Privacy and security
Best Private DNS Providers for Android: Hostname List (2026)
By the llcloud team 5 min read
Quick answer
Repel is the easiest way to use the best Private DNS on Android: pick a provider such as AdGuard DNS, NextDNS, Quad9 or Cloudflare and it sets Android's Private DNS in one tap, then its filter adds your own blocklists and an activity log on top. For ads and trackers the strongest free hostname is dns.adguard-dns.com, for malware dns.quad9.net, and for a child's phone family.adguard-dns.com.
Android's Private DNS setting takes one hostname, and the one you pick decides what gets blocked and who sees your lookups. Below is every major provider's hostname as each one publishes it, checked on their own pages in October 2026, with what it blocks and what it keeps. Then you will see how to set any of them without typing, and how to get more control than a single hostname gives you.
Which Private DNS hostnames can I use on Android?
Type the hostname exactly as shown, with no tls:// or https:// in front.
| Provider | Hostname | What it blocks | What it logs |
|---|---|---|---|
| AdGuard DNS | dns.adguard-dns.com |
Ads and trackers | No personal data on public servers, only anonymous aggregate stats |
| AdGuard DNS Family | family.adguard-dns.com |
Ads, trackers, adult content, plus safe search | Same as above |
| NextDNS | yourid.dns.nextdns.io |
Whatever lists you choose in your account | Nothing unless you turn logs on, you pick retention and region |
| Quad9 | dns.quad9.net |
Malware and malicious domains | Does not collect or record user IP addresses |
| Cloudflare | one.one.one.one |
Nothing | Resolver logs deleted within 25 hours, IPs not kept on disk apart from a tiny sample |
| Cloudflare for Families | security.cloudflare-dns.com |
Malware | Same as Cloudflare |
| Cloudflare for Families | family.cloudflare-dns.com |
Malware and adult content | Same as Cloudflare |
| Control D | p2.freedns.controld.com |
Ads and trackers | Says its free DNS does not log or store queries |
| Control D Family | family.freedns.controld.com |
Malware, ads, trackers, adult and drug sites | Same as Control D |
| CleanBrowsing Security | security-filter-dns.cleanbrowsing.org |
Phishing, spam and malware | No IP addresses, anonymised aggregate query data may be kept |
| CleanBrowsing Family | family-filter-dns.cleanbrowsing.org |
Adult sites, proxies and VPNs, malware, plus safe search | Same as CleanBrowsing Security |
| Google Public DNS | dns.google |
Nothing | Logs with your IP deleted within 24 to 48 hours, sampled logs kept without IP |
Control D also offers p0 (no filtering), p1 (malware only) and p3 (social media) on the same freedns.controld.com domain. CleanBrowsing has a middle option, adult-filter-dns.cleanbrowsing.org, which blocks adult sites without blocking proxies. Mullvad's DNS is left out on purpose because Mullvad is closing its public DNS service on November 2, 2026.
If you just want to copy a hostname quickly, our Private DNS hostname picker has the most common ones ready to paste.
Which provider should I pick for my phone?
Start from what you want to stop:
- Ads and trackers. AdGuard DNS or Control D's
p2. Both block known ad and tracker domains for every app on the phone. - Malware and phishing, with as little breakage as possible. Quad9, or Cloudflare's security hostname.
- A child's phone. AdGuard DNS Family, Cloudflare's family hostname or CleanBrowsing Family. Our guide to blocking adult sites with DNS covers that setup in detail.
- Your own blocklists. NextDNS, where you choose the lists in your account. Our Repel vs NextDNS comparison shows what changes when the lists live on your phone instead.
- Speed and nothing else. Cloudflare or Google, neither of which filters.
A word on "DNS to block ads". A filtering DNS stops lookups for ad domains, so many banners and trackers in apps vanish. It cannot remove ads that come from the same server as the content, such as ads inside YouTube videos. That is true of every DNS provider in the table and of every DNS filter app.
How do I set a Private DNS provider on Android?
- Open Settings > Network & internet > Private DNS. On Samsung Galaxy phones it is under Settings > Connections > More connection settings > Private DNS. The wording differs by version, so search Settings for "Private DNS" if you cannot see it.
- Choose Private DNS provider hostname.
- Type a hostname from the table.
- Tap Save.
If every app stops loading afterwards, the hostname probably has a typo or your Wi-Fi blocks encrypted DNS. Our fix for Private DNS server cannot be accessed walks through each cause. The full walkthrough of the setting itself is in how to set up Private DNS on Android.
Why use Repel instead of typing a hostname?
A hostname is a single fixed choice. You get that provider's list, no log of what it blocked, and no way to allow one domain an app needs. Repel starts from the same setting and adds what it leaves out.
One-tap Private DNS. Pick a provider such as AdGuard DNS, NextDNS, Quad9 or Cloudflare, and Repel switches Android's Private DNS for you. No typos, and switching providers takes one tap instead of four. It keeps working with Repel closed and uses no VPN.
Your own blocklists on top. Repel's tracker and malware filter checks each lookup on the phone against community lists such as HaGeZi, OISD, 1Hosts and StevenBlack. Allowed lookups go out encrypted with DNS over HTTPS. The free version includes HaGeZi Light or Pro, and Pro adds the larger lists, threat intelligence and your own DNS server. This layer uses Android's VPN slot.
An activity log. See which app looked up which domain and whether it was blocked. Tap an entry to block it, allow it, or cut that app off the internet.
A firewall that leaves your VPN free. Repel's app firewall blocks internet access for any app without using the VPN slot. It needs Android 13 or newer and a one-time pairing through Wireless debugging. Our guide to blocking trackers without a VPN shows how to combine it with one-tap Private DNS.
Which option gives you the most control?
| A Private DNS hostname alone | Repel | |
|---|---|---|
| Set a provider without typing | ✗ | ✓ |
| Switch providers in one tap | ✗ | ✓ |
| Works with the app closed | ✓ | ✓ (one-tap Private DNS) |
| Your choice of blocklists on the phone | ✗ | ✓ |
| See what each app looked up | ✗ | ✓ |
| Allow one blocked domain | ✗ | ✓ |
| Cut an app off the internet | ✗ | ✓ |
| Lookups keep their filter when Wi-Fi blocks port 853 | ✗ | ✓ (filter, DNS over HTTPS) |
If you are weighing Repel against AdGuard's own app, the Repel vs AdGuard comparison goes through it. To change DNS on a single Wi-Fi network instead, see our guide to DNS changers on Android.
Sources
- AdGuard DNS public servers and AdGuard DNS privacy policy
- Quad9 service addresses and Quad9 privacy policy
- Cloudflare: Set up 1.1.1.1 on Android and Cloudflare public resolver privacy
- NextDNS privacy policy
- Control D free DNS and free DNS overview
- CleanBrowsing filters and CleanBrowsing privacy policy
- Google Public DNS: DNS over TLS and privacy
Questions
What is the best Private DNS for Android?
For blocking ads and trackers, AdGuard DNS at dns.adguard-dns.com is the simplest free choice. For malware protection with little breakage, Quad9 at dns.quad9.net. For your own lists, NextDNS gives you a personal hostname. Repel sets any of these popular providers in one tap and adds a local filter with an activity log, so you can see and fix what gets blocked.
What is the AdGuard DNS hostname for Private DNS?
Type dns.adguard-dns.com to block ads and trackers, family.adguard-dns.com to also block adult content and force safe search, or unfiltered.adguard-dns.com for no blocking. Enter it without tls:// in front. AdGuard publishes these on its public DNS page. In Repel you pick AdGuard DNS from the list and it fills the hostname in for you.
How do I use NextDNS on Android?
Create a free configuration at my.nextdns.io, where you choose the blocklists. Its Setup tab shows your personal hostname in the form yourid.dns.nextdns.io. Enter that under Private DNS provider hostname and tap Save. Repel has NextDNS in its one-tap Private DNS list as well, so you add your ID once instead of typing the full hostname.
Can a DNS block ads on Android?
Partly. A filtering DNS such as AdGuard DNS refuses lookups for known ad and tracker domains, so many in-app banners and trackers disappear. It cannot remove ads served from the same server as the content, such as ads inside YouTube videos or other video streams. That limit applies to every DNS filter, Repel included.
Which Private DNS does not log?
Quad9 says it does not collect or record user IP addresses. AdGuard says it processes no personal data for its public servers. NextDNS logs nothing unless you turn logs on. Cloudflare deletes resolver logs within 25 hours, and Google deletes its logs that hold your IP within 24 to 48 hours. Read each policy before you choose.
