What Is Private DNS? Meaning, Hostname List & Setup

What Is Private DNS?

Private DNS is Android's setting for encrypted DNS: it sends the website names your device looks up over an encrypted connection, so your Wi-Fi network and your ISP can't read or change them. To turn it on, go to Settings → Network & internet → Private DNS, choose Private DNS provider hostname and type a hostname such as dns.google or one.one.one.one.

Android has had it since Android 9 (2018), using DNS over TLS. Since a 2022 Google Play system update, Android 11 and later switch to DNS over HTTP/3 for the providers Android recognises: Google's dns.google, and Cloudflare under the name cloudflare-dns.com (with one.one.one.one it stays on DNS over TLS). iPhone, Windows, Mac and web browsers offer the same protection under the name encrypted DNS.

In company and cloud networks, "private DNS" means something else: internal DNS zones that only exist inside that network. That meaning is covered below.

How Regular DNS Works (And Why It's a Problem)

Traditional DNS has been sending queries in plaintext since its first standards in 1983. When you type a domain name into your browser, your device sends a DNS query over UDP port 53 to a DNS resolver (usually your ISP's server). The resolver responds with the IP address — all completely unencrypted.

This means anyone on your network path can see every domain you visit. Your ISP can build a complete browsing profile. Attackers on public Wi-Fi can intercept your queries. Some ISPs have even rewritten DNS answers to send mistyped addresses to their own search and ad pages.

DNS is also vulnerable to cache poisoning and spoofing attacks where an attacker sends forged responses, redirecting you to malicious websites without your knowledge. Traditional DNS has no built-in way to verify that the response actually came from the real DNS server.

How Private DNS Works

Private DNS wraps your DNS queries inside an encrypted connection. Instead of sending a plaintext query on UDP port 53, your device establishes an encrypted session with the DNS resolver first, then sends the query through that secure tunnel.

The DNS resolver decrypts your query, resolves the domain name to an IP address, encrypts the response, and sends it back. The entire exchange is invisible to anyone monitoring the network — they can see that you are communicating with a DNS server, but they cannot see which domains you are querying.

Three IETF-standard encrypted DNS protocols are in use today: DNS over TLS (DoT), DNS over HTTPS (DoH), and DNS over QUIC (DoQ). Each takes a different approach to encrypting the same underlying DNS query (Oblivious DoH and DNSCrypt exist too, but are less common).

DNS over TLS vs DNS over HTTPS vs DNS over QUIC

DoT (RFC 7858) runs DNS inside TLS on its own port, 853. Android's Private DNS has used it since Android 9, and because the port is dedicated, a network can block it easily.

DoH (RFC 8484) sends DNS queries as HTTPS requests on port 443, so it looks like other web traffic and can only be blocked by blocking known DoH servers. Chrome, Firefox and Edge have it built in, and Windows 11 can use it system-wide. On Android, Android 11 and later switch to DNS over HTTP/3 for the providers Android recognises: Google's dns.google, and Cloudflare under the name cloudflare-dns.com (with one.one.one.one it stays on DNS over TLS).

DoQ (RFC 9250, 2022) runs DNS directly over QUIC on UDP port 853, which avoids head-of-line blocking and resumes connections quickly. Few resolvers offer it: AdGuard DNS and Quad9 do (Quad9 lists it in its DDR answer, we checked on 26 October 2026), while Cloudflare's 1.1.1.1 supports DoT, DoH and Oblivious DoH but not DoQ, and Android doesn't use it.

How to Enable Private DNS on Android

Android has had Private DNS since Android 9 (2018). It applies to every app, on Wi-Fi and mobile data, and has three modes: Off; Automatic, the default, which encrypts DNS whenever your network's DNS server supports it and otherwise uses plain DNS; and Private DNS provider hostname, which always uses the provider you type.

• Step 1: Open Settings > Network & Internet (or Connections on Samsung)
• Step 2: Tap Private DNS (you may need to tap 'Advanced' or 'More connection settings' first)
• Step 3: Select Private DNS provider hostname
• Step 4: Enter your provider's hostname. Examples: 1dot1dot1dot1.cloudflare-dns.com (Cloudflare), dns.google (Google), dns.quad9.net (Quad9), dns.adguard-dns.com (AdGuard)
• Step 5: Tap Save. If Android can't reach the provider, it warns "Private DNS server cannot be accessed"

How to Enable Private DNS on iPhone and iPad

iPhone and iPad (iOS 14 and later) support DNS over HTTPS and DNS over TLS, but there's no single switch like Android's: you add an encrypted DNS app or a configuration profile.

• Method 1: DNS App — Install your provider's app (for example 1.1.1.1 from Cloudflare, NextDNS or AdGuard) from the App Store and turn it on. Its DNS setting appears under Settings > General > VPN & Device Management.
• Method 2: Configuration Profile — Download a .mobileconfig file from your DNS provider (or a trusted collection such as the paulmillr/encrypted-dns GitHub repository) in Safari, then open Settings > General > VPN & Device Management, select the downloaded profile and tap Install.
• Method 3: Per-Network DNS — Go to Settings > Wi-Fi, tap the (i) next to your network, tap Configure DNS, select Manual, and add DNS server IPs (e.g., 1.1.1.1, 1.0.0.1). On iOS 16 and later, a server that supports Discovery of Designated Resolvers (1.1.1.1, 8.8.8.8 and 9.9.9.9 do) makes the iPhone switch to encrypted DNS on its own; other servers stay unencrypted.

How to Enable DNS over HTTPS on Windows 11

Windows 11 supports DNS over HTTPS natively. It ships with a list of recognized DoH providers including Cloudflare, Google, and Quad9.

• Step 1: Open Settings > Network & internet > Wi-Fi > Manage known networks and pick your network (for a cable: Ethernet → your network)
• Step 2: Find DNS server assignment on that page
• Step 3: Click Edit next to DNS server assignment
• Step 4: Select Manual, enable IPv4
• Step 5: Enter a primary DNS server (e.g., 1.1.1.1), set DNS over HTTPS to On (automatic template)
• Step 6: Enter a secondary DNS server (e.g., 1.0.0.1), set DoH to On as well
• Step 7: Click Save. The DNS entry should now show an Encrypted label

# View the DoH providers Windows 11 already knows (Cloudflare, Google, Quad9…)
netsh dns show encryption

# Add a provider that isn't on that list, via PowerShell (AdGuard shown)
Add-DnsClientDohServerAddress -ServerAddress '94.140.14.14' -DohTemplate 'https://dns.adguard-dns.com/dns-query' -AllowFallbackToUdp $False -AutoUpgrade $True

How to Enable Private DNS on macOS

macOS (Big Sur 11 and later) supports encrypted DNS through configuration profiles, the same as iOS, or through DNS apps.

• Method 1: DNS App — Install the Cloudflare 1.1.1.1 app (or similar) and enable it. The app configures DoH or DoT at the system level.
• Method 2: Configuration Profile — Download a .mobileconfig file, double-click it, then approve it in System Settings → General → Device Management (older macOS versions: search System Settings for "Profiles").
• Method 3: Terminal (advanced) — networksetup -setdnsservers Wi-Fi 1.1.1.1 1.0.0.1 changes the DNS servers. On macOS Ventura and later, a server that supports DDR (1.1.1.1, 8.8.8.8, 9.9.9.9) is upgraded to encrypted DNS automatically; others stay unencrypted.

Best Private DNS Providers (2026)

Cloudflare 1.1.1.1 supports DoT and DoH (plus Oblivious DoH), with filtering variants security.cloudflare-dns.com (malware) and family.cloudflare-dns.com (malware and adult content). It keeps no source IP address on disk, deletes its logs within 25 hours, and has an outside auditor check those commitments.

Google Public DNS supports DoT and DoH. Its temporary logs hold your full IP address and are deleted within 24 to 48 hours; the permanent sample keeps only a city-level location. If minimal logging is your priority, Cloudflare or Quad9 fit better.

Quad9 is run by a Swiss non-profit foundation, doesn't store IP addresses, and blocks known malicious domains using threat intelligence from security partners: a good choice for security-focused users.

AdGuard DNS blocks ads and trackers at the DNS level, so ads disappear across your whole device without a separate ad blocker. It also offers DNS over QUIC.

NextDNS gives you the most control. You get a custom hostname, configurable blocklists, per-device analytics, parental controls, and a dashboard to see exactly what is being blocked. Free tier includes 300,000 queries per month.

Speed varies by location, so don't pick blind: run a free DNS speed test to benchmark Cloudflare, Google and Quad9 over encrypted DNS-over-HTTPS from your own network, then enable Private DNS with the provider that actually wins for you.

Every address and setup step for the two biggest: our Cloudflare DNS servers and Google DNS servers guides.

Private DNS Hostname (Code): What to Type in the Android Box

The private DNS hostname, sometimes called the private DNS code, is the address you type into Settings → Network & Internet → Private DNS → "Private DNS provider hostname" on Android.

Copy any of these into the box. They're the official hostnames of the major providers:

After saving, check it took effect: DNS Robot's DNS Leak Test should show your provider's servers, not your ISP's. If the setting fails on one network, the section on blocked encrypted DNS below explains why.

Public vs Private DNS: The Enterprise Meaning

Confusingly, "private DNS" has a second meaning in corporate and cloud environments — and it has nothing to do with the encrypted DNS setting on your phone.

In that world, private DNS means private DNS zones: internal name records like intranet.corp.local or db1.internal hosted on servers that are only reachable inside a company network or a cloud VPC. AWS calls these Route 53 private hosted zones, Azure has Azure Private DNS, and Oracle and Google Cloud offer equivalents. The records are never published to the public internet — public resolvers simply cannot see them.

The quick test: if you're typing a hostname into a phone or laptop setting, you're dealing with encrypted DNS (this article). If your IT team or a cloud console mentions private DNS, they mean internal zones. You can check what the public internet sees for any name with a DNS lookup — records that live in a private zone won't appear at all.

Benefits of Using Private DNS

Enabling private DNS on your devices provides immediate security and privacy improvements.

• Stops ISP snooping — Your ISP can no longer see which domains you query or build a browsing profile from your DNS traffic
• Prevents DNS spoofing on the way — the TLS certificate proves you're talking to your real DNS provider, so no one between you and it can forge answers
• Protects on public Wi-Fi — Other users on the same network cannot intercept your DNS queries
• Blocks DNS hijacking — Your queries cannot be silently redirected by a compromised router or malicious network
• Bypasses transparent DNS proxies — Some ISPs intercept DNS on port 53 even when you use third-party servers. Encrypted DNS uses different ports, bypassing these proxies
• Optional ad and malware blocking — Providers like AdGuard, NextDNS, and Quad9 can block ads, trackers, and malicious domains at the DNS level
• Works system-wide — Once enabled, private DNS protects all apps on your device, not just your browser

Potential Downsides of Private DNS

Private DNS is not perfect. Here are the trade-offs you should be aware of.

• A slower first lookup — setting up the encrypted connection adds a round trip or two before the first query. After that the connection is reused.
• Captive portals may break — Hotel, airport, and coffee shop Wi-Fi networks that require a login page often need unencrypted DNS to redirect you. Private DNS can prevent these portals from loading.
• Corporate networks may block it — IT departments need DNS visibility for security monitoring. Many enterprise networks intentionally block encrypted DNS to external resolvers.
• Centralization concern — Encrypted DNS encourages use of a few large resolvers (Cloudflare, Google), concentrating DNS traffic with fewer companies.
• Does not encrypt everything — Private DNS encrypts your lookups, but your ISP still sees the IP addresses you connect to, and usually the site name in the TLS handshake (SNI) unless the site uses Encrypted Client Hello.
• Split-horizon DNS issues — Organizations using different internal vs. external DNS may have problems when devices bypass the internal resolver.

'This Network Is Blocking Encrypted DNS Traffic' — What It Means

On iPhone, iPad and Mac, Wi-Fi settings can show "This network is blocking encrypted DNS traffic" under the network name. It means your device tried to use encrypted DNS and the network stopped it, so the names you look up there are visible to the network.

It's common on corporate and school Wi-Fi, hotel and airport networks with a login page, and some home routers. Our full guide, This Network Is Blocking Encrypted DNS Traffic, covers each cause; the quick fixes:

• Turn off what enables encrypted DNS on this network — Limit IP Address Tracking (iCloud Private Relay) for this Wi-Fi network, a DNS app or profile, or a manual DNS server (set Configure DNS back to Automatic)
• Forget the Wi-Fi network and reconnect — Go to Wi-Fi settings, forget the network, then rejoin it
• Use a VPN — A VPN encrypts all traffic including DNS, bypassing any network-level DNS blocking
• Accept it on managed networks — On corporate or school networks, encrypted DNS blocking is often intentional for security monitoring. You may not be able to bypass it

How to Verify Private DNS Is Working

After enabling private DNS, check that your lookups really go to your chosen provider. Test the device itself in a browser; the terminal commands below test the provider.

• DNS Robot's DNS Leak Test — run the DNS Leak Test on the device: it shows which resolvers really answer your lookups. You should see your chosen provider, not your ISP
• Cloudflare's check page — if you use Cloudflare, 1.1.1.1/help shows whether your lookups use DoH, DoT or plain DNS
• Android — with a hostname set, Android warns "Private DNS server cannot be accessed" when it can't connect; no warning means it's working
• Windows 11 — your connection's properties list each DNS server with (Encrypted) when DoH is on

# Test DNS over TLS with kdig
kdig -d @1.1.1.1 +tls-ca +tls-host=cloudflare-dns.com example.com

# Which resolver does dig use? (DNS Robot's test nameserver replies with its IP; a DoH profile may not apply to dig)
dig +short TXT whoami.leak.dnsrobot.net

# Test DNS over HTTPS with curl
curl -s -H 'accept: application/dns-json' \
  'https://cloudflare-dns.com/dns-query?name=example.com&type=A'