Your Android phone ships with whatever DNS server your carrier or router assigns, and that is rarely the fastest or most private option available. Whether you are tired of slow page loads, want to bypass restrictive filters, or simply want better privacy than your ISP's default resolver provides, changing your DNS on Android is one of the highest-value tweaks you can make in under five minutes. This guide covers every method available on Android 9 through Android 14, explains why each method works the way it does, and shows you how to confirm the change actually took effect.

Why Your Default DNS is Probably Not Good Enough

When you type a domain name into Chrome on your phone, Android sends a DNS query to a resolver — usually one operated by your mobile carrier or your home ISP. These resolvers are often slow, log your browsing history for ad targeting, and are occasionally used to redirect mistyped domains to sponsored search pages. Some ISPs even inject results to block content they do not want you to access.

Third-party DNS resolvers like Cloudflare (1.1.1.1), Google (8.8.8.8), Quad9 (9.9.9.9), or NextDNS offer faster response times, stronger privacy policies, and in some cases built-in malware or ad blocking at the DNS level. Switching to any of them costs nothing and takes no special technical knowledge.

Understanding the Two Main Methods on Android

Android gives you two distinct ways to change your DNS, and they work differently. Knowing which one to use matters:

  • Per-network Wi-Fi static DNS — applies only to a specific Wi-Fi network. Does not affect mobile data. Available on all Android versions.
  • Private DNS (DNS-over-TLS) — applies system-wide to all networks including mobile data. Encrypts your DNS queries in transit. Requires Android 9 (Pie) or later and a resolver that supports DNS-over-TLS.

For most people, Private DNS is the better choice because it covers all connections with a single setting. The Wi-Fi method is still useful if you want different DNS on different networks, or if you are running Android 8 or earlier.

Method 1: Private DNS (Recommended for Android 9 and Later)

Private DNS uses DNS-over-TLS, which encrypts your queries so your ISP cannot snoop on what domains you are resolving. Every major third-party resolver now supports it.

Step-by-Step Instructions

  1. Open Settings on your Android device.
  2. Tap Network and Internet (on stock Android). On Samsung One UI, this is under Connections. On Xiaomi MIUI, look under Wi-Fi and Mobile Networks or search for "Private DNS" in Settings search.
  3. Tap Private DNS. If you cannot find it, use the Settings search bar and type "Private DNS" — it is present on virtually every Android 9+ device even if buried differently.
  4. Select Private DNS provider hostname.
  5. Enter the hostname of your chosen resolver (not the IP address — this field requires a hostname for TLS certificate validation).
  6. Tap Save.

Hostnames for Popular Private DNS Providers

  • Cloudflare (1.1.1.1, privacy-focused): one.one.one.one
  • Cloudflare for Families (blocks malware): security.cloudflare-dns.com
  • Google Public DNS: dns.google
  • Quad9 (blocks malicious domains): dns.quad9.net
  • NextDNS (customizable): Your unique hostname from nextdns.io/setup, e.g. abc123.dns.nextdns.io
  • AdGuard DNS (blocks ads): dns.adguard-dns.com
💡 After saving your Private DNS setting, use the DNS Propagation Checker on a desktop to confirm your domain lookups are resolving from the resolver you selected, or check the verification steps below directly on your phone.

Method 2: Static DNS Per Wi-Fi Network (All Android Versions)

This method only changes DNS for one specific Wi-Fi network. It does not protect you on mobile data or other Wi-Fi networks. Use it if you need per-network control or are on Android 8 or earlier.

Step-by-Step Instructions

  1. Open Settings and go to Wi-Fi (or Network and Internet > Internet on stock Android 12+).
  2. Long-press the network you are connected to, then tap Modify Network. On newer Android versions, tap the gear icon next to the network name instead.
  3. Tap Advanced options to expand the section.
  4. Under IP settings, change the dropdown from DHCP to Static.
  5. Scroll down to the DNS 1 field. Enter your preferred DNS server IP, for example 1.1.1.1.
  6. In the DNS 2 field, enter a fallback IP, for example 1.0.0.1.
  7. Leave the IP address, gateway, and prefix length exactly as they were pre-filled — do not change these unless you know what you are doing, or you will lose connectivity.
  8. Tap Save.

Common IP Addresses for DNS 1 and DNS 2

  • Cloudflare: 1.1.1.1 / 1.0.0.1
  • Google: 8.8.8.8 / 8.8.4.4
  • Quad9: 9.9.9.9 / 149.112.112.112
  • OpenDNS: 208.67.222.222 / 208.67.220.220

Method 3: Router-Level DNS Change (Covers All Devices on Your Network)

If you want every device on your home network — phones, tablets, laptops, smart TVs — to use a better DNS resolver without touching each device individually, change the DNS on your router. Your Android phone will inherit the setting automatically via DHCP.

How to Access Your Router Admin Panel

  • Most routers (Netgear, Linksys, D-Link, TP-Link older models): http://192.168.1.1 or http://192.168.0.1
  • TP-Link (newer models): http://tplinkwifi.net
  • Netgear: http://routerlogin.net
  • ASUS: http://asusrouter.com

Once logged in, navigate to WAN Settings, Internet Setup, or DNS Settings (the exact path varies by brand), and enter your preferred DNS server IPs in the primary and secondary DNS fields. Save and reboot the router. Then forget and rejoin Wi-Fi on your Android device to pick up the new DHCP assignment.

How to Verify Your DNS Change Actually Worked

This is the step most guides skip, and it is the most important one. A setting that appears saved does not always mean the device is actually using it. Here are three ways to confirm.

Method A: Using a Browser Test Page

Navigate to https://one.one.one.one/help if you configured Cloudflare. The page will tell you explicitly whether your queries are reaching Cloudflare's resolver and whether DNS-over-TLS is active. Google has a similar page at https://dns.google.

Method B: Using the Termux Terminal App

Install Termux from F-Droid (the Play Store version is outdated) and run a query directly:

pkg install dnsutils nslookup dnschecker.ca # Look at the "Server:" line in the output. # It should show an address belonging to your chosen resolver.

You can also use dig for more detail:

dig dnschecker.ca # The ";; SERVER:" line at the bottom shows which resolver answered. # For Cloudflare you will see 1.1.1.1 or 2606:4700:4700::1111.

Method C: Using Our Online DNS Lookup Tool

Open your phone's browser and run a lookup using the DNS Lookup tool. If your Private DNS setting is working, the query will originate from your resolver's IP range rather than your ISP's resolver IP range. Compare the authoritative response you see against what you expect.

Troubleshooting: When Private DNS Does Not Seem to Work

Private DNS requires a working TLS connection on port 853. Some corporate networks, hotel Wi-Fi systems, and mobile carrier networks actively block port 853 to prevent customers from bypassing their resolvers. Here is how to diagnose this:

# In Termux, test if port 853 is reachable: nc -zv dns.google 853 # If you see "succeeded" you are fine. # If it times out, port 853 is blocked on this network.

If port 853 is blocked, your options are:

  • Use a VPN that bundles its own DNS resolver (Cloudflare's 1.1.1.1 app, Mullvad, ProtonVPN all do this).
  • Fall back to the per-Wi-Fi static DNS method with plain UDP on port 53 — less private but functional.
  • Use the 1.1.1.1 app from Cloudflare, which tunnels DNS over HTTPS (DoH) rather than TLS and works on more restrictive networks.

Private DNS Setting is Greyed Out

On some Samsung devices with MDM (Mobile Device Management) profiles installed — common on corporate or school-managed phones — the Private DNS option is locked by policy. If you are on a personal device and it is still greyed out, check whether you have an active VPN or a monitoring app installed by your employer. These can override DNS system-wide and block the setting from being changed.

Setting Reverts After Reboot

This is rare but has been reported on certain Xiaomi and Realme devices with aggressive battery optimization. Go to Settings > Battery > App battery saver and make sure no system policy is interfering. Also check that you tapped Save and did not just back out of the screen.

DNS Apps as an Alternative

If the native settings feel cumbersome or you need more control, dedicated apps can manage DNS without requiring root:

  • 1.1.1.1 by Cloudflare — free, sets up a local VPN tunnel to route DNS through Cloudflare. Includes WARP mode for encrypted traffic.
  • NextDNS — free tier available, highly customizable blocklists, parental controls, per-device analytics. The app configures Private DNS or a local VPN automatically.
  • AdGuard — blocks ads and trackers at the DNS level via a local VPN. Does not require root.

These apps use Android's VPN API to intercept DNS queries locally and forward them to their servers over an encrypted channel. The trade-off is a persistent VPN notification in your status bar and a small battery cost.

Which DNS Resolver Should You Choose

There is no single right answer, but here is a practical breakdown:

  • Best for speed: Cloudflare (1.1.1.1) consistently wins independent latency benchmarks for most regions. Google DNS is a close second with better redundancy in some areas.
  • Best for security: Quad9 (9.9.9.9) filters known malicious domains using threat intelligence from IBM X-Force and other sources. It does not log personally identifiable information.
  • Best for ad and tracker blocking: NextDNS or AdGuard DNS. Both offer customizable blocklists without installing anything on the device.
  • Best for privacy policy: Cloudflare commits to deleting all logs within 24 hours and has this audited annually. Quad9 is operated by a Swiss non-profit with strong legal protections.

Preventing Your ISP from Overriding Your DNS

Some mobile carriers and ISPs have begun intercepting UDP port 53 traffic and redirecting it to their own resolvers regardless of what IP you configure. Private DNS (DNS-over-TLS on port 853) bypasses this interception because the traffic is encrypted and goes to a different port. If you are using the plain UDP static DNS method and noticing your DNS setting appears ignored, this is likely what is happening. Switching to Private DNS solves it. If Private DNS is also being blocked, a full VPN is the only remaining option.

Changing DNS on Android is one of the simplest ways to immediately improve your privacy and sometimes your browsing speed. With Private DNS now built into every Android device from version 9 onward, there is no reason to stay on your carrier's default resolver. Pick a provider, enter the hostname, save, and verify — the whole process takes less than two minutes.