How to Set Up Private DNS on iPhone and Android

Why Change It

Your phone's default DNS belongs to whichever network you are on. Your carrier, a coffee shop, or a hotel can all see and log every site you look up, even when the sites use HTTPS. Switching to encrypted DNS hides those lookups from the network, and a provider with filtering can block ad and tracker domains for every app on the phone. Background in DNS Privacy.

The Two Encrypted Types

• DNS over HTTPS (DoH). Looks like ordinary web traffic. Supported by iOS profiles and by apps on Android.
• DNS over TLS (DoT). Uses a dedicated port. Android's built-in Private DNS setting uses this type and takes a hostname.

Which one you use depends on what your DNS provider offers and what your phone supports.

iPhone and iPad

The profile only changes DNS. You can remove it any time from the same Settings screen.

Android

Android has a built-in Private DNS setting, under Settings, Network and internet, Private DNS. It accepts a DNS over TLS hostname. If your provider gives you a DoT hostname, enter it there and you are done.

If your provider uses a personal DNS over HTTPS address instead, use an app that supports a custom DoH server, such as Intra, which is free and made by Google Jigsaw. Open Intra, choose a custom DNS over HTTPS server, paste your address, and switch it on.

Check That It Works

Open the DNS Checker in your phone's browser to see which DNS resolver your connection is using, and run the Adblock Test to see whether ad and tracker domains are blocked.

Common Problems

• Switching networks. Some Wi-Fi networks, such as hotel portals, block encrypted DNS until you sign in. Open the sign-in page first.
• Work or school profiles. A managed phone may restrict DNS or profile changes.
• A VPN running at the same time. Many VPNs use their own DNS and override yours while connected.

Common Questions