Privacy
Private DNS for Android is a built-in setting that encrypts your DNS lookups and sends them to a server you choose. Here’s what it does, whether it should be on or off, and how to use it to block ads.
In short
Before an app or a website loads anything, your phone asks DNS where the server is: “what’s the address of example.com?” DNS is like the internet’s address book, and your phone looks things up in it hundreds of times a day.
Normally these lookups go to your internet provider or Wi-Fi network without encryption. Anyone on the network can see them, and some networks change the answers.
Private DNS sends the same lookups over an encrypted connection, using DNS over TLS, to a DNS server you choose. Your Wi-Fi network and your provider can no longer read or change the answers. Android Private DNS appeared in Android 9 and is on almost every phone today.
Android uses DNS over TLS for Private DNS. Recent versions can also use DNS over HTTPS with some providers. For you the result is the same: lookups are encrypted between the phone and the DNS server.
Keep it on. Automatic is a safe default. Choose a provider hostname when you want ad blocking or a DNS provider you trust. Here’s what each Private DNS mode does:
| Mode | What it does | When to use it |
|---|---|---|
| Off | Plain DNS from your network, without encryption | Almost never |
| Automatic | Encrypts lookups only if your network’s DNS supports it | The default on most phones |
| Private DNS provider hostname | Always uses the server you enter, encrypted | To choose your own DNS, for example to block ads |
With a provider hostname, Android uses only that server. If it can’t reach it, websites stop loading and Android shows “Private DNS server cannot be accessed”.
The Android setup guide walks through each step and shows where the setting is on popular brands.
Some DNS providers filter lookups: they don’t give out the addresses of ad and tracking servers. Using Private DNS for blocking ads takes one setting: set such a provider as your Private DNS, and ads stop loading in every app and browser on the phone, on Wi-Fi and mobile data. That’s how Seawall works on Android: you paste your personal Seawall address as the provider hostname.
Android shows this when it can’t reach the hostname. Check that it’s typed exactly, without https:// or spaces. Some public Wi-Fi networks block encrypted DNS: switch to mobile data or set Private DNS to Automatic while you’re on that network.
No. Encryption adds a tiny delay to the first lookup, and the connection is then reused. With a filtering provider, pages often load faster because ads and trackers don’t.
It means your phone looks up website addresses over an encrypted connection, using a DNS server you choose, instead of the plain DNS of your network.
Yes. It’s a built-in Android feature that encrypts your DNS lookups. Choose a provider you trust, because it sees the names of the sites you look up.
Yes. It works on any network your phone joins: mobile data, home Wi-Fi, a café or a hotel.
It hides the names you look up, but your provider still sees which IP addresses you connect to.
Android 9 and newer. On older phones, set a DNS server on your router instead.
A DNS ad blocker, or DNS adblock, stops ads before they load by refusing to look up the servers that deliver them. Here’s how using DNS to block ads works, how it compares with browser extensions and where it falls short.
Pop-up ads come from three places: ad networks, apps that draw ads over other apps, and website notifications you once allowed. Here’s how to stop pop-up ads of each kind on an Android phone, iPhone, Windows and Mac.
Seawall blocks ads and trackers in apps, browsers and on smart TVs. No app needed.