiled static binary for Android (ARM64 or ARMv7 depending on your device). Determine your architecture with:
```
uname -m
```
Typical outputs:
- aarch64 → ARM64
- armv7l → 32‑bit ARM

Download the matching binary. Replace {arch} with aarch64 or armv7 as appropriate:

curl -L -o dnscrypt-proxy.tar.gz https://github.com/DNSCrypt/dnscrypt-proxy/releases/download/2.1.5/dnscrypt-proxy-linux-{arch}.tar.gz

Extract the archive and move the executable to a directory in your $PATH:

tar xzf dnscrypt-proxy.tar.gz
mv dnscrypt-proxy /data/data/com.termux/files/usr/bin/
chmod +x /data/data/com.termux/files/usr/bin/dnscrypt-proxy

Verify the installation:
```
dnscrypt-proxy -version
```
You should see the version string printed.

Step 3 – Obtain a DoH server list and create a configuration

dnscrypt‑proxy ships with a dnscrypt-resolvers.md file that lists many public DNS servers, including DoH endpoints. Copy the example configuration to your home directory:
```
cp /data/data/com.termux/files/usr/share/dnscrypt-proxy/dnscrypt-proxy.toml ~/dnscrypt-proxy.toml
```
Edit the configuration file with nano (installed by default) or vim:
```
nano ~/dnscrypt-proxy.toml
```
Locate the listen_addresses line and set it to the loopback interface:
```
listen_addresses = ['127.0.0.1:53']
```
This tells dnscrypt‑proxy to listen on the standard DNS port (53) but only on the local device.
Find the server_names section. Replace the default list with a DoH‑only server, for example Cloudflare’s DoH endpoint:
```
server_names = ['cloudflare']
```
Optional – enable DNSSEC validation for extra security by ensuring the following line is present and not commented:
```
require_dnssec = true
```
Save the file (Ctrl+O, Enter) and exit (Ctrl+X).

Step 4 – Test the resolver locally

Start dnscrypt‑proxy in the background:
```
dnscrypt-proxy -config ~/dnscrypt-proxy.toml &
```
The ampersand runs the process in the background, returning you to the shell prompt.
Install dig (part of the dnsutils package) to test queries:
```
pkg install dnsutils -y
```
Run a test query against the local resolver:
```
dig @127.0.0.1 example.com +tls
```
If everything works, you will see an answer section with the IP address of example.com. The +tls flag forces an encrypted query to the local proxy, which then forwards it over DoH.
If you get “connection timed out” or “no answer”, verify that the background process is still running:
```
ps | grep dnscrypt-proxy
```

Step 5 – Make dnscrypt‑proxy start automatically on boot

Termux provides a termux-wake-lock and a termux-boot package that runs scripts after device boot. Install it:
```
pkg install termux-services termux-boot -y
```

Create a startup script in the ~/.termux/boot directory:

mkdir -p ~/.termux/boot
cat > ~/.termux/boot/start-dnscrypt.sh <<'EOF'
#!/data/data/com.termux/files/usr/bin/sh
# Start dnscrypt-proxy with our custom config
dnscrypt-proxy -config ~/dnscrypt-proxy.toml &
EOF
chmod +x ~/.termux/boot/start-dnscrypt.sh

Reboot the device to verify that the script runs automatically. After reboot, repeat the dig test from Step 4.

Step 6 – Point Android’s DNS to the local resolver

Open Settings → Network & Internet → Wi‑Fi.
Long‑press the Wi‑Fi network you are connected to and choose Modify network (or the gear icon on newer Android versions).
Expand Advanced options.
- Set IP settings to Static. (Don’t worry – you will keep the existing IP address, gateway, and DNS values.)
- In the DNS 1 field, enter 127.0.0.1. Leave DNS 2 empty.
Save the changes. Android will now send DNS queries to the local address where dnscrypt‑proxy is listening.
To verify, open a browser and visit https://www.cloudflare.com/cdn-cgi/trace. The page shows the ip and dns fields; the dns value should be 127.0.0.1, confirming that the device is using the local resolver.

Changing the IP settings to static may break automatic IP address assignment on some networks. If you lose connectivity, simply revert the changes or re‑select “DHCP”.

Step 7 – Optional: Use NetGuard to keep the resolver reachable when the device is on mobile data

Install NetGuard (free, no‑root firewall).
In NetGuard’s interface, enable the toggle for dnscrypt-proxy (it appears as “Termux”). This ensures that the app can receive inbound connections on 127.0.0.1 even when the device switches from Wi‑Fi to mobile data.
When you switch to mobile data, Android does not expose the loopback address to the system DNS resolver. NetGuard creates a virtual VPN that forwards traffic to the local service, keeping DoH active across networks.

Troubleshooting

1. No DNS resolution after setting 127.0.0.1

Check that dnscrypt‑proxy is running: ps | grep dnscrypt-proxy. If not, start it manually and watch the console output for errors.
Port conflict: Some devices already run a DNS forwarder on port 53 (e.g., certain VPN apps). Edit listen_addresses in the TOML file to use an alternate port, such as 127.0.0.1:5353, and update the Wi‑Fi DNS entry accordingly.
SELinux enforcement: On some OEM skins, SELinux may block Termux from binding to low ports. If you see “Permission denied”, switch to a higher port (e.g., 5353) as above.

2. dnscrypt‑proxy crashes with “cannot resolve resolver list”

Make sure the device has internet access when the proxy starts. The binary downloads the resolver list on first launch; a blocked network will cause a failure.
If you are behind a captive portal (hotel Wi‑Fi), connect to a regular network first, let dnscrypt‑proxy download its files, then switch back.

3. DNS queries are still sent to the ISP

Some Android versions (especially Samsung One UI) cache the DNS server at the system level. Disable “Smart DNS” or “Private DNS” in Settings > Network & Internet > Private DNS.
Re‑boot the device after changing the Wi‑Fi DNS fields. The system reloads the resolver list on boot.

4. Battery drain concerns

Running a background service continuously will keep the CPU awake occasionally. Use Termux’s termux-wake-lock only when you need the resolver; otherwise, stop the process with pkill dnscrypt-proxy when you are on a trusted network.
NetGuard’s VPN mode also consumes a small amount of power; monitor battery usage in Settings > Battery.

Advanced tweaks

Multiple DoH providers: In the TOML file, list more than one server in server_names (e.g., ['cloudflare','quad9']) and enable fallback_resolvers to improve reliability.
Custom blocklists: dnscrypt‑proxy supports blocked_names and blocked_ips. Add domains you want to force‑block (e.g., ad‑servers) to blocked_names for an on‑device ad‑blocking solution.
Logging: Enable logfile = '/data/data/com.termux/files/home/dnscrypt-proxy.log' to keep a record of queries. Useful for debugging but may expose browsing patterns – keep the file encrypted if privacy is a concern.

Why this matters

Standard DNS queries travel in clear text, allowing anyone on the same network (public Wi‑Fi, ISP, or malicious hotspot) to see which domains you are contacting. By converting your phone into a local DoH resolver, you gain two layers of protection:

Encryption between your device and the DoH provider: Cloudflare, Quad9, and others support HTTPS, preventing eavesdropping.
Integrity verification via DNSSEC: When require_dnssec = true is set, the resolver validates signed records, protecting against DNS spoofing attacks.

The solution runs entirely in user space, requires no rooting, and can be toggled on or off with a single command, making it suitable for privacy‑conscious users who travel frequently.

Cleaning up

If you decide the resolver is no longer needed, you can remove it cleanly:

Stop the background process: pkill dnscrypt-proxy

Delete the binary and configuration:

rm /data/data/com.termux/files/usr/bin/dnscrypt-proxy
rm ~/dnscrypt-proxy.toml

Remove the boot script: rm ~/.termux/boot/start-dnscrypt.sh
Re‑configure your Wi‑Fi DNS settings back to “Automatic”.

Your device will return to the default DNS behavior instantly.

Wrap‑up

By following the steps above you have turned an ordinary Android phone into a privacy‑enhancing DNS‑over‑HTTPS resolver without needing root access. The approach leverages Termux’s lightweight Linux environment, the well‑maintained dnscrypt-proxy project, and Android’s native network configuration UI. You can now browse, stream, and use apps knowing that the DNS layer of your connection is encrypted and authenticated.

For users who frequently switch between networks, consider creating two Termux aliases – one that starts dnscrypt‑proxy with the default configuration, and another that stops it – to streamline the workflow.

alias startdns='dnscrypt-proxy -config ~/dnscrypt-proxy.toml &'
alias stopdns='pkill dnscrypt-proxy'

User Comments (0)

Add Comment

No comments added yet.

Add Comment

Your Name: *

Comment Title: *

Your E-mail: * We'll never share your email with anyone else.

Your Comment: *

Comments will not be approved to be posted if they are SPAM, abusive, off-topic, use profanity, contain a personal attack, or promote hate of any kind.