What is Private DNS on Android?
Private DNS is a one-line setting on every Android phone that encrypts the lookups your phone makes before loading each site and app. It takes a minute to turn on, and it is the easiest privacy improvement most people never make.
In this guide
Private DNS is Android's built-in support for encrypted DNS (DNS over TLS, with DNS over HTTP/3 for providers that support it). Instead of sending lookups in plain text to whatever resolver the Wi-Fi or mobile network provides, your phone sends them encrypted to a resolver you choose, on every network. Turn it on in Settings > Network & internet > Private DNS, pick "Private DNS provider hostname" and enter a hostname such as one.one.one.one or dns.google.
What Private DNS does
Every time your phone opens a site or an app contacts its server, it first asks a DNS resolver to turn a name like example.com into an address. Normally that question goes unencrypted to the resolver the network handed out, so the café Wi-Fi, your mobile carrier or your home ISP can read the full list of names you look up, and could answer with a different address.
Private DNS, added in Android 9 in 2018, replaces that with DNS over TLS: the same lookups, wrapped in the encryption web browsers use, sent on port 853 to a resolver you name. On Android 11 and later, lookups to providers that support it, Google Public DNS and Cloudflare among them, are automatically upgraded to DNS over HTTP/3, which Google measured as cutting median lookup time by about a quarter. Either way the setting is system-wide: it covers every app and every network, Wi-Fi or mobile, without a VPN.
What it does not do: it does not hide your IP address, it does not encrypt the traffic that follows the lookup (HTTPS already does that), and the provider you choose sees every name you resolve. It moves trust from whichever network you happen to be on to one resolver you picked on purpose.
How to turn on Private DNS
Pixel and most Android phones
- Open Settings > Network & internet.
- Tap Private DNS (on older versions it is under Advanced).
- Choose Private DNS provider hostname, type the hostname from the table below and tap Save.
Samsung Galaxy
- Open Settings > Connections > More connection settings.
- Tap Private DNS, choose Private DNS provider hostname, enter the hostname and tap Save.
The three modes mean:
- Off: plain DNS to the network's resolver.
- Automatic: the default. Android tries DNS over TLS to the network's own resolver and silently falls back to plain DNS if that fails, which on most networks means plain DNS. It is better than nothing and worse than naming a provider.
- Private DNS provider hostname: encrypted DNS to the provider you typed, with no fallback. If that provider is unreachable, the phone reports an error rather than leaking.
Type a hostname, not an IP address: the field needs a name so the TLS certificate can be checked. 1.1.1.1 will not work there; one.one.one.one will.
Provider hostnames
| Provider | Hostname | What it does |
|---|---|---|
| Cloudflare | one.one.one.one | Fast, no filtering, logs truncated and deleted within 25 hours |
| Cloudflare for Families | security.cloudflare-dns.com or family.cloudflare-dns.com | Blocks malware; the second also blocks adult content |
| Google Public DNS | dns.google | No filtering, very widely peered, DoH3 upgrade on Android 11+ |
| Quad9 | dns.quad9.net | Blocks known malware domains, DNSSEC validation, Swiss non-profit |
| Quad9 unfiltered | dns10.quad9.net | Same resolver without the blocklist |
| AdGuard DNS | dns.adguard-dns.com | Blocks ads and trackers system-wide, in every app |
| AdGuard Family | family.adguard-dns.com | Ads, trackers and adult content; enables safe search |
| AdGuard unfiltered | unfiltered.adguard-dns.com | No filtering |
| NextDNS | <your-id>.dns.nextdns.io | Your own configurable blocklists and logs; the ID comes from your NextDNS account |
Which to pick: Cloudflare or Google if you only want encryption and speed; Quad9 if you want malware blocking with a strict privacy stance; AdGuard if your main goal is removing ads from apps and games; NextDNS if you want to see and tune what is blocked. Hostnames are case-insensitive, and there is no ranking of "fastest" that holds everywhere: the nearest server differs by country and carrier, so if speed matters, try two and compare page-load times.
Fix "Private DNS server cannot be accessed"
This message means the phone could not open an encrypted connection to the hostname you entered, and because the hostname mode has no fallback, apps lose internet until it is resolved. Work through these in order:
- Check the spelling. One character wrong and the TLS certificate will not match. Copy a hostname from the table rather than typing it.
- Sign in to the Wi-Fi first. Hotel, airport and café networks hold all traffic until you accept their login page. Switch Private DNS to Automatic, open the portal and sign in, then switch back.
- The network blocks port 853. Some workplace, school and public networks allow only ports 80 and 443. Nothing on the phone fixes that; use mobile data, a VPN, or Automatic on that network.
- The provider is down or unreachable from your carrier. Try a second provider from the table. If one works and the other does not, the first is being blocked or is having an outage.
- A VPN or a filtering app is intercepting DNS. Apps that create a local VPN to block ads take over DNS; disable them or let one of the two handle it.
- Toggle airplane mode or restart the phone to clear a stuck connection after changing the setting.
If you only ever see the error on one network, that network is the cause, and the quickest workaround is a saved rule in your head: Automatic there, hostname everywhere else.
Verify which resolver you are using
Run the DNS leak test from the phone's browser. It makes the browser look up unique hostnames and lists the resolvers that asked for them. With Private DNS set to a provider hostname, the result should show only that provider (Cloudflare, Google, Quad9, AdGuard or NextDNS); if your carrier or home ISP appears, the setting is not active on this network or an app is bypassing it. The what is my DNS server page shows the single resolver answering right now, and the DNS lookup tool lets you compare the answers two resolvers give for a name, which is how you confirm that a filtering provider is actually blocking a domain.
Private DNS pairs well with a VPN but can also fight with it: most VPN apps route DNS through their own resolver while connected and hand it back afterwards. Running the leak test with the VPN on and off shows which resolver wins; our DNS leak guide explains what to do if the answer is "the wrong one".
Test it now
CheckingRunning against our own test servers. Nothing is stored.
Open the DNS leak testQuestions
What is a private DNS?
On Android, Private DNS is the setting that encrypts DNS lookups with DNS over TLS (or DNS over HTTP/3) and sends them to a resolver you choose instead of the one the network assigns. It stops the Wi-Fi operator, your carrier or your ISP from reading or altering the names you look up, applies to every app on every network, and needs no extra software. It does not hide your IP address or replace a VPN.
What is the fastest Private DNS hostname?
There is no single winner. Response time depends on which provider has a server closest to your carrier's network, so Cloudflare (one.one.one.one) wins in some regions and Google (dns.google) or Quad9 in others, usually by a few milliseconds. On Android 11 and later, Google and Cloudflare also get the faster DNS over HTTP/3 transport automatically. Try two for a day each and keep the one where pages open quicker.
How do I stop ads using Private DNS?
Set Private DNS to a filtering provider: enter dns.adguard-dns.com for AdGuard's ad-and-tracker blocklist, or a NextDNS hostname with your own configuration. Because the resolver answers blocked domains with nothing, ads and trackers fail to load in every app and browser without an extension. It cannot remove ads served from the same domain as the content, such as YouTube's, and some apps break if their analytics domains are blocked.
Is 1.1.1.1 and 1.0.0.1 DNS safe?
Yes. They are Cloudflare's public resolver, which supports encrypted DNS, truncates and deletes client IP data within 25 hours, does not sell query data, and has had those commitments independently audited. On Android you enter it as the hostname one.one.one.one rather than the numbers. Using it means Cloudflare sees your lookups instead of your ISP, which is a change of who you trust rather than an absence of trust.
Does Private DNS work on mobile data?
Yes. The setting is system-wide, so it applies on mobile data, every Wi-Fi network and tethered connections alike, and it keeps working when you switch between them. Carriers rarely block port 853, so the hostname mode is reliable on cellular. The exception is a carrier or a VPN app that forces its own DNS; the DNS leak test shows which resolver is actually answering on each connection.