Android 12 ships with a built-in Private DNS feature that encrypts every DNS query leaving your phone — no app installs, no VPN required. If you have been browsing the web with your carrier's default DNS resolver, your ISP can see every domain name you visit in plain text. Private DNS changes that by forcing DNS-over-TLS (DoT) on all system-level traffic, including apps that don't have their own DNS settings. Setting it up takes about 90 seconds, but there are a handful of pitfalls that catch people out, and this guide covers all of them.

What Private DNS Actually Does on Android

Android's Private DNS feature, introduced in Android 9 Pie and refined in Android 12, implements DNS-over-TLS (DoT) on port 853. Every resolver query — whether from Chrome, Gmail, a third-party app, or the system itself — is wrapped in a TLS tunnel before it leaves the device. This prevents three specific problems:

  • ISP snooping: Your carrier can no longer see which domains you query, only that you're sending encrypted traffic to port 853.
  • DNS hijacking: Man-in-the-middle attackers on public Wi-Fi cannot redirect or spoof your DNS responses.
  • Unencrypted leaks from apps: Apps that rely on the system resolver (the vast majority) automatically benefit with zero code changes.

Private DNS does not hide your IP address, encrypt your actual web traffic, or replace a VPN. It solves specifically the DNS privacy problem — which is significant, since DNS leaks reveal your entire browsing pattern even when HTTPS is in use.

Prerequisites Before You Start

Before entering any DNS hostname, confirm the following:

  1. You are running Android 12 or later. Go to Settings → About phone → Android version to check.
  2. You have a working internet connection (Wi-Fi or mobile data). Private DNS requires connectivity to reach the resolver during setup.
  3. You know the hostname (not the IP address) of the DoT resolver you want to use. Common options are listed in the next section.
💡 Not sure if your chosen DNS provider is actually reachable? Run a quick check with our DNS Propagation Checker to confirm the provider's hostname resolves correctly before you lock it into your phone settings.

Choosing a Private DNS Provider

Android 12 requires a DoT hostname, not an IP address, when using the "Private DNS provider hostname" mode. These are the most reliable options:

  • Cloudflare (1.1.1.1): one.one.one.one — fast, no-logging policy, global anycast network.
  • Google Public DNS: dns.google — extremely reliable, well-documented SLA.
  • Quad9 (9.9.9.9): dns.quad9.net — blocks known malicious domains, privacy-focused, non-profit operated.
  • AdGuard DNS (default filter): dns.adguard.com — blocks ads and trackers at the DNS level across all apps.
  • NextDNS: yourid.dns.nextdns.io — fully customizable filtering, requires a free NextDNS account to get your unique ID.
  • Cloudflare for Families (malware block): security.cloudflare-dns.com

For most users who just want privacy without filtering, one.one.one.one or dns.google are the safest picks — both have well-known uptime records and published privacy policies.

Step-by-Step: Setting Up Private DNS on Android 12

The menu path varies slightly between manufacturers (Samsung, Pixel, OnePlus, Xiaomi), so both the stock Android path and common variants are included below.

Stock Android 12 (Pixel phones)

  1. Open Settings.
  2. Tap Network and internet.
  3. Tap Private DNS (it appears near the bottom of this menu).
  4. Select Private DNS provider hostname.
  5. Type the hostname of your chosen provider, for example: one.one.one.one
  6. Tap Save.

Android immediately attempts a TLS handshake with the resolver. If it fails (bad hostname, resolver unreachable), it shows an error and reverts. A successful save means the connection was validated.

Samsung Galaxy (One UI 4 / Android 12)

  1. Open Settings.
  2. Tap Connections.
  3. Tap More connection settings.
  4. Tap Private DNS.
  5. Select Custom and enter your hostname.
  6. Tap Save.

OnePlus / OxygenOS 12

  1. Open Settings.
  2. Tap Wi-Fi and Internet.
  3. Tap Private DNS.
  4. Select Private DNS provider hostname and enter the hostname.
  5. Tap Save.

Xiaomi / MIUI 13 (Android 12)

  1. Open Settings.
  2. Tap Connection and sharing.
  3. Scroll down and tap Private DNS.
  4. Select Use custom DNS and enter the hostname.
  5. Tap Save.

Verifying That Private DNS Is Working

Saving the setting is not enough — you need to confirm encrypted DNS queries are actually leaving the device. Use these methods:

Method 1: Cloudflare's Browser Test

Open Chrome or any browser on the Android device and navigate to https://1.1.1.1/help. Look for the line that says Using DNS over TLS (DoT): Yes. If you configured Cloudflare as your resolver and that line shows Yes, you are done.

Method 2: DNS Leak Test

Visit https://www.dnsleaktest.com from your Android browser and run the extended test. The resolvers listed should match the provider you configured (Cloudflare, Google, Quad9, etc.) rather than your ISP's servers.

Method 3: ADB Shell (Advanced)

If you have Android Debug Bridge installed on a PC and USB debugging enabled on the phone, connect and run:

adb shell getprop net.dns1 adb shell ndc resolver getconfig adb shell dumpsys connectivity | grep -i dns

The output should reference your chosen resolver's IP. If net.dns1 still shows your router's LAN IP (e.g., 192.168.1.1), it does not mean Private DNS is broken — the system still uses the LAN gateway at Layer 3 but wraps queries in TLS on the way out. The leak test in Method 2 is more definitive.

Method 4: DNS Lookup Tool

Use our DNS Lookup tool from the phone's browser to query a domain and observe the response. If queries resolve correctly after changing Private DNS, the resolver is operational.

Common Errors and How to Fix Them

"Couldn't save Private DNS — check your network and try again"

This error means Android tried to establish a TLS connection on port 853 and failed. Causes and fixes:

  • Typo in hostname: Double-check the exact spelling. one.one.one.one not 1.1.1.1 (IP addresses are rejected).
  • Port 853 blocked by router or ISP: Some corporate routers and certain ISPs block port 853 outbound. Switch to mobile data and retry. If it works on mobile data but not Wi-Fi, the router is the culprit. Log into your router admin panel and ensure TCP/UDP port 853 outbound is not blocked in firewall rules.
  • Captive portal not dismissed: On public Wi-Fi, the captive portal login page may intercept the TLS test. Complete the portal login first.
  • VPN conflict: If a VPN is active and set to block port 853 or DNS, it will prevent validation. Temporarily disable the VPN, set Private DNS, then re-enable the VPN.

Private DNS Saves but Queries Still Go to the ISP Resolver

This occasionally happens with Samsung One UI due to a Wi-Fi network profile conflict. Fix it by:

  1. Going to Settings → Connections → Wi-Fi.
  2. Long-pressing your active Wi-Fi network.
  3. Selecting Manage network settings.
  4. Setting IP settings to Static, then switching back to DHCP and saving.
  5. Reconnecting to Wi-Fi and re-verifying with a leak test.

Private DNS Breaks Certain Apps or Captive Portal Detection

A handful of apps and enterprise Wi-Fi networks depend on unencrypted DNS for local split-horizon resolution or captive portal detection. If specific apps stop working after enabling Private DNS, set the mode back to Automatic on those networks. Android's Automatic mode still attempts opportunistic DoT but falls back gracefully to unencrypted DNS when DoT is unavailable — a reasonable compromise for enterprise environments.

Private DNS vs. Manual DNS in Wi-Fi Settings

Many users confuse Private DNS with the DNS fields inside individual Wi-Fi network settings (Settings → Wi-Fi → your network → pencil icon → Advanced → DNS). Those fields accept IP addresses and send queries in plain text. They are useful for changing which resolver handles your queries on one specific network, but they offer zero encryption. Private DNS is system-wide, encrypted, and applies across all Wi-Fi networks and mobile data simultaneously. Always prefer Private DNS over manual Wi-Fi DNS for privacy.

Using NextDNS for Custom Filtering

If you want DNS-level ad blocking or parental controls without a separate app, NextDNS offers a free tier with detailed per-device query logs. After creating a free account at nextdns.io, your dashboard provides a unique ID such as ab12cd. Enter the following as your Private DNS hostname:

ab12cd.dns.nextdns.io

Replace ab12cd with your actual ID. NextDNS validates the TLS connection the same way as other providers, so the save process is identical. Once configured, every blocked domain shows up in your NextDNS query log in real time.

How to Disable Private DNS

If you need to revert to default behavior — for troubleshooting, corporate MDM compliance, or any other reason — go back to Settings → Network and internet → Private DNS and select Off (stock Android) or Automatic. Automatic mode attempts DoT opportunistically but never hard-fails if it's unavailable, which is a less strict but more compatible setting.

Keeping Private DNS Active During a Reset

Android's Private DNS setting persists across reboots and app updates, but it is wiped by a factory reset. After any factory reset, your first connectivity task should be restoring the Private DNS hostname. Consider noting the exact hostname you use in a password manager or secure note so the restore takes seconds rather than requiring you to look it up again.

Summary

Private DNS on Android 12 is one of the most impactful privacy settings available — free, built-in, and covering the entire device with a single hostname entry. The setup is straightforward on all major Android skins, and verification takes under two minutes with a browser-based leak test. If port 853 is blocked at the network level, mobile data bypasses the restriction instantly. For users who want ad blocking on top of encryption, NextDNS and AdGuard DNS are both solid choices that plug directly into the same settings menu without requiring any additional apps.