Private DNS Server Cannot Be Accessed on Android: How to Fix It

You open an app, nothing loads, and Android shows "Private DNS server cannot be accessed" or "Private DNS server not reachable". Your Wi-Fi bars look fine. The good news is that the cause is nearly always one of five things, and each takes a minute to check. This guide walks through them in order, then shows how to stop the error coming back.

What does "Private DNS server cannot be accessed" mean?

Private DNS sends your phone's domain lookups encrypted to a provider you choose. When you type a provider hostname, Android treats it as a promise: either every lookup goes to that provider over an encrypted connection, or nothing goes at all. Google's Android team explained this when the feature launched. If the phone cannot reach the server, it marks the network as "No internet access" instead of falling back to plain DNS.

That is a privacy feature, and it is also why the error feels so dramatic. One unreachable server and every app stops loading, even though the Wi-Fi itself works.

The usual causes:

How do I fix the Private DNS error step by step?

Work through these in order. Most people are done by step 2.

1. Check the hostname. Open Settings > Network & internet > Private DNS and look at what is typed under Private DNS provider hostname. On Samsung Galaxy phones it is under Settings > Connections > More connection settings > Private DNS. The wording differs by version and phone maker, so if you cannot find it, search Settings for "Private DNS". Check every letter and remove any https://, tls://, trailing slash or space. An IP address such as 1.1.1.1 never works here.
2. Test on another network. Turn Wi-Fi off and try mobile data. If the error disappears, the Wi-Fi network is blocking encrypted DNS (see below). If it stays, the hostname or the provider is the problem.
3. Sign in to the Wi-Fi first. Cafés, airports and hotels often show a sign-in page before they let you online. That page relies on the network's own DNS. Set Private DNS to Automatic, open the sign-in page from the notification, sign in, then set your hostname again.
4. Try a second provider. Outages are rare but they happen. Swap in another well-known hostname such as dns.quad9.net or one.one.one.one for a few minutes. Our Private DNS hostname picker lets you copy one without typing.
5. Turn your VPN off for a minute. If the error goes away, the VPN is handling DNS its own way. Use its built-in DNS or blocking option while it is connected.
6. Restart the phone. After a change of network or SIM, a restart clears a stuck connection more often than you would expect.

Why does Wi-Fi block Private DNS on port 853?

Android's Private DNS uses DNS over TLS, and the standard for it puts that traffic on port 853. A port is like a numbered door on the network. Many managed networks in hotels, schools, offices and some public hotspots close door 853 on purpose, because they run their own DNS filter and do not want devices to skip it.

You have two choices on a network like that:

• Set Private DNS to Automatic while you are on it. You keep encryption whenever the network supports it, but you lose your chosen provider and its filtering until you leave.
• Use a filter that sends lookups with DNS over HTTPS. That method rides on the HTTPS standard, the same encrypted connection on port 443 that every website uses, so a network that closes port 853 usually still lets it through.

Repel does the second one. Its tracker and malware filter checks each lookup on the phone against the blocklists you choose, then sends the allowed ones out encrypted with DNS over HTTPS. The filter uses Android's VPN slot to see lookups, which is worth knowing if you also run a privacy VPN. We explain that trade in how Repel keeps your VPN slot free.

How do I stop the Private DNS error from coming back?

Most repeat errors come from typing hostnames by hand and from moving between networks with different rules. Repel handles both.

No more typing. Repel's one-tap Private DNS lets you pick a provider such as AdGuard DNS, NextDNS, Quad9 or Cloudflare from a list, and it switches Android's Private DNS setting for you. The hostname is always spelled right. It keeps working with Repel closed and uses no VPN.

Switching back is one tap. When a hotel network forces you onto Automatic, you do not need to remember the hostname later. Pick the provider again in Repel and you are back.

A filter that does not depend on port 853. On networks that block encrypted DNS, turn on Repel's filter. Lookups go out with DNS over HTTPS, and you keep the blocklists you chose, such as HaGeZi in the free version.

See what broke. Sometimes the error is gone but one app still fails, because a filtering provider blocked a domain it needs. Plain Private DNS cannot tell you which one. Repel's activity log shows which app looked up which domain and whether it was blocked, so you can allow that single domain.

If you are still choosing a provider, our list of the best Private DNS providers for Android compares hostnames, blocking and logging. For the basics of the setting itself, start with how to set up Private DNS on Android.

Is "Private DNS server not reachable" ever a false alarm?

Occasionally. The warning can appear for a moment while the phone joins a network and clear by itself. If pages are loading normally, you can ignore it. If the warning keeps returning on the same network, treat it as a real block and use one of the fixes above.

A related case is Android's other DNS setting, the static DNS on a single Wi-Fi network. If someone set DNS 1 and DNS 2 by hand on that network, those servers matter mainly when Private DNS is Off or Automatic, because a provider hostname sends every lookup to that provider instead. Our guide to changing DNS on Android explains how the two settings fit together.

Which way of avoiding the error works best?

If you want to block trackers without giving up your VPN at all, read how to block trackers on Android without a VPN, which pairs one-tap Private DNS with Repel's no-VPN firewall. And if you are weighing Repel against the Intra encrypted DNS app, the Repel vs Intra comparison covers the differences.

Sources

• Android Developers Blog: DNS over TLS support in Android P
• Google: Manage advanced network settings on Android (Private DNS)
• RFC 7858: DNS over TLS (port 853)
• RFC 8484: DNS Queries over HTTPS