Privacy and security
DNS Changer for Android: Change DNS Without Root (2026 Guide)
By the llcloud team 5 min read
Quick answer
Repel is the DNS changer to use on Android without root. Its one-tap Private DNS switches every network to a provider such as AdGuard DNS, Quad9 or Cloudflare, and its filter sends lookups with DNS over HTTPS through your own blocklists. Built in, you can type a hostname under Settings > Network & internet > Private DNS, or set static DNS on one Wi-Fi network.
Your phone uses whatever DNS server the Wi-Fi router or mobile network hands it, and you may want something faster, more private or able to block trackers. Android has two built-in ways to change DNS without root, and each has a catch. This guide shows both, then how a DNS changer app fills the gaps.
How do I change DNS on Android without root?
The setting you want is Private DNS. It has been part of Android since version 9, applies to every network, Wi-Fi and mobile data alike, and encrypts your lookups.
- Open Settings > Network & internet > Private DNS. On Samsung Galaxy phones go to Settings > Connections > More connection settings > Private DNS. The wording differs by version, so if you cannot see it, search Settings for "Private DNS".
- Choose Private DNS provider hostname.
- Type the provider's hostname, for example
dns.quad9.netorone.one.one.one. - Tap Save.
There are three things to know:
- The field takes a hostname, never an IP address. Cloudflare's own setup page tells you to type
one.one.one.onehere, not1.1.1.1. - With a hostname set, Android sends every lookup to that provider and refuses to fall back. On a network that blocks encrypted DNS, apps stop loading until you switch to Automatic. Our guide to the Private DNS server cannot be accessed error covers every cause.
- You get the provider's choices. You cannot add a domain to its blocklist or allow one it blocks.
For a list of hostnames with what each one blocks and logs, see the best Private DNS providers for Android.
How do I change DNS on one Wi-Fi network?
Android also lets you set plain DNS servers for a single Wi-Fi network. This is the older method, and it is where you can type IP addresses such as 9.9.9.9.
- Open Settings > Network & internet > Internet and tap the Wi-Fi network you are connected to. On Samsung start from Settings > Connections > Wi-Fi and tap the gear next to the network.
- Tap Edit (often a pencil icon), then Advanced options. Some phones label it differently, so look for a link that shows more settings.
- Change IP settings from DHCP to Static.
- Enter the DNS servers in DNS 1 and DNS 2. Check the IP address and gateway fields too, which some phones fill in for you and others leave blank.
- Tap Save.
The wording differs by version and phone maker, and Google's help page only documents the path as far as Advanced options. Before you rely on this method, weigh what it gives up:
- One network only. Every other Wi-Fi network and your mobile data keep their old DNS.
- No encryption. Lookups still travel in plain text, so the network can read them.
- A fixed IP address. Static mode also pins the phone's own address on that network, which can clash with another device if the router hands that address out.
- Overridden by Private DNS. With a Private DNS hostname set, Android sends lookups to that provider instead.
Does Android support DNS over HTTPS?
Partly. Android's Private DNS was built on DNS over TLS. In 2022 Google shipped DNS over HTTP/3 through a Google Play system update for phones on Android 11 and newer, but it only kicks in for well-known servers. At launch that meant Google and Cloudflare. For every other provider, Private DNS still uses DNS over TLS on port 853, which some hotel, school and office networks block.
You cannot pick DNS over HTTPS yourself in Android's settings. To use it with any provider, you need an app that resolves lookups itself.
Why use a DNS changer app?
The built-in settings change where lookups go. They cannot show you what is being looked up, filter by your own lists or work around a network that blocks port 853. A DNS changer app can. Most of them use Android's VpnService, which runs a small VPN on the phone that handles lookups only. Your other traffic does not pass through it, but Android allows one VPN at a time, so it takes the slot your privacy VPN would use.
Repel gives you both routes in one app, so you can choose per need.
One-tap Private DNS, no VPN. Pick a provider such as AdGuard DNS, NextDNS, Quad9 or Cloudflare and Repel switches Android's Private DNS setting for you. It applies to every network, keeps working with Repel closed and uses no VPN. Changing provider is one tap, and the hostname is always spelled right.
A filter with DNS over HTTPS. Repel's tracker and malware filter checks every lookup on the phone against the blocklists you choose, such as HaGeZi, OISD, 1Hosts and StevenBlack, then sends allowed lookups out encrypted with DNS over HTTPS. That travels like normal web traffic, so networks that block port 853 do not stop it. This layer uses the VPN slot. With Pro you can also enter your own DNS server.
An activity log. See which app looked up which domain and whether it was blocked. Tap an entry to allow or block it.
A firewall that leaves your VPN free. Repel's app firewall blocks internet access for any app without the VPN slot. It needs Android 13 or newer and a one-time pairing through Wireless debugging. Read how Repel keeps your VPN slot free for how that works.
Repel also runs on Android TV and Google TV as the full app, laid out for the remote. Our guide to blocking ads on Android TV shows that setup.
Which way of changing DNS should you use?
| Private DNS by hand | Static DNS on Wi-Fi | Repel | |
|---|---|---|---|
| Works on every network | ✓ | ✗ | ✓ |
| Encrypted lookups | ✓ | ✗ | ✓ |
| No typing hostnames | ✗ | ✗ | ✓ |
| DNS over HTTPS on every network | ✗ | ✗ | ✓ (filter) |
| Your own blocklists | ✗ | ✗ | ✓ |
| See what each app looked up | ✗ | ✗ | ✓ |
| Allow one blocked domain | ✗ | ✗ | ✓ |
| Cut an app off the internet | ✗ | ✗ | ✓ |
If you are comparing DNS apps, our Repel vs Intra and Repel vs RethinkDNS comparisons go through the differences. For the basics of the Private DNS setting, start with how to set up Private DNS on Android, or copy a hostname straight from the Private DNS picker.
Sources
Questions
How do I change DNS on Android without root?
Open Settings > Network & internet > Private DNS, choose Private DNS provider hostname, type a hostname such as dns.quad9.net and tap Save. It applies to Wi-Fi and mobile data, and needs no root. Repel does the same in one tap from a list of providers, and can add a local filter that sends lookups with DNS over HTTPS.
How do I change DNS on Wi-Fi only on Android?
Open the Wi-Fi network's settings, tap Edit or the gear icon, open Advanced options and set IP settings to Static. Then enter IP addresses in DNS 1 and DNS 2. The wording differs by phone. This applies only to that one network, is not encrypted, and is ignored when Private DNS is set to a provider hostname.
Does Android support DNS over HTTPS?
Partly. Android's Private DNS uses DNS over TLS. Since a Google Play system update in 2022, phones on Android 11 and newer use DNS over HTTP/3 instead, but only for well-known servers, which were Google and Cloudflare at launch. For DNS over HTTPS with any provider and your own blocklists, use an app such as Repel.
Can I use 8.8.8.8 or 1.1.1.1 as Private DNS?
Not as numbers. The Private DNS field takes a hostname, so use dns.google for Google or one.one.one.one for Cloudflare. An IP address fails and shows a "Private DNS server cannot be accessed" warning. Plain IP addresses only go in a Wi-Fi network's static DNS fields, which are unencrypted and apply to that network alone.
Does a DNS changer app drain the battery?
A one-tap Private DNS setting costs nothing, because Android does the work and the app can stay closed. A local filter runs in the background to check each lookup, which uses some power for each lookup it checks. Repel lets you choose: use one-tap Private DNS when you want zero background work, or the filter when you want your own lists and the activity log.
