Change DNS on Android: 5 Easy Steps

Every website you visit starts with a DNS lookup — your phone asking “what is the IP address of this domain?” By default, that question goes to your carrier or ISP in plain text, which means they can see, log, and even manipulate every site you look up. Learning how to change Private DNS on Android encrypts those lookups, closing one of the biggest privacy gaps most phone owners do not know they have.

The process takes under two minutes, requires no extra app, and works on any phone running Android 9 or newer. This guide walks through exactly how to change Private DNS on Android in five easy steps, explains which DNS hostnames are worth using, and covers what to do when something does not connect.

DNS Changes That Do Not Stick (and Why)

If your custom DNS keeps reverting, the culprit is usually one of three things. First, some carrier-branded phones override Private DNS on the carrier’s own network — the setting holds on Wi-Fi but silently falls back on mobile data. Test by checking dnsleaktest.com on both connections. Second, VPN apps override Private DNS entirely while connected; that is by design, since the VPN provides its own DNS. Third, a few enterprise-managed phones have the setting locked by device policy — check for a briefcase badge on the Settings icon.

Per-network DNS (long-press a Wi-Fi network > Modify > Advanced > IP settings Static) only applies to that one network and is forgotten if you reset network settings. Private DNS hostname mode is the setting that roams with you across every network, which is why it is the recommended approach. If you need different DNS at home versus on the go, automation apps like Tasker can toggle the Private DNS hostname based on the connected Wi-Fi SSID.

What Is Private DNS (and DNS-over-TLS)?

DNS is the internet’s phone book: it translates human-readable domains like example.com into IP addresses your phone can reach. Traditionally these queries travel unencrypted over UDP port 53, visible to anyone on the network path — your mobile carrier, the coffee-shop Wi-Fi operator, or an attacker on the same network.

Private DNS is Android’s built-in name for DNS-over-TLS (DoT). Instead of sending queries in the clear, your phone opens an encrypted TLS connection (port 853) to the DNS provider you choose. The contents of your lookups stay private between you and that provider. It is not a VPN — it does not hide your IP address or encrypt your actual traffic — but it removes one of the easiest surveillance points on the network.

Why You Should Change Private DNS on Android

There are four practical reasons to change Private DNS on Android instead of leaving the default:

Privacy. Your carrier can no longer see or sell a log of every domain you resolve. You shift that trust to a single provider you choose — ideally one with a published no-logging policy.

Ad and tracker blocking. Providers like AdGuard operate DNS hostnames that block ad and tracking domains at the lookup level. Ads simply fail to resolve, which works across every app and browser without installing anything.

Speed. Large public resolvers like Google’s and Cloudflare’s often answer queries faster than carrier DNS, especially on congested mobile networks. The difference is measured in milliseconds per lookup, but it adds up across a browsing session.

Bypassing ISP-level filtering. Some carriers redirect mistyped domains to their own search pages or block specific sites at the DNS level. A third-party encrypted resolver sidesteps both behaviors.

The trade-off is trust: you are handing your DNS history to one company instead of your carrier. Pick a provider whose privacy policy you have actually read.

Before You Start: What You Need

• Android 9 (Pie) or newer. Private DNS arrived in Android 9. On older versions, you need a third-party app instead.
• A DNS hostname. You do not type an IP address — you type a hostname like dns.google or one.one.one.one. A comparison table follows in the steps section.
• Two minutes. No root, no downloads, no account required.

How to Change Private DNS on Android: 5 Easy Steps

Step 1: Open Settings and find the Private DNS option. Go to Settings > Network & Internet > Private DNS. On Samsung Galaxy phones (One UI), the path is Settings > Connections > More connection settings > Private DNS. On some Xiaomi and Oppo phones, look under Settings > Connection & sharing.

Step 2: Select “Private DNS provider hostname.” You will see three options: Off, Automatic, and Private DNS provider hostname. “Automatic” uses encrypted DNS only if your carrier supports it — which most do not — so choose the hostname option for a guaranteed encrypted connection.

Step 3: Type your chosen hostname. Enter one of the hostnames from the table below, exactly as shown (no https://, no trailing slash), then tap Save. The most popular choices:

Step 4: Verify the connection is active. Reopen the Private DNS screen — it should still show your hostname. Then visit a DNS leak test site in your browser to confirm queries now resolve through your chosen provider instead of your carrier.

Step 5: Test your daily apps. Open your browser, email, and banking apps to confirm everything loads normally. If an app misbehaves, the troubleshooting section below has fixes.

Private DNS vs DNS-over-HTTPS: What Is the Difference?

You may have heard of DNS-over-HTTPS (DoH) — the same idea as Private DNS, but tunneled through HTTPS on port 443 instead of a dedicated TLS port. Browsers like Chrome and Firefox use DoH for their own traffic, while Android’s Private DNS setting uses DNS-over-TLS (DoT) for the entire system.

In practice, the privacy outcome is nearly identical: your lookups are encrypted between your phone and the resolver. DoT has one practical advantage on Android — it applies system-wide, covering every app, not just the browser. DoH’s advantage is stealth: because it looks like ordinary web traffic, networks that block port 853 cannot easily block it. If you are on a restrictive network where Private DNS fails to connect, enabling Secure DNS inside Chrome (Settings > Privacy and security > Use secure DNS) gives your browsing the same protection even while the system setting stays off.

One caveat: when both are active, Chrome’s Secure DNS overrides the system resolver for browser traffic. That is fine — both are encrypted — but be aware your browser and your apps may be using different providers if you configure them separately.

How to Change Private DNS on Different Android Skins

The setting lives in slightly different places depending on your manufacturer:

• Google Pixel / stock Android: Settings > Network & Internet > Private DNS.
• Samsung Galaxy (One UI): Settings > Connections > More connection settings > Private DNS.
• OnePlus (OxygenOS): Settings > Wi-Fi & Network > Private DNS.
• Xiaomi (MIUI/HyperOS): Settings > Connection & sharing > Private DNS.
• Oppo/Realme (ColorOS): Settings > Connection & sharing > Private DNS.

If you cannot find it, use the search bar at the top of the Settings app and type “Private DNS” — Android will jump you straight to it. On Android 12 and newer, you can also long-press the Internet tile in Quick Settings, tap the gear icon, and find Private DNS in the network settings.

How to Verify It Is Working

The quickest check is a DNS leak test: with Private DNS set and no VPN active, the test should list your DNS provider’s servers (for example, Cloudflare’s) rather than your carrier’s. You can also test ad blocking directly — with dns.adguard.com set, banner ads in free apps and mobile sites should largely disappear within a few minutes as cached DNS entries expire.

Go Deeper With Your Android Settings

Private DNS is one of several under-the-hood tweaks worth knowing. Our guide to Android Developer Options: 10 safe tweaks covers animation scaling, background process limits, and other settings that are safe to change. If privacy is your motivation, pair encrypted DNS with our 13 proven tips to reduce mobile data usage — several of them also cut background tracking. And if you travel, our eSIM setup guide for US carriers explains how to get local data abroad, where carrier DNS logging can be even more aggressive.

For authoritative references, Google documents its resolver in the Google Public DNS documentation, and Cloudflare explains its privacy commitments on the Cloudflare 1.1.1.1 DNS page.

Troubleshooting Private DNS Problems

“Couldn’t connect” error after saving. Double-check the hostname for typos — dns.google, not dns.google.com. Some corporate and school Wi-Fi networks block port 853 entirely; on those networks, temporarily switch Private DNS to Off.

Some apps or sites stop loading. A few banking and streaming apps pin their own DNS or distrust third-party resolvers. If one app breaks, you can usually whitelist it rather than disabling Private DNS globally — or switch to dns.google, which causes the fewest compatibility issues.

Captive portals (hotel/airport Wi-Fi) fail. Login portals often need plain DNS to redirect you to the sign-in page. Turn Private DNS off, complete the portal login, then turn it back on.

Carrier blocks the setting. A small number of carrier-branded phones hide the Private DNS menu. Search Settings for “Private DNS” directly; if it is truly absent, the 1.1.1.1 app from Cloudflare provides the same encryption through a local VPN loop.

When NOT to Change Private DNS

Encrypted DNS is not always the right call. If you rely on parental-control filtering enforced at the router level, custom DNS bypasses it. Some workplaces require their own DNS for internal sites and threat monitoring — check with IT before changing it on a work profile. And if your carrier offers genuinely faster local DNS with no logging concerns that bother you, the privacy gain may not outweigh the hassle.

Do You Still Need a VPN After You Change Private DNS on Android?

Short answer: they do different jobs, so one does not replace the other. When you change Private DNS on Android, you encrypt the address lookups — nobody on the network sees which domains you request. But your carrier still sees the IP addresses you connect to, and websites still see your real IP address and location.

A VPN encrypts everything and masks your IP, which Private DNS cannot do. Conversely, a VPN does not automatically encrypt DNS — many VPN apps leak DNS queries to the carrier unless configured carefully. The strongest setup runs both: Private DNS guarantees your lookups are encrypted even if the VPN drops, and the VPN hides the traffic itself. If you only pick one, pick based on your threat: choose Private DNS for everyday privacy hygiene, a VPN when you need location masking or protection on hostile networks.

FAQ

Does changing Private DNS on Android slow down my internet?

Usually the opposite. Major public resolvers answer queries in 10–20 ms, often faster than carrier DNS. Your actual download speeds are unaffected — DNS only influences how quickly a connection starts, not how fast data flows.

Is Private DNS the same as a VPN?

No. When you change Private DNS on Android, only your DNS lookups are encrypted. A VPN encrypts all traffic and hides your IP address. They solve different problems and work fine together — many privacy-conscious users run both.

Which Private DNS hostname is best for privacy?

Cloudflare’s one.one.one.one and Quad9’s dns.quad9.net both publish audited no-logging policies and are the strongest privacy picks. Google’s dns.google is fastest for many users but logs with Google’s standard privacy policy. Choose based on whether you prioritize speed or data minimization.

Will Private DNS block ads?

Only if you choose a filtering hostname. dns.adguard.com blocks ad and tracker domains at the DNS level across all apps. dns.google and one.one.one.one do not filter anything — they just resolve faster and more privately.

Why does my phone say Private DNS is “Automatic”?

Automatic mode attempts encrypted DNS but silently falls back to your carrier’s plain DNS when the network does not support it — which defeats the purpose. Selecting a provider hostname forces encryption and is the only mode worth using.

Conclusion

It takes two minutes to change Private DNS on Android, and it closes one of the easiest privacy leaks on your phone. For most people, one.one.one.one is the sweet spot — audited privacy, excellent speed, zero configuration beyond typing the hostname. If you want ad blocking thrown in, use dns.adguard.com instead. Either way, your carrier no longer gets a free log of everywhere you go online.