Android settings
Private DNS on Android Explained: Provider Hostnames, Automatic Mode and Setup
Private DNS is the Android setting that sends the phone’s name lookups through an encrypted DNS over TLS connection instead of plain port 53 traffic. It arrived with Android 9 (Pie), and Google introduced it in an April 2018 post on the Android Developers Blog. One menu entry hides three quite different behaviours, and only one of them guarantees encryption.
Where the Private DNS setting lives
On a stock Android build the path is Settings > Network & internet > Advanced > Private DNS, the exact route Cloudflare’s setup guide for 1.1.1.1 gives. Phone makers rearrange menus freely, so if the entry is not under Advanced, typing its name into the search bar at the top of Settings is the quickest way to reach it.
Tapping the entry opens a small dialog with three options: Off, Automatic and a provider hostname field. Nothing else is configurable. There is no port number, no choice of protocol and no fallback list, which keeps the feature simple but also means it speaks DNS over TLS and nothing else, a detail that matters later on restrictive networks.
Off, Automatic mode and what each one does
Automatic is the default. In automatic mode Android checks whether the DNS server handed out by the Wi-Fi or mobile network also answers over TLS, and upgrades to an encrypted connection when it does. If the network’s resolver only speaks classic DNS, the phone keeps sending plain queries without any warning, so the padlock you might imagine is not there.
That is the catch with automatic mode. It protects you only on networks whose operator already runs a TLS-capable resolver, which is exactly the kind of network you were least worried about. On a café hotspot or an airport network with an ordinary resolver, nothing changes, and anyone on the path can still read and rewrite the lookups.
Off does what it says: the phone always uses the network’s plain resolver. It has one honest use, which is diagnosis. If a login page or a work application stops loading after you set a hostname, switching to Off for a minute shows quickly whether the encrypted resolver is involved or whether the fault lies somewhere else entirely.
Choosing a provider hostname
The third option gives real protection. You type the TLS hostname of a resolver, and Android sends every lookup from apps using the system resolver to that server over an authenticated connection. Google’s post describes the failure case: if the server cannot be reached, Android marks the network as having no internet access instead of falling back to plaintext.
| Resolver | Hostname to enter | What the operator documents |
|---|---|---|
| Google Public DNS | dns.google | DNS over TLS on port 853 |
| Cloudflare 1.1.1.1 | one.one.one.one | DNSSEC-validating resolver |
| Quad9 | dns.quad9.net | Threat blocking, alternate DoT port 8853 |
| AdGuard DNS | dns.adguard-dns.com | Ad and tracker blocking |
Enter the bare provider hostname, never an address with a scheme or a path. A string such as https://dns.quad9.net/dns-query is a DoH address for browsers and other DoH clients. AdGuard publishes its server as tls://dns.adguard-dns.com, and only the part after tls:// belongs in the field. Save, then open any website to confirm that lookups still resolve.
Which provider hostname to pick depends on what you want filtered. Google and Cloudflare return unfiltered answers, Quad9 refuses domains on its threat lists, and AdGuard blocks advertising and tracking domains. A blocking resolver is the closest thing to a system-wide ad blocker Android offers without installing anything, and the blocklist belongs to the operator, not to you.
What the setting protects, and what it leaves open
With a hostname set, the lookups between the phone and the resolver are encrypted and authenticated, so the Wi-Fi operator, other people on the same network and the mobile carrier can no longer read or alter them. Cloudflare’s guide notes that the setting applies on every network, including cellular, which makes it a reasonable default for a phone that roams.
It does not make browsing invisible. The resolver you chose now sees every name the phone looks up, so trust moves from the network to that operator. The connections that follow each lookup still go to visible IP addresses. Apps that run their own DNS code are outside the setting altogether, as the Android post warns developers.
There is also the port. DNS over TLS uses TCP port 853, and the DNSCrypt FAQ points out that a dedicated port is easy to block precisely where encryption matters most. A network that blocks it leaves the phone with no working DNS at all. The public Wi-Fi guide covers what to do on hotel and airport networks.
Private DNS and DNSCrypt apps on the same phone
DNSCrypt is a separate protocol, and Android has no built-in client for it. Apps that bring dnscrypt-proxy or a compatible client to the phone, described in the Android install guide, handle DNS themselves and can use DNSCrypt or DoH on port 443, the port ordinary HTTPS traffic uses, which is far harder to block than port 853.
Decide which component owns DNS before combining them, because two encryption layers pointed at different resolvers make every failure harder to trace. If the built-in private DNS client is enough, keep it. For query logs, blocklists or Anonymized DNS relays, use a DNSCrypt app. The encrypted DNS overview and the DNS over TLS page compare the protocols.
iPhone and Windows equivalents
iOS and iPadOS have no single hostname field like Android’s. Encrypted DNS arrives through a DNS Settings configuration profile, which according to Apple’s deployment guide supports HTTPS or TLS as the protocol, or through an app published by a resolver operator. Neither route is as quick as typing one hostname.
Windows 11 takes another route and uses DNS over HTTPS. Under the connection’s Edit IP settings, choose Manual, enter a preferred DNS server, then pick Off, On (automatic template) or On (manual template), plus a Fallback to plaintext switch. Microsoft notes that the option is missing from Windows 10. The DNS over HTTPS page explains templates.
When the phone says the server cannot be accessed
Work through this in order. Check the spelling of the provider hostname and remove any scheme, port or trailing slash. Switch from Wi-Fi to mobile data: if the warning disappears, the Wi-Fi network is blocking port 853 or intercepting the connection. Finally try a second hostname from the table, which rules out an outage at one operator.
If one particular network keeps blocking port 853, you have two practical choices. Set the entry to Automatic while connected there and accept plain DNS for that session, or move to a DNSCrypt or DoH app that runs over port 443. For a phone that travels a lot, the app is usually the steadier option of the two.
Frequently asked questions
Is Private DNS the same as a VPN?
No. The setting encrypts only DNS lookups between the phone and one resolver. The websites and servers the phone connects to afterwards are still reachable by IP address in the normal way, and the network can see those connections. A VPN tunnels all traffic, not only name lookups. The resolver you choose also sees every name you look up.
Should I choose Automatic or a provider hostname?
Choose a provider hostname if you want encryption on every network. Automatic only upgrades to DNS over TLS when the resolver handed out by the current Wi-Fi or mobile network supports it, so on any network whose resolver lacks TLS support it quietly keeps sending plain DNS queries. Off always uses the network's plain resolver.
Why does my phone say the Private DNS server cannot be accessed?
Usually the hostname is mistyped, contains a prefix such as https:// or tls://, or the network blocks TCP port 853, which DNS over TLS needs. Check the spelling first, then try the same hostname on mobile data to see whether the Wi-Fi network is the problem. If the warning disappears, the Wi-Fi is blocking port 853.
Which hostname should I type for Cloudflare, Google or Quad9?
Cloudflare documents one.one.one.one, Google Public DNS uses dns.google, and Quad9 uses dns.quad9.net. AdGuard DNS publishes dns.adguard-dns.com for its ad-blocking resolver. Type only the hostname, without a scheme, port or path. Google and Cloudflare return unfiltered answers, Quad9 blocks domains on its threat lists and AdGuard blocks ads and trackers. Save, then open a website to confirm lookups still resolve.
Does Private DNS work on mobile data as well as Wi-Fi?
Yes. Cloudflare's Android guide notes that the setting applies on all networks, including cellular. The phone uses the same resolver whether it is connected to home Wi-Fi, a hotel network or the mobile carrier. That makes it a sensible default for a phone that roams. Apps that run their own DNS code stay outside it.