On Android 15, open Settings > Network & internet > Private DNS, tap Private DNS provider hostname, and type a hostname such as dns.google or one.one.one.one. The change applies system-wide to every app immediately — no reboot required. If the phone shows the cannot-be-reached error right after saving, the hostname has a typo or your network is blocking outbound port 853.

What Android Private DNS actually does

Android's Private DNS feature routes DNS queries over DNS over TLS (DoT), standardized in RFC 7858. Instead of sending plaintext lookups over UDP port 53, the phone opens an encrypted TLS connection to the resolver on port 853. Your ISP, the coffee-shop router, and anyone doing passive packet capture on the link cannot read your lookup traffic.

The Private DNS menu has three modes:

  • Off — uses whatever DNS the DHCP server provides, over plain UDP 53. No encryption.
  • Automatic — tries to upgrade the ISP-assigned resolver to DoT. If the resolver supports port 853, encrypted DoT is used. If not, Android falls back silently to plain DNS. You get encryption only if your ISP supports it.
  • Private DNS provider hostname — you specify the resolver. Android enforces DoT and will not fall back to plain DNS if the server is unreachable. This is the correct choice for guaranteed encryption with a specific resolver of your choosing.

Check your current setting before making any change

Before switching, confirm what Android is already using. Open Settings > Network & internet > Private DNS. If it shows Off or Automatic, your DNS is unencrypted or opportunistically encrypted via your ISP's resolver. If it already shows a hostname, a prior configuration or app set a custom resolver.

On Samsung, the path is Settings > Connections > More connection settings > Private DNS. On Xiaomi HyperOS and some Motorola builds running Android 15, look under Settings > Network & internet > Advanced > Private DNS. If you cannot find it at all, tap the magnifying glass in Settings and search Private DNS.

Step-by-step: stock Android 15 on Pixel devices

  1. Open Settings.
  2. Tap Network & internet.
  3. Tap Private DNS.
  4. Select Private DNS provider hostname.
  5. Enter one of the hostnames from the provider list below.
  6. Tap Save.
  7. Wait two seconds. Android tests the connection and shows a brief confirmation when the server is reachable.

Step-by-step: Samsung One UI 7 (Android 15)

  1. Open Settings.
  2. Tap Connections.
  3. Tap More connection settings.
  4. Tap Private DNS.
  5. Tap Custom — Samsung labels the manual-hostname option Custom, not Private DNS provider hostname.
  6. Enter the hostname in the text field.
  7. Tap Save.

Step-by-step: OnePlus, Xiaomi, and Motorola on Android 15

OnePlus OxygenOS 15: Settings > Wi-Fi & network > Private DNS. Xiaomi HyperOS and stock Motorola Android 15: Settings > Network & internet > Advanced > Private DNS. The nesting depth varies by firmware version. If you do not see Private DNS at the top level of Network settings, look for an Advanced expander at the bottom of that screen. Once found, the options and behavior are identical to stock Android.

Choosing a DNS provider: correct hostnames for Android DoT

Android requires a hostname, not an IP address. The hostname must match the TLS certificate the resolver presents on port 853. Entering 1.1.1.1 instead of one.one.one.one fails certificate validation immediately.

  • Google Public DNS: dns.google — global Anycast, DNSSEC-validating.
  • Cloudflare 1.1.1.1: one.one.one.one — fast Anycast, no-logging pledge, DNSSEC-validating.
  • Cloudflare malware-blocking: security.cloudflare-dns.com
  • Quad9: dns.quad9.net — blocks known malicious domains using threat intelligence feeds. Recommended for travel and public Wi-Fi.
  • AdGuard DNS (ad-blocking): dns.adguard-dns.com — blocks ads and trackers at the DNS layer across every app on the phone.
  • NextDNS (custom filtering): your unique subdomain from the NextDNS dashboard, e.g., abcde.dns.nextdns.io — per-device logs, custom blocklists, parental controls.

If you run a self-hosted resolver such as Pi-hole with DoT configured, it needs a publicly trusted TLS certificate. Android does not accept self-signed certificates for Private DNS. Use Let's Encrypt via a domain you control.

Tip: After changing your Private DNS hostname, verify the new resolver is answering correctly with our DNS Propagation Checker. Compare records from your old and new resolver. A difference usually means the new resolver is applying a blocklist — expected with Quad9 or AdGuard, a red flag with Google or Cloudflare.

The second method: per-network DNS via static IP on Wi-Fi

Private DNS applies to all networks simultaneously — every Wi-Fi network and your cellular connection. If you want a different resolver on just one Wi-Fi network, or if you need plain UDP port-53 DNS rather than DoT, use the static IP method on that specific network instead.

  1. Open Settings > Network & internet > Internet (or Wi-Fi on Samsung).
  2. Long-press the connected network name and tap Modify network. On some builds, tap the gear icon next to the network name instead.
  3. Tap Advanced options.
  4. Change IP settings from DHCP to Static.
  5. Android pre-fills the current IP and gateway. Leave those as-is to keep your existing address.
  6. In DNS 1 and DNS 2, enter resolver IP addresses — for example, 9.9.9.9 and 149.112.112.112 for Quad9.
  7. Tap Save.

Important: if Private DNS is set to a hostname in the global menu, it takes precedence over per-network DNS. Set Private DNS to Off first for the static-IP DNS settings to apply.

Verifying the DNS change worked

Android shows a brief confirmation when a hostname is reachable, but it does not show which resolver answered any given query. Use these methods for a genuine check.

From a connected computer using dig or nslookup

# Check resolver identity — TXT record returns the resolver IP dig whoami.ds.akahelp.net TXT +short # Query a specific resolver directly dig @9.9.9.9 example.com A +short # Windows built-in equivalent nslookup example.com 9.9.9.9

These commands run on Linux, macOS, and Windows. They test from your network's vantage point and confirm the resolver is reachable and answering correctly, without needing USB debugging on the phone.

Confirm port 853 is open from your network

# Linux / macOS: test TCP reachability on port 853 nc -zv dns.google 853 # Inspect the TLS certificate the resolver presents openssl s_client -connect dns.google:853 -servername dns.google 2>/dev/null | grep subject

If nc returns connection refused or times out, port 853 is blocked at the router or ISP level. That is the most common cause of the cannot-be-reached error on Android.

Android adb shell for developers

# Enable USB debugging in Developer options, then on your computer: adb shell getprop net.dns1 adb shell getprop net.dns2 # Live lookup from the phone's own network stack adb shell nslookup dns.google
Tip: Cross-check your new resolver's answers with our DNS Lookup tool. If a domain returns a different IP from the old resolver versus the new one, the new resolver is applying a blocklist — expected with Quad9 or AdGuard, a red flag with Google or Cloudflare.

Troubleshooting: Private DNS server cannot be reached

Work through these root causes in order of frequency:

  1. IP address instead of hostname. The field requires a TLS hostname such as dns.google, not 8.8.8.8. Android validates the TLS certificate against the hostname you entered. An IP address cannot match a certificate common name.
  2. Typo in the hostname. One wrong character breaks TLS validation. Copy-paste from a trusted source rather than typing freehand.
  3. Port 853 blocked. Corporate networks, school networks, and some ISPs block outbound TCP port 853. Run the nc test above to confirm. If blocked, use Automatic mode as a fallback, or configure DoH at the browser level instead — covered in the next section.
  4. Captive portal still active. Hotel and airport Wi-Fi intercept DNS until you complete the portal login page. Set Private DNS to Off, finish the portal login, then re-enable it.
  5. System clock out of sync. TLS certificate validation requires an accurate system clock. If the phone's time is off by more than a few minutes, TLS handshakes fail. Search Date and time in Settings and enable automatic time sync.
  6. Provider outage. Rare but real. Switch to Automatic temporarily and retry in 10 minutes, or try a different provider hostname.

DoT vs DoH: what Android 15 supports natively

The built-in Private DNS menu on Android 15 supports only DoT on port 853. DNS over HTTPS (DoH, port 443) is not exposed through the system UI. This matters because port 443 is almost never blocked, while port 853 sometimes is on managed or restricted networks. If port 853 is blocked on your current network, Android's native Private DNS will not work with a custom hostname — it fails hard rather than falling back to plain DNS.

For DoH, your options on Android 15 are:

  • Chrome on Android 15: Settings > Privacy and security > Use secure DNS — select a provider. Applies DoH inside Chrome only, not to other apps.
  • Firefox on Android: Settings > Privacy and Security, then the DNS over HTTPS option below it.
  • Cloudflare 1.1.1.1 app, NextDNS app, AdGuard DNS app: each creates a local VPN tunnel for system-wide DoH. Running a separate VPN simultaneously is not possible when these apps are active.

IPv6 and DNSSEC in 2026

On Android 15, if your carrier or home router assigns an IPv6 address, the phone attempts the DoT connection over IPv6 first using dual-stack happy eyeballs. All four major public resolvers — dns.google, one.one.one.one, dns.quad9.net, and dns.adguard-dns.com — support DoT over IPv6. On networks that advertise IPv6 prefixes but drop IPv6 packets in transit, the DoT connection stalls and Android shows cannot-be-reached even though the hostname and spelling are correct. To isolate this, run ping6 dns.google from a computer on the same network. If IPv6 ping fails while IPv4 succeeds, the issue is broken IPv6 transit on that network, not a DNS configuration error.

DNSSEC validation on Android 15 is handled by the upstream resolver, not the operating system itself. Quad9 validates DNSSEC signatures and returns SERVFAIL for broken chains. Cloudflare also validates. Google Public DNS validates but returns results regardless of DNSSEC status by default. If strict DNSSEC enforcement matters, Quad9 (dns.quad9.net) is the safest public choice.

Common misdiagnoses

  • VPN stops working after setting Private DNS. Most Android VPN clients take over the DNS stack entirely when connected. The VPN's own DNS setting applies and Private DNS is bypassed. Configure DNS inside your VPN app's settings, not in the system Private DNS menu.
  • DNS did not get faster. DNS latency savings measure in single-digit milliseconds and are rarely perceptible as faster page loads. The real reasons to switch are privacy and optional content filtering.
  • Still on ISP DNS after setting Automatic. Automatic mode still uses your ISP's resolver — it just adds opportunistic DoT encryption when the ISP supports it. To leave your ISP's resolver entirely, use hostname mode with a third-party provider.
  • Set static-IP DNS on Wi-Fi but nothing changed. Private DNS overrides per-network settings. Set Private DNS to Off in the main menu first.

After a firmware update: verify this setting

Samsung One UI major upgrades and some Xiaomi HyperOS updates have been documented to reset network settings, including the Private DNS hostname, as part of their migration process. After any major Android version upgrade, open the Private DNS menu and confirm your hostname is still saved. The check takes 20 seconds and prevents you from running on unencrypted ISP-controlled DNS for days without realizing it.

Outside of firmware upgrades, the Private DNS setting persists through app installs, security patches, reboots, and network changes. The reliable reset triggers are a factory reset, a major OEM firmware upgrade, and MDM policies pushed by an employer or school IT department. On a managed device, your IT policy may silently override any Private DNS hostname you set.