On Android 9 (Pie) and later, turn on encrypted DNS at Settings > Network and Internet > Private DNS (the label may be under Advanced). Choose Automatic for Android’s network-provided secure transport, or choose Private DNS provider hostname and enter a provider such as dns.google or one.one.one.one. Save the setting, then perform a fresh hostname lookup. If you use Cloudflare, open 1.1.1.1/help and confirm that Using DNS over TLS (DoT) says Yes.
Private DNS encrypts DNS questions and answers. It does not encrypt all application traffic, replace a VPN, or guarantee anonymity. VPNs, carrier VPN features, and DNS-changing apps can supersede Android’s setting, so verification must account for those layers.
As an Amazon Associate I earn from qualifying purchases.
What Private DNS is—and what it is not
DNS (the Domain Name System) converts a hostname such as example.com into the IP address an app needs to connect. Ordinary DNS can be visible to the network carrying the request. Android’s Private DNS feature uses DNS-over-TLS (DoT), which encrypts the connection between the operating system’s resolver and the DNS provider.
Recommended Free Tools
That protection covers the DNS question and the answer. It does not encrypt the web page, video stream, message, file transfer, or other application traffic after the address is resolved. Android Help states: “Private DNS helps secure only DNS questions and answers. It can’t protect anything else.” A site may still use HTTPS to protect its own traffic, but Private DNS is not a substitute for HTTPS or a VPN.
#1 Best Overall
- YOUR CONTENT, SUPER SMOOTH: The ultra-clear 6.7" FHD+ Super AMOLED display of Galaxy A17 5G helps bring your content to life, whether you're scrolling through recipes or video chatting with loved ones.¹
- LIVE FAST. CHARGE FASTER: Focus more on the moment and less on your battery percentage with Galaxy A17 5G. Super Fast Charging powers up your battery so you can get back to life sooner.²
- MEMORIES MADE PICTURE PERFECT: Capture every angle in stunning clarity, from wide family photos to close-ups of friends, with the triple-lens camera on Galaxy A17 5G.
- NEED MORE STORAGE? WE HAVE YOU COVERED: With an improved 2TB of expandable storage, Galaxy A17 5G makes it easy to keep cherished photos, videos and important files readily accessible whenever you need them.³
- BUILT TO LAST: With an improved IP54 rating, Galaxy A17 5G is even more durable than before.⁴ It’s built to resist splashes and dust and comes with a stronger yet slimmer Gorilla Glass Victus front and Glass Fiber Reinforced Polymer back.
Android 9 (Pie) introduced the built-in, system-wide Private DNS control. Android versions older than 9 do not provide this same system-wide DNS-over-TLS feature. Their static-DNS workaround is configured separately for each Wi-Fi network and does not automatically cover cellular data.
Check compatibility and competing network controls first
- Android version: Use the built-in control on Android 9 or later. Menu names differ among manufacturers and Android releases.
- Network access: Have a working Wi-Fi or cellular connection. A captive-portal network may require sign-in before encrypted DNS can work.
- VPNs and DNS apps: A VPN, a carrier’s VPN feature, or a DNS-changer app can route DNS through its own service. The result may differ from the Private DNS selection.
- One hostname only: Android’s custom-provider field expects a provider hostname, not an IP address, URL, or a list of servers.
If the Private DNS item is not visible, open Settings search and search for Private DNS. Some devices place it at Settings > Network and Internet > Advanced > Private DNS; manufacturer wording can vary.
Turn on Private DNS on Android 9 and later
- Open Settings.
- Tap Network and Internet. On some phones this may be called Connections or appear under a similarly named network section.
- Tap Private DNS. If it is not on the first screen, tap Advanced first, or use Settings search.
- Choose one of the three modes: Off, Automatic, or Private DNS provider hostname.
- If you choose a provider hostname, enter exactly one hostname and tap Save.
Off
Off disables Android’s Private DNS feature. DNS behavior then depends on the network and any VPN or DNS application in use. Select this only when diagnosing a connection problem or when another layer is intentionally handling DNS.
Automatic
Automatic lets Android use the network’s resolver with its supported secure transport. This is the least manual option and avoids committing the phone to a particular public provider. It is useful when you want Android to negotiate the secure behavior available on the current network rather than hard-code a provider.
Private DNS provider hostname
This mode sends DNS-over-TLS requests to the hostname you enter. The hostname must be spelled exactly, without https://, a path, a port, or spaces. After tapping Save, Android attempts to establish the secure DNS connection. If it cannot, Android may display a message such as “Private DNS server cannot be accessed” or “Private DNS cannot connect.”
Rank #2
- Carrier: This phone is locked to Tracfone, which means this device can only be used on the Tracfone wireless network. Tracfone plan required, activating is easy, just 3 steps.
- DISPLAY: Immersive viewing on a 6.7-inch super-bright 120Hz display with powerful stereo speakers and Bass Boost for cinematic entertainment.
- CAMERA SYSTEM: Advanced 50MP Quad Pixel camera captures sharp, detailed photos and videos in any lighting condition
- PERFORMANCE: Lightning-fast 5G connectivity paired with a powerful processor and RAM Boost for smooth multitasking.
- BATTERY LIFE: Long-lasting 5000mAh battery with TurboPower charging technology delivers hours of power in minutes.
Provider hostnames you can enter
The following hostnames are documented by the providers and are accepted as Android Private DNS entries. Filtering changes which names resolve; it does not turn the service into a general content filter for traffic that uses a different DNS path.
| Provider option | Hostname to enter | Policy described by the provider | Verification page |
|---|---|---|---|
| Google Public DNS | dns.google |
Standard public DNS resolver; the supplied documentation does not describe malware or adult-content filtering for this hostname. | A provider-specific verification page is not established here; use a fresh hostname lookup and check for competing VPN or DNS-app settings. |
| Cloudflare standard resolver | one.one.one.one |
Standard resolver without the malware/adult-content filtering described for the two policy-specific hostnames below. | 1.1.1.1/help or 1.0.0.1/help; check “Using DNS over TLS (DoT)” = “Yes”. |
| Cloudflare malware blocking | security.cloudflare-dns.com |
Blocks domains identified by Cloudflare as malware; the supplied setup information does not establish broader blocking guarantees. | 1.1.1.1/help or 1.0.0.1/help; check “Using DNS over TLS (DoT)” = “Yes”. |
| Cloudflare malware and adult-content blocking | family.cloudflare-dns.com |
Blocks domains identified for malware and adult content under Cloudflare’s family resolver policy. | 1.1.1.1/help or 1.0.0.1/help; check “Using DNS over TLS (DoT)” = “Yes”. |
Do not choose a resolver because it is assumed to be universally fastest or most private. DNS performance and privacy characteristics depend on location, the network, provider policy, and whether another app or VPN is handling DNS. Choose Automatic when you want Android to follow the network’s secure capability, or choose a fixed hostname when you specifically want the policy of that provider.
Free tools Windows power users keep installed
One-click scans. No signup required.
How to verify that Private DNS is actually working
Seeing Private DNS selected in Settings confirms the preference was saved, not that every lookup is currently using it. Verify from a fresh request and consider the effect of caches, VPNs, and DNS apps.
1. Perform a fresh hostname-resolution test
- Leave Private DNS enabled and connected to the Wi-Fi or cellular network you want to test.
- Open a browser and visit a hostname URL that you have not just loaded, or refresh a page several times after closing and reopening the browser.
- Confirm that the hostname resolves and the page loads normally. Google describes this as a basic resolver test.
- If you changed providers, repeat the test after the change. A page already stored in the browser or operating-system cache can load without a new DNS query, so one instant page load is not conclusive.
This test shows that name resolution works. It does not identify which provider answered, and it cannot by itself prove that the connection used DNS-over-TLS.
2. Use Cloudflare’s DoT check when Cloudflare is configured
If the Private DNS hostname is one of Cloudflare’s entries, open 1.1.1.1/help or 1.0.0.1/help. Find the field labeled Using DNS over TLS (DoT). Cloudflare’s instruction, updated June 23, 2026, is to verify that this field shows Yes.
Rank #3
- YOUR CONTENT, SUPER SMOOTH: The ultra-clear 6.7" FHD+ Super AMOLED display of Galaxy A17 5G helps bring your content to life, whether you're scrolling through recipes or video chatting with loved ones.¹
- LIVE FAST. CHARGE FASTER: Focus more on the moment and less on your battery percentage with Galaxy A17 5G. Super Fast Charging powers up your battery so you can get back to life sooner.²
- MEMORIES MADE PICTURE PERFECT: Capture every angle in stunning clarity, from wide family photos to close-ups of friends, with the triple-lens camera on Galaxy A17 5G.
- NEED MORE STORAGE? WE HAVE YOU COVERED: With an improved 2TB of expandable storage, Galaxy A17 5G makes it easy to keep cherished photos, videos and important files readily accessible whenever you need them.³
- BUILT TO LAST: With an improved IP54 rating, Galaxy A17 5G is even more durable than before.⁴ It’s built to resist splashes and dust and comes with a stronger yet slimmer Gorilla Glass Victus front and Glass Fiber Reinforced Polymer back.
This page is provider-specific. A result of Yes demonstrates that the tested connection reached Cloudflare using DoT; it does not prove that Google’s resolver, another provider, or a VPN’s resolver is being used. If you entered dns.google, use the fresh-resolution test and inspect VPN or DNS-app behavior rather than treating the Cloudflare page as a Google test.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
3. Distinguish DNS failure from general connectivity failure
- Hostname test fails, fixed-IP test works: suspect DNS configuration, the provider hostname, a blocked DoT connection, or an overriding VPN/DNS app.
- Hostname and fixed-IP tests both fail: investigate general connectivity, a captive portal, VPN routing, carrier restrictions, or network blocking before changing the DNS hostname.
A fixed-IP test bypasses hostname resolution, so it is useful as a diagnostic comparison. It does not prove that all other traffic is healthy or that Private DNS is correctly configured.
Fix “Private DNS cannot connect” and related errors
Check the hostname syntax
Return to Settings > Network and Internet > Private DNS and re-enter the hostname exactly. Use dns.google, one.one.one.one, security.cloudflare-dns.com, or family.cloudflare-dns.com as appropriate. Do not paste a complete web address such as https://one.one.one.one; Android expects only the hostname.
Test the network before testing the resolver
Open an ordinary website or app. On hotel, airport, school, or other captive-portal Wi-Fi, first complete the network’s sign-in page. Cloudflare notes that static DNS settings can interfere with captive-portal Wi-Fi; the same practical issue means you may need to connect to the portal before restoring a fixed DNS configuration. If the portal does not appear, temporarily choose Automatic or Off, complete sign-in, then restore the intended Private DNS mode.
Temporarily remove competing VPN or DNS layers
Disable a VPN, carrier VPN feature, or DNS-changer app briefly and test again. If the error disappears, the competing layer was overriding or blocking Android’s Private DNS path. Re-enable only the configuration you actually intend to use. A VPN may deliberately provide its own DNS, so Android’s selected hostname will not necessarily be the resolver used inside the tunnel.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #4
- PRIVACY DISPLAY: Automatically hide your screen from those beside you. The built-in privacy display can be preset¹ to turn on when receiving notifications, typing passwords, or using specific apps
- TYPE IT IN. TRANSFORM IT FAST: Enhance any shot in seconds on your smartphone by using Photo Assist² with Galaxy AI.³ Add objects, restore details, or apply new styles by simply typing or tapping
- NIGHTS, CAPTURED CLEARLY: From gigs to city lights, record and capture moments after dark with clarity using Nightography so your photos and videos stay crisp and clear on your Samsung Galaxy
- MAKE IT. EDIT IT. SHARE IT: Turn everyday moments into something personal with creative tools built right into your mobile phone, whether it’s a special contact photo, custom wallpaper, an invitation or more⁴
- HELP THAT KEEPS UP: Stay in the moment while Now Nudge with Galaxy AI helps you respond faster and stay organized with smart suggestions⁵ that appear exactly when you need them on your phone
Try Automatic to isolate provider-specific problems
Select Automatic and test a fresh hostname lookup. If Automatic works but a custom hostname fails, the issue is likely the custom provider path, a misspelled hostname, or a network that blocks that DoT endpoint. If Automatic also fails, troubleshoot the network, captive portal, VPN, or carrier path rather than repeatedly changing public providers.
Consider network blocking
Some networks restrict encrypted DNS or block particular resolver endpoints. Test on both Wi-Fi and cellular when possible. Cloudflare’s Android documentation says that a configured Private DNS resolver is used on all networks, including cellular, but a VPN or DNS-changing application can supersede the operating-system setting. A difference between Wi-Fi and cellular therefore may indicate network policy or an active app, not an Android menu problem.
Private DNS across Wi-Fi, cellular, VPNs, and apps
When Android’s Private DNS is configured, it is intended to apply across Wi-Fi and cellular connections. Cloudflare describes this behavior as using the configured resolver “on all networks — including cellular.” Switching from a home router to mobile data should not require entering the hostname again.
That system-wide scope has important exceptions:
- VPN tunnel: The VPN may route DNS inside the tunnel and ignore the Android Private DNS selection.
- Carrier VPN feature: A carrier-provided secure connection can impose its own resolver behavior.
- DNS-changer app: An app that creates a local VPN or otherwise intercepts DNS can replace the operating-system transport.
- App-specific DNS: An app can implement its own DNS transport. Android Developers warns that custom app DNS transports can bypass Android’s built-in transport security. Using the OS resolver with a known secure provider reduces that risk, but it cannot force an app to obey the OS resolver.
For a trustworthy check, record which VPN or DNS app is enabled, disable it for the test, run the fresh lookup, and then decide whether the app or Android should be the single source of DNS policy.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhat to do on Android 8 and older
Phones older than Android 9 lack Android’s built-in, system-wide Private DNS control. You can usually set DNS manually for an individual Wi-Fi network:
Best Value
- Carrier: This phone is locked to Tracfone, which means this device can only be used on the Tracfone wireless network. Activating is easy, just 3 steps.
- ACTIVATION Promotion: Includes 1500 min, 1500 texts & 1500 MB Data + add more as you need it
- CAMERA SYSTEM: 50MP Quad Pixel camera. Capture sharper, more vibrant photos day or night with 4x the light sensitivity.
- PERFORMANCE: Blazing-fast Qualcomm performance. Get the speed you need for great entertainment with a Snapdragon 680 processor and 4GB of RAM.
- 64GB built-in storage. Get plenty of room for photos, movies, songs, and apps. Made for US
- Open the phone’s Wi-Fi settings and select the connected network’s edit or advanced options.
- Change the IP settings from DHCP to Static if that is the terminology on the device.
- Enter the DNS server addresses supplied by the resolver you choose, then save and reconnect.
- Test a fresh hostname lookup after reconnecting.
The exact labels and fields vary by manufacturer, and this method is not equivalent to Android Private DNS. It applies only to that Wi-Fi network, does not automatically cover cellular data, and can interfere with captive-portal sign-in. Restore DHCP or remove the static entries when leaving a network that requires a portal.
Choose the mode that matches your goal
Use Automatic when you want the least maintenance
Automatic avoids manually selecting a public provider and lets Android use the network’s supported secure transport. It is a sensible default for a phone used on many networks, provided your VPN or DNS apps are not taking over.
Use a fixed hostname for a defined resolver policy
Select a custom hostname when you need a specific provider or filtering policy. The standard Cloudflare hostname does not have the malware and adult-content policy attached to the two family-oriented hostnames. Google’s dns.google entry is a separate provider choice. A fixed provider also makes troubleshooting easier because the expected endpoint is known.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Use Off only for diagnosis or deliberate replacement
Off is appropriate temporarily when a captive portal, VPN, or network requires ordinary DNS during setup. If you leave it off, DNS protection depends on whatever resolver the network or another application supplies.
Security limits and privacy expectations
DNS-over-TLS prevents the network from reading the DNS messages in transit as ordinary unencrypted DNS. The DNS provider can still receive the queries needed to answer them, and the destination service can still observe connections made to its own servers. Private DNS does not hide an IP address from every observer, encrypt non-DNS traffic, prevent tracking cookies, or make browsing anonymous.
HTTPS, app-level encryption, and a VPN address different parts of the connection. A VPN may also supersede Private DNS, so enabling both does not mean that two independent DNS protections are stacked. Verify the path actually in use instead of assuming that the Android toggle controls every app.
Quick Recap
Quick checklist
- Confirm the phone runs Android 9 or later.
- Open Settings > Network and Internet > Private DNS, using Advanced or Settings search if necessary.
- Choose Automatic or enter one exact provider hostname.
- Tap Save and wait for the connection to return.
- Disable competing VPN or DNS-changer layers for diagnosis.
- Run a fresh hostname lookup rather than relying on a cached page.
- If using Cloudflare, check 1.1.1.1/help or 1.0.0.1/help for Using DNS over TLS (DoT): Yes.
- Remember that Private DNS protects DNS questions and answers only.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
