Almost everything you do on the internet starts with a DNS query, so having secure communication with a DNS provider is essential. This is where Android's Private DNS feature comes into play.

What Is Private DNS on Android?

DNS is a building block of the modern internet. It acts as a directory or phonebook and helps you reach wherever you want to go on the web.

For example, when you want to visit How-To Geek, you simply type howtogeek.com in the address bar of a web browser. But, unfortunately, your web browser doesn't know how to get to How-To Geek. That's where DNS comes into the picture. Your web browser asks the DNS server, typically run by your internet service provider (ISP) or cellular network, which converts the howtogeek.com domain name to an IP address, like 151.101.2.217

With the IP address in hand, your web browser can now connect to your favorite resource for how-to articles.

But traditionally, the DNS queries and their responses were sent without any kind of security or encryption, making them vulnerable to eavesdropping or man-in-the-middle attacks. So, a new DNS protocol—DNS over TLS—was introduced. It creates a secure channel between your web browser and the DNS server and safeguards your DNS traffic from prying eyes and malicious third parties. DNS over TLS isn't the only secure DNS protocol, DNS over HTTPS is another protocol that is used widely.

Google has brought DNS over TLS support to Android by introducing the Private DNS feature. It's available in Android 9 (Pie) and higher and encrypts all DNS traffic on the phone, including from apps.

The feature is enabled by default and uses a secure channel to connect to the DNS server if the server supports it. But if your ISP or cell service provider's DNS doesn't have encrypted DNS support, or you are simply not sure about it, you can use a third-party secure DNS server using the Private DNS feature. Here's how to enable, disable, or use a private DNS provider in Android.

How to Manage the Private DNS Feature in Android

To manage Private DNS options, you need to go to Settings > Network & Internet > Private DNS. First, swipe down from the top of your device once or twice to access the notification shade and tap the gear icon to access the device settings.

Once you are in the settings, tap "Network & Internet." Depending on your device, this might have a slightly different name, like "Connections."

Now tap on "Private DNS" to manage the feature. If you don't immediately see the "Private DNS" option, you may have to tap on "More Connection Settings" or "Advanced."

You will get three options: "Off," "Automatic," and "Private DNS Provider Hostname." You can select "Off" to stop using DNS over TLS, "Automatic" to use encrypted DNS when available, or write the hostname of a private DNS provider to use encrypted DNS from that provider. Remember, rather than DNS server IPs, you need a hostname.

Once done, tap on "Save" to apply the changes.

Why You Might Want to Use a Private DNS Provider

As explained above, Android's Private DNS feature brings DNS over TLS support to the platform. Unfortunately, while its "Automatic" option uses secure DNS when available, you are at the mercy of your ISP or cell service provider to offer encrypted DNS support. Your ISP may not want to do that.

But there is an easy way to check. You can confirm whether your internet provider supports TLS protocol for DNS encryption by using the Safer.com Browser Privacy Test. It shows if your ISP's DNS is TLS enabled or not.

If you want to ensure that your phone's DNS queries remain secure and encrypted, we recommend using Google Public DNS or Cloudflare. You can also check out our guide to choosing a DNS provider with your PC, or see a more comprehensive list of public DNS providers with encryption support on DNS Privacy Project's website.