What is Private DNS on Android?
Every time an app or a browser opens a site, the phone first asks a DNS server for the site's address. By default that question travels unencrypted and goes to whatever server your Wi-Fi or mobile network hands out. Android's Private DNS setting changes that. It sends the question to a server you choose, wrapped in encryption, using a protocol called DNS over TLS (DoT).
Private DNS is configured with a hostname, such as family.cloudflare-dns.com. It is not configured with an IP address. If you want the background on what a DNS lookup is, read what is DNS.
What are the three Private DNS modes?
Android offers up to three choices:
| Mode | What it does |
|---|---|
| Off | Private DNS is not used. The phone uses the network's DNS as usual. |
| Automatic | The phone tries an encrypted connection to the network's DNS server and uses plain DNS if that is not possible. |
| Private DNS provider hostname | The phone sends every lookup to the hostname you typed, encrypted. If that server is unreachable, lookups fail. |
Some phones label the options slightly differently. The third option is sometimes called "strict mode" in technical texts.
How do I set a filtering provider as Private DNS?
Some public DNS providers publish a family filter, which answers for a list of adult and harmful sites with a blocked result. Typing that provider's hostname into Private DNS applies it to the whole phone. These hostnames are the same hosts that appear in the DoH addresses in our family DNS servers table:
| Provider | Hostname | What it is |
|---|---|---|
| Cloudflare Family | family.cloudflare-dns.com | Family filter |
| AdGuard Family | family.adguard-dns.com | Family filter |
| Quad9 | dns.quad9.net | Blocks known malicious sites |
| AdGuard DNS | dns.adguard-dns.com | Ad blocking |
Check the provider's own page before you rely on a hostname, since providers can change them. Do the steps below.
Stock Android (Pixel and similar)
- Open Settings.
- Tap Network & internet.
- Tap Private DNS.
- Choose Private DNS provider hostname and type the hostname.
- Tap Save.
Samsung (One UI)
- Open Settings.
- Tap Connections, then More connection settings.
- Tap Private DNS.
- Choose the hostname option, type the hostname and tap Save.
Xiaomi (MIUI and HyperOS)
- Open Settings.
- Tap Connection & sharing.
- Tap Private DNS.
- Choose the hostname option, type the hostname and tap Save.
Menu names can differ by phone model and Android version. If you cannot find the entry, use the search box at the top of Settings and search for "Private DNS".
Why must Private DNS be Off or Automatic with EZOBLOCKER?
EZOBLOCKER catches your phone's DNS lookups with a local tunnel, sends them encrypted (DoH) to its own servers and blocks the categories you picked there. Android's Private DNS setting takes priority over that. If a hostname is typed in, Android sends every DNS lookup straight to that server and EZOBLOCKER does not see it, so your categories filter nothing.
So the two are alternatives, not partners:
- To use EZOBLOCKER's categories, set Private DNS to Off or Automatic. In the app, Settings > Advanced shows the current Private DNS state and warns you if it needs fixing.
- To use only a public provider's filter through the phone's system setting, type its hostname and leave EZOBLOCKER off.
EZOBLOCKER can also use a public provider itself: Advanced > DNS provider. In that mode its own categories do not apply. See the family DNS servers guide for the details.
How do I check that it works?
Open the protection check in your phone's browser while EZOBLOCKER is on. It requests a small file from a control address and from a category address. If the control one loads and the category one does not, that category is being filtered through EZOBLOCKER. For what DNS filtering cannot do, such as YouTube video ads, see what DNS cannot block.
Setting up a family filter for a child's phone? Parental control covers the options, and the DNS changer page explains how EZOBLOCKER fits in.