Search Android Settings for Private DNS. Use Automatic if you want Android to try encrypted DNS without choosing a specific provider. To use a particular DNS-over-TLS service, select the provider hostname option and enter the hostname published by that service. Test both Wi-Fi and mobile data after saving.
What Android Private DNS changes
DNS helps your phone look up the network addresses associated with names such as a website domain. Android Private DNS can encrypt the connection used for those lookups. A provider hostname tells Android which resolver it should use for the encrypted connection. The resolver still receives the queries needed to answer them. Read the provider’s policies and check which features apply to the endpoint you choose, particularly if it offers different versions for filtering and ordinary resolution.
Private DNS addresses one piece of an internet connection. A website can still receive the information you provide to it, and an application can use its own network settings. If you are choosing a setting for a work-managed phone, check with the administrator first. Internal domains, network filters, and managed VPNs can depend on the organization’s DNS. A custom public resolver can change how those domains resolve. Keep a note of the original setting so you can restore it if the change interferes with a network you rely on.
Find the setting and choose a mode
Start by opening Settings and searching for Private DNS. On a device with a standard Android settings layout, it is generally under Network & internet. Manufacturers can place it elsewhere. See Google’s Android network settings documentation for the standard controls. The three usual choices are Off, Automatic and Private DNS provider hostname. If the option does not appear, check the Android version and whether the phone is managed before looking for another app.
Automatic is a sensible default for everyday use if you have no specific resolver requirement. The provider option is useful when you deliberately want to use a named service across networks where that service can be reached. Off can help isolate a connection problem during troubleshooting, and you can return to your intended setting afterward. Make one change at a time. Altering a Wi-Fi proxy, VPN, and DNS option together makes it difficult to identify which one caused the result.
Enter the provider hostname correctly
Find the DNS-over-TLS hostname in the provider’s own instructions. For example, Google Public DNS setup documentation specifies dns.google for Android’s provider hostname setting. Enter just the hostname. Leave out https://, a port, an IP address, and paths such as /dns-query. Providers can publish different endpoints for DNS-over-HTTPS and DNS-over-TLS. Use the one documented for Android Private DNS. If you copied it, check for a space at the beginning or end before saving.
If you are evaluating a service for filtering, look up which hostname corresponds to the filtering policy you actually want. Then verify the policy using the provider’s own documented test if available. An ordinary website loading is useful evidence that DNS works, but it does not prove that a particular filtering profile is active. A different app might resolve names independently or receive a different answer from cache.
Test Wi-Fi and mobile data separately
With Wi-Fi connected, load a site you do not already have open. Then briefly turn Wi-Fi off and try another site using mobile data, provided your plan permits it. Test the apps you care about as well as a browser. An app may keep a connection alive or use cached answers, so use more than one example. Return to your normal network afterward. If data fails only when switching networks, record which network works and check whether the phone reports a Private DNS connection error.
For a shared Wi-Fi problem, see our Wi-Fi dead zone guide to separate weak coverage from a name resolution failure. If a Windows device on the same network also cannot resolve a domain, the Windows DNS troubleshooting guide provides a second test. Those observations help you decide whether to focus on the phone, the resolver, or the connection itself.
Troubleshoot captive portals and VPNs
A hotel, airport, or guest Wi-Fi network may require a sign-in page before it permits normal internet use. If the portal fails to appear with a custom provider, try switching back to Automatic for the sign-in process. Reapply your chosen hostname afterward and test again. If the network consistently prevents the provider from working, return to the setting appropriate for that network. There is little value in repeatedly changing the hostname when the network blocks the required connection.
VPN clients may use their own resolvers or enforce rules for work domains. If changing Private DNS affects access while the VPN is connected, read the VPN provider’s documentation and compare behavior in an environment where you are allowed to disconnect it. Do not disable a required work VPN just to make a public resolver work. A separate case is tethering. When troubleshooting a connected laptop, verify its settings separately using our Android hotspot guide. The phone and the laptop can follow different resolution paths.
Restore a known-good configuration
If websites and apps stop loading after the change, return to the option you recorded before beginning, then retest with the same network and application. If that restores connectivity, check the hostname and the provider’s service status before deciding whether to try again. If it does not, test another network and check whether the phone can reach the internet at all. This sequence is quicker than resetting all network settings, which can remove saved networks and other configuration.
When a name works publicly but fails on a home server or office network, check whether the name is meant to be resolved only by a local DNS service. A public resolver may have no record of it. Ask whoever manages that network for its expected setup. Keep a short note of the settings that work at home, on cellular data and with any managed VPN. That gives you a starting point if the problem returns after a phone update.
If the phone says it is connected but a new website fails, try one already open and then one you have never opened on that network. The first may continue through an existing connection or use a cached answer. Note the exact browser error, the current network and the time. Repeat with Automatic and your custom provider while leaving the other network settings alone. This comparison can make the difference between an intermittent resolver problem and a device that never had internet access on that particular Wi-Fi network in the first place.
Frequently asked questions
Can I enter an IP address?
Use the DNS-over-TLS provider hostname in Android’s hostname field. Check the provider’s setup instructions for the exact name.
Does it apply to every app?
Apps and VPNs can use their own resolution paths. Check the service that matters to you when confirming the behavior.
Why did hotel Wi-Fi stop working?
The network may require a portal sign-in or block the chosen resolver connection. Test Automatic, complete the portal sign-in, and then retest your provider.
