Every time you type a web address or an app connects to a server, your phone first asks a DNS server to translate that name into an IP address it can actually reach. By default, this request travels unencrypted, visible to your internet provider and anyone else positioned to see your network traffic.
Private DNS closes that gap. It encrypts the DNS lookup itself, so the sites and apps you’re connecting to aren’t visible to your provider the way they normally would be.
This isn’t the same as a VPN, and it’s worth understanding the difference before setting it up. Private DNS only encrypts the lookup step, not your actual browsing traffic afterward. It’s a narrower, lighter-weight privacy improvement, not a full replacement for a VPN if that’s what you actually need.
What Private DNS Actually Protects Against
Without Private DNS, your provider can see every domain you look up, even if the connection to that site itself is encrypted through HTTPS. This is a genuine privacy gap: your provider might not see what you did on a site, but they can see that you visited it at all.
Private DNS, using a protocol called DNS-over-TLS, encrypts this lookup specifically. Your provider still sees that your phone is making encrypted DNS requests, but not which domains those requests are for.
It also protects against a specific kind of interference some networks apply: DNS-based content blocking or redirection, sometimes used by public Wi-Fi networks, some countries, or even some ISPs for advertising injection.
Setting Up Private DNS
Android has built this in natively since Android 9, so no separate app is needed for the basic setup.
- Go to Settings, then Network & Internet.
- Tap Private DNS (on some phones this is under a Connections or More Connection Settings submenu instead).
- Select “Private DNS provider hostname.”
- Enter a provider’s hostname. Common choices include dns.google for Google’s own service, or one.one.one.one for Cloudflare.
- Tap Save.
That’s the entire setup. Android will confirm the connection and start using it immediately for all DNS lookups on that connection, both Wi-Fi and mobile data.
Choosing a Private DNS Provider
The hostname you enter determines which company is handling your DNS lookups, so it’s worth choosing deliberately rather than picking the first name that comes up in a search.
- Cloudflare (one.one.one.one) is widely regarded as fast and has a published, audited privacy policy specifically promising not to retain logs tied to your identity beyond a short window.
- Google (dns.google) is fast and reliable, though Google’s broader business model around data means some privacy-focused users prefer an alternative, even though Google’s public DNS privacy policy is reasonably strict on its own.
- Quad9 (dns.quad9.net) adds built-in malicious domain blocking on top of standard DNS resolution, automatically blocking known malware and phishing domains at the lookup level.
- NextDNS offers a customizable service with its own hostname, letting you block ad and tracking domains specifically as part of the DNS resolution itself, though it requires creating a free account to get your personalized hostname.
Verifying Private DNS Is Actually Working
After setup, it’s worth confirming the connection actually succeeded rather than assuming it did. Go back to Settings, Network & Internet, Private DNS, and check the status shown beneath your entered hostname.
A working connection shows something like “Connected” directly. If it shows an error or fails to connect, the specific hostname may be blocked on your current network, some corporate and school networks specifically block DNS-over-TLS traffic, or you may have a typo in the hostname itself.
You can also verify independently using a browser-based DNS leak test site, which shows which DNS provider your connection is actually using at that moment, confirming it matches the provider you configured.
What Happens on Networks That Block Private DNS
Some networks, particularly corporate, school, and certain public Wi-Fi networks, deliberately block the specific port Private DNS uses, since it interferes with their own network monitoring or content filtering policies.
When this happens, Android generally falls back to standard, unencrypted DNS automatically rather than losing internet access entirely, though this depends on your phone’s specific fallback behavior. If you notice internet access breaking entirely on a specific network after enabling Private DNS, temporarily setting it to “Off” or “Automatic” for that network is the practical workaround.
Private DNS Versus a VPN: When Each Actually Matters
Private DNS is worth using essentially always, since it has minimal downside and closes a real privacy gap in normal browsing. A VPN is a different, heavier tool, worth using specifically when you need your actual browsing traffic hidden from your network provider, not just the DNS lookups.
Using both together is common and reasonable: Private DNS for everyday use, with a VPN added specifically when you’re on an untrusted network, like public Wi-Fi, or when you specifically need to hide your traffic content, not just your lookups, from whoever operates the network you’re on.
Understanding DNS-over-TLS Versus DNS-over-HTTPS
Android’s built-in Private DNS setting specifically uses DNS-over-TLS, one of two competing encrypted DNS standards. The other, DNS-over-HTTPS, is more commonly used within individual browsers like Chrome and Firefox rather than at the system level.
This distinction matters because a browser configured with its own DNS-over-HTTPS setting, separate from your phone’s system-wide Private DNS, can sometimes create confusing situations where your browser uses one DNS provider while every other app uses a different one set at the system level.
If you’ve enabled a DNS-over-HTTPS provider within Chrome specifically, under Chrome’s own Settings, Privacy and Security, Secure DNS, this operates independently of your phone’s Private DNS setting. For consistency across all apps, it’s simpler to rely on the system-wide Private DNS setting alone and leave the browser’s own secure DNS setting on its default, letting it inherit from the system.
How This Affects Smart Home Devices and IoT Traffic on Your Network
It’s worth being clear that Private DNS configured on your Android phone only affects that specific phone’s own DNS lookups. It does nothing for other devices on your home network, smart speakers, smart TVs, or other phones, unless each device is configured separately.
For network-wide encrypted DNS covering every device in your home, the setting needs to be configured at the router level instead, a separate and more involved process than the phone-level setup covered in this guide, and one that depends heavily on your specific router’s capabilities.
Checking Whether Your Carrier Already Provides Some DNS Privacy
A small number of carriers have begun offering their own encrypted DNS by default on mobile data connections specifically, separate from anything you’d configure manually. This is still uncommon, but worth being aware of, since it means Private DNS might provide less additional benefit specifically on mobile data if your carrier already handles this.
There’s no easy way to check this directly from your phone’s settings. Searching your specific carrier’s name alongside “encrypted DNS” or “DNS over TLS” in their published network documentation is the most reliable way to find out whether this applies to your account.
Frequently Asked Questions
Does Private DNS slow down my browsing?
Generally no, and with fast providers like Cloudflare it can sometimes feel slightly faster than your default ISP DNS, though the difference is usually small enough not to notice in everyday use.
Can I use Private DNS with an ad-blocking DNS provider to block ads system-wide?
Yes, this is one of the more popular reasons people set it up specifically. Providers like NextDNS or AdGuard DNS block known ad and tracker domains at the lookup level, which blocks ads within apps too, not just web browsers, something a browser-only ad blocker can’t achieve.
Does Private DNS work while using mobile data, or only on Wi-Fi?
It works on both, since it’s a system-level Android setting applied to all network connections, not something tied to a specific Wi-Fi network’s own configuration.
How Private DNS Differs From “Adaptive” Mode
Android’s Private DNS settings screen offers three options, not just Off and a manual hostname: Off, Automatic, and Private DNS provider hostname. It’s worth understanding what “Automatic” actually does, since it’s easy to assume it means the same thing as entering a specific provider.
Automatic mode attempts to opportunistically upgrade to encrypted DNS using whatever DNS server your network already provides, if that server happens to support encryption, falling back to standard unencrypted DNS if it doesn’t. This gives some benefit on networks with supporting infrastructure, but doesn’t guarantee encryption the way manually specifying a known provider does.
For consistent, guaranteed encryption regardless of which network you’re on, manually setting a specific provider hostname, rather than relying on Automatic, is the more reliable choice.
Setting Different DNS Providers for Different Purposes
Some people set up multiple NextDNS or AdGuard DNS profiles, each with different blocking rules, then switch between the corresponding hostnames depending on context, a stricter ad and tracker blocking profile for personal browsing, a more permissive one if certain apps break under aggressive blocking.
This requires manually switching the hostname in Settings each time, since Android’s built-in Private DNS setting only supports one active hostname at a time. It’s a manual process, but genuinely useful if you’ve run into specific apps that don’t work correctly with an aggressive ad-blocking DNS provider active.
Why Some Banking and Streaming Apps May Behave Unexpectedly
Certain apps, particularly some banking apps and streaming services, occasionally have their own certificate pinning or network security checks that can behave unexpectedly when DNS resolution doesn’t match what they expect, though this is uncommon with standard privacy-focused DNS providers.
This is much more likely to happen specifically with DNS providers that intercept or modify results, like ad-blocking services, rather than plain privacy-focused ones like Cloudflare or Google. If a specific app misbehaves right after enabling Private DNS, temporarily switching to Off, then confirming whether that resolves the app issue, isolates the cause quickly.
What DNS Providers Can and Cannot See Even With Encryption
It’s worth being precise about what Private DNS actually protects against, since it’s easy to overstate. Your ISP can no longer see which domains you’re looking up, but the DNS provider you’ve chosen instead, Cloudflare, Google, or whoever you selected, technically can, since they’re the one performing the lookup on your behalf.
This is why choosing a provider with a genuinely trustworthy, published privacy policy matters. You’re not eliminating the possibility of DNS-level tracking entirely, you’re shifting who has that visibility from your ISP to a company you’ve deliberately chosen and can evaluate on its stated privacy practices.
Cloudflare specifically commits to deleting most identifying data within 24 hours and has undergone independent audits confirming this practice, which is part of why it’s frequently recommended as a default choice for people who haven’t researched DNS providers in depth themselves.
Troubleshooting a Private DNS Connection That Won’t Establish
If the status screen shows an error rather than a successful connection, a few things are worth checking in order. First, confirm you typed the hostname exactly right, since a small typo, like missing a period, causes an immediate failure with no other explanation given.
Second, restart your Wi-Fi router if you’re on a home network, since some older router firmware has known compatibility issues with the specific port DNS-over-TLS uses. Third, try switching between Wi-Fi and mobile data to isolate whether the block is specific to your home network or affects all connections equally.
If the connection fails specifically and consistently on one network but works everywhere else, that network is very likely blocking the required port deliberately, and there’s no phone-side fix for that beyond disabling Private DNS while on that specific network.
A Note on Enterprise and School-Managed Devices
If your phone is enrolled in a work or school device management system, the Private DNS setting may already be configured and locked by that organization’s IT policy, or blocked from being changed entirely. This is intentional in most cases, implemented to enforce specific content filtering or monitoring requirements the organization has decided on.
If you find you can’t change this setting at all on a managed device, this is expected behavior rather than a bug, and it’s worth directing any specific concerns to your organization’s IT department rather than attempting workarounds.
How to Undo Private DNS if You Need to Disable It
If you’ve enabled Private DNS and later want to turn it off entirely, go back to Settings, Network & Internet, Private DNS, and select “Off” instead of the hostname option. This immediately reverts to standard, unencrypted DNS provided by whichever network you’re connected to.
There’s no cleanup needed beyond this single toggle, since Private DNS doesn’t install anything or change other settings on your phone. It’s a genuinely reversible setting you can toggle on and off freely as your needs change.
Comparing Popular Providers on Speed, Not Just Privacy
While privacy is the main reason to enable Private DNS at all, provider choice does have a real, if usually small, effect on browsing speed, since DNS lookup time adds a small delay before any page can start loading.
Cloudflare’s one.one.one.one has consistently ranked among the fastest public DNS resolvers in independent, ongoing speed testing, largely due to its extensive global server network positioned close to most users geographically. Google’s dns.google performs similarly well in most regions. Smaller or more specialized providers like NextDNS can be marginally slower due to the additional processing involved in custom blocking rules, though the difference is rarely noticeable in everyday use.
Frequently Asked Questions, Continued
Will Private DNS protect me from all forms of online tracking?
No, it specifically protects the DNS lookup step only. Tracking through cookies, browser fingerprinting, and app-level analytics continues regardless of your DNS settings, since those operate entirely separately from how domain names get resolved to IP addresses.
Does enabling Private DNS use more battery?
The effect is negligible, since DNS lookups themselves are tiny pieces of data regardless of whether they’re encrypted, and the additional processing overhead for encryption is minimal on any modern phone’s processor.
Conclusion
Private DNS is one of the simplest genuine privacy improvements available on Android, taking under a minute to set up with no ongoing cost or app to maintain.
Choosing a reputable provider, Cloudflare or Google for straightforward privacy, Quad9 for added malware blocking, or NextDNS for customizable ad blocking, and verifying the connection actually succeeded covers the setup completely. It’s not a replacement for a VPN when you genuinely need traffic-level privacy, but for everyday browsing, it closes a real gap most people don’t realize exists.
If you think there’s been a mistake here, please do let us know by commenting on this post or Contact Us. And a member of our Content Integrity Team will review this decision with you.
