Privacy and security
How to Set Up Private DNS on Android (and Which Provider to Pick)
By the llcloud team 5 min read
Quick answer
Open Settings > Network & internet > Private DNS, choose Private DNS provider hostname, type a hostname such as dns.adguard-dns.com or dns.quad9.net, and tap Save. Your lookups then go to that provider encrypted, for every app, with no VPN. The menu moves on some phones, so search Settings for "Private DNS" if you cannot find it.
Private DNS is one of the most useful settings Android has and one of the least known. It takes four taps, costs nothing and works for every app on the phone. This guide shows where it lives, which provider to type in, and what to do when a network refuses it.
What does Private DNS actually do?
Every time an app connects somewhere, the phone first looks up the domain name. Without Private DNS those lookups usually go to your network's DNS server in plain text. Anyone on the path can read them, and some networks rewrite them.
With Private DNS on, Android sends the lookups encrypted (DNS over TLS) to the provider you choose. Two things change:
- Your Wi-Fi or mobile operator can no longer read or tamper with the lookups.
- If the provider filters, lookups for blocked domains, such as known trackers or malware hosts, fail before the app can connect.
What it does not change: your traffic itself, your IP address, or what websites can see. Google's help page states this plainly too. Private DNS protects lookups, not everything else.
How do I turn on Private DNS?
- Open Settings > Network & internet > Private DNS.
- Choose Private DNS provider hostname.
- Type the hostname of the provider you want (see the table below).
- Tap Save.
The location varies. On Samsung Galaxy phones look in Settings > Connections > More connection settings > Private DNS. Older Android versions put it under Network & internet > Advanced. Other skins move it again, so if you do not see it, search Settings for "Private DNS". The three options are the same everywhere: Off, Automatic and a provider hostname.
Which Private DNS provider should I use?
These are the hostnames as each provider publishes them, as of October 2026. Type them exactly, without tls:// or https://.
| Provider | Hostname | What it blocks |
|---|---|---|
| AdGuard DNS | dns.adguard-dns.com |
Ads and trackers |
| AdGuard DNS Family | family.adguard-dns.com |
Ads, trackers, adult content, plus safe search |
| AdGuard DNS Non-filtering | unfiltered.adguard-dns.com |
Nothing |
| Quad9 | dns.quad9.net |
Malware domains |
| Cloudflare | one.one.one.one |
Nothing |
| Cloudflare for Families | security.cloudflare-dns.com |
Malware |
| Cloudflare for Families | family.cloudflare-dns.com |
Malware and adult content |
| Google Public DNS | dns.google |
Nothing |
A few notes to help you choose:
- For fewer trackers, AdGuard DNS is the simple pick.
- For malware protection with as little breakage as possible, Quad9 or Cloudflare's security hostname.
- For a child's phone, one of the family hostnames.
- NextDNS gives you your own hostname from its website, where you choose the lists. It suits people who want control without installing an app.
- Mullvad published filtering hostnames too, but its page says the public encrypted DNS service will be discontinued on November 2, 2026, so do not set it up now.
If you would rather not type hostnames at all, Repel has one-tap Private DNS. You pick AdGuard DNS, NextDNS, Quad9, Cloudflare or another provider from a list, and Repel changes Android's setting for you. It keeps working with Repel closed and uses no VPN.
Why is Private DNS not working?
"Private DNS server cannot be accessed"
- Check the spelling. One wrong letter and every lookup fails.
- Some Wi-Fi networks block encrypted DNS on port 853. Hotels, schools and offices do this. Switch to Automatic while you are on that network.
- Try a second provider to rule out an outage.
A Wi-Fi sign-in page will not load
Captive portals in cafés and airports rely on the network's own DNS. Switch Private DNS to Automatic, sign in, then switch it back.
It seems to stop working when my VPN is on
Most VPN apps route DNS through their own servers inside the tunnel, so the Private DNS setting may be bypassed while the VPN is connected. Use your VPN's own DNS or blocking option instead, or one that accepts a custom DNS server.
An app or site broke
A filtering provider sometimes blocks a domain an app needs. With Private DNS alone you can only switch providers or turn filtering off. This is where a local filter helps: Repel's activity log shows which domain was blocked, and you can allow that single domain instead of dropping protection.
Which provider can I trust with my lookups?
Private DNS moves your lookups away from your network operator and hands them to the provider you pick. That provider can see which domains your phone asks for, so choose one whose privacy policy you are comfortable with. All of the providers in the table publish their logging policies on their own sites, and it is worth a two minute read before you commit.
A few practical points:
- Distance matters. A provider with servers near you answers faster. If pages feel slow to start loading, try another provider.
- Filtering is the provider's call. You cannot add or remove a single domain from AdGuard's or Quad9's list.
- You can switch at any time. Nothing is installed, so changing provider is the same four taps.
Private DNS or a local DNS filter?
| Private DNS | Repel's local filter | |
|---|---|---|
| Uses the VPN slot | No | Yes |
| Blocklist | The provider's | HaGeZi, OISD, 1Hosts, StevenBlack and more |
| See what each app looked up | No | Yes, activity log |
| Allow one blocked domain | No | Yes |
| Needs an app running | No | Yes |
Private DNS is the better start for most people. The local filter is the better tool when you want to see and adjust what is blocked, and you can spare the VPN slot. Because an app-based filter has to stay running, battery management on some phones can stop it. If that happens, read why Android kills background apps for the fix on your phone, or on Samsung go straight to stopping Samsung from killing apps.
For the bigger picture, including cutting single apps off the internet while your VPN stays on, see how to block trackers on Android without a VPN. And if you are choosing between firewall apps, the Repel vs NetGuard comparison explains the VPN slot question in detail. Privacy on the phone itself matters too, and our guide on hiding photos on Android covers the free built-in folders and encrypted vaults.
Sources
Questions
What is Private DNS on Android?
Private DNS is Android's built-in setting for encrypted DNS, added in Android 9. It sends your phone's domain lookups to a provider you choose over an encrypted connection, so your network operator cannot read or change them. If the provider filters, it also refuses lookups for tracker or malware domains. It covers lookups only, not the rest of your traffic.
Should I use Automatic or a provider hostname?
Automatic encrypts lookups only when your current network's DNS server supports it, and falls back to plain DNS when it does not. A provider hostname always uses the provider you name and fails rather than falling back. Pick a hostname if you want filtering or a provider you trust. Stay on Automatic if you only want the default behaviour.
Why does my internet stop working after I set Private DNS?
Usually the hostname has a typo, or the network blocks encrypted DNS on port 853, which some hotel, school and work Wi-Fi does. Android then shows a warning like "Private DNS server cannot be accessed". Check the spelling, try another provider, or switch to Automatic while you are on that network. Captive portal sign-in pages can also fail until you switch it off.
Can I use an IP address like 1.1.1.1 in Private DNS?
No. The field takes a hostname, because Android checks the provider's certificate against that name. For Cloudflare use one.one.one.one, and for Google use dns.google. Typing a bare IP address will fail to connect. If you need to use an IP address, set it in the Wi-Fi network's own DNS options instead, which applies to that network only and is not encrypted.
Does Private DNS hide my browsing from websites?
No. It hides your lookups from the network you are on and moves trust to the provider you picked. Websites still see your IP address, and your network can still see which servers you connect to. If you need to hide your IP address, that is a job for a VPN.
