What Is Private DNS
Private DNS is a device setting that encrypts your DNS queries using DNS over TLS (DoT) or DNS over HTTPS (DoH). When you type a website address into your browser, your device sends a DNS query to translate that domain name into an IP address. Traditionally, this query travels as plaintext over the network, allowing your ISP, network administrator, or anyone monitoring the connection to see every website you visit. Private DNS fixes this by routing your queries through an encrypted tunnel to a resolver you control.
On Android, the term "Private DNS" specifically refers to the built-in setting introduced in Android 9 (Pie) that allows you to specify a DNS resolver hostname using the DoT protocol. However, the concept of private DNS extends beyond Android — it encompasses any configuration where you use an encrypted DNS resolver instead of the default one provided by your ISP or network.
The privacy implications are significant. Without Private DNS, your ISP can log every domain you visit, build a profile of your interests, sell that data to advertisers, or comply with government surveillance requests. With Private DNS enabled, your DNS queries are encrypted end-to-end between your device and the resolver, making it impossible for intermediate parties to observe your browsing activity.
Private DNS is not a replacement for a privacy-focused DNS provider, but rather a complementary technology. Encryption protects your queries in transit, but the resolver itself still sees them. Using Private DNS with a provider that has a strict no-log policy gives you the strongest privacy protection available for DNS.
How to Enable Private DNS on Android
Android 9 and later include native Private DNS support, making it the easiest platform to configure encrypted DNS. The setting uses DNS over TLS (DoT) to encrypt all DNS queries from your device.
Step-by-Step Instructions
1. Open the Settings app on your Android device.
2. Tap Network & internet (on some devices this may be called "Connections" or "Wi-Fi & network").
3. Tap Advanced to expand additional options.
4. Tap Private DNS. You will see three options: Off, Automatic, and Private DNS provider hostname.
5. Select Private DNS provider hostname.
6. Enter your chosen provider's DoT hostname. For example:
- Cloudflare:
1dot1dot1dot1.cloudflare-dns.com
- Google:
dns.google
- Quad9:
dns.quad9.net
7. Tap Save. All DNS queries from your device are now encrypted.
Verifying It Works
To confirm Private DNS is active, visit a site like 1.1.1.1/help or dnsleaktest.com. These sites can detect whether your DNS queries are being routed through an encrypted connection. If the test shows the resolver you configured, Private DNS is working correctly.
Troubleshooting
If Private DNS causes connectivity issues, it is usually because the network is blocking port 853 (the DoT port). Corporate networks, public Wi-Fi, and some ISPs block this port. In these cases, you can temporarily set Private DNS to "Off" or "Automatic" until you are back on a network that supports DoT. Alternatively, consider using DNS over HTTPS (DoH) through a browser, which uses port 443 and is harder to block.
Private DNS on iOS
Apple introduced DNS over HTTPS (DoH) and DNS over TLS (DoT) support in iOS 14 and iPadOS 14. However, iOS does not have a built-in "Private DNS" setting like Android. Instead, you configure encrypted DNS through one of two methods.
Method 1: Configure Profiles
Many DNS providers offer iOS configuration profiles that automatically set up encrypted DNS. Download the profile from your provider's website, go to Settings > General > VPN & Device Management, and install the profile. Once installed, your DNS queries will be encrypted using the provider's DoH or DoT server.
Method 2: Use Safari's DNS Settings
In iOS 14 or later, go to Settings > Safari > Advanced > Private DNS (or "Restrict Private Addresses" on some versions). From here, you can select a DNS provider or enter a custom DNS-over-HTTPS URL. This only affects Safari — other apps will use the system DNS.
Method 3: Third-Party Apps
Apps like NextDNS, AdGuard, and 1.1.1.1 (Warp) can configure system-wide encrypted DNS on iOS. These apps create a local VPN profile that intercepts DNS queries and routes them through an encrypted channel. This is the most reliable method for encrypting DNS across all apps on iOS.
See our complete DNS change guide for detailed instructions on each method.
Private DNS on Windows
Windows 11 introduced native support for DNS over HTTPS (DoH) in its network settings. Windows 10 users need to use a third-party client or edit the registry.
Windows 11 (Native DoH Support)
Go to Settings > Network & internet > Wi-Fi or Ethernet > Hardware properties. Click Edit next to DNS server assignment. Select Encrypted only (DNS over HTTPS) from the dropdown. Enter your provider's DoH server URL (e.g., https://1.1.1.1/dns-query for Cloudflare). Click Save.
Windows 10 (Using Third-Party Clients)
Windows 10 does not have native DoH support in the UI. Use a client like dnscrypt-proxy or Stubby. Install the client, configure it with your chosen resolver's DoH or DoT server, and set your system DNS to 127.0.0.1 (localhost) so all queries route through the encrypted client.
Using PowerShell
Advanced users can configure DoH on Windows 10/11 via PowerShell. Run the following command to add a DoH server: Set-DnsClientDohServerAddress -ServerAddress "1.1.1.1" -DohTemplate "https://1.1.1.1/dns-query" -AllowFallbackToUdp $false -AutoUpgrade $true. Then set your network adapter to use this server.
Private DNS on Mac
macOS does not have a native "Private DNS" toggle, but it supports DNS over HTTPS and DNS over TLS through system configuration or third-party tools.
Using macOS Native Settings (Big Sur and Later)
Go to System Settings > Network > Wi-Fi or Ethernet > Details > DNS. Click the + button to add a DNS server. Add your provider's IP address (e.g., 1.1.1.1 or 8.8.8.8). Note: macOS does not natively encrypt these queries — you need a third-party tool for encryption.
Using Stubby (DNS over TLS)
Install Stubby via Homebrew: brew install stubby. Edit the Stubby configuration file at /usr/local/etc/stubby/stubby.yml to add your chosen DoT resolver. Start Stubby and configure your network DNS to point to 127.0.0.1.
Using dnscrypt-proxy
Install dnscrypt-proxy: brew install dnscrypt-proxy. Configure it with DoH or DoT resolvers, then set your Mac's DNS to 127.0.0.1. This encrypts all DNS traffic system-wide.
Best Private DNS Providers
Choosing the right Private DNS provider depends on your priorities — speed, privacy, ad blocking, or parental controls. Here are the top providers for 2026:
| Provider |
DoT Hostname |
DoH URL |
Key Feature |
| Cloudflare 1.1.1.1 | 1dot1dot1dot1.cloudflare-dns.com | https://1.1.1.1/dns-query | Fastest global network |
| Google DNS | dns.google | https://dns.google/dns-query | Widest compatibility |
| Quad9 | dns.quad9.net | https://dns.quad9.net/dns-query | Built-in malware blocking |
| NextDNS | dns.nextdns.io | https://firefox.dns.nextdns.io | Customizable ad/tracker blocking |
| AdGuard DNS | dns.adguard.com | https://dns.adguard.com/dns-query | Aggressive ad blocking |
Cloudflare offers the fastest DNS resolution globally with a strict no-log policy audited by independent firms. Google DNS is the most widely compatible and reliable, though Google does log queries for 24-48 hours. Quad9 blocks known malicious domains by default, adding a layer of security. NextDNS is ideal for users who want fine-grained control over what gets blocked, with customizable allowlists and blocklists. AdGuard DNS focuses on ad and tracker blocking without requiring client software.
For a detailed comparison, see our complete DNS provider reviews.
Private DNS vs VPN: What's the Difference?
Private DNS and VPNs both protect your internet traffic, but they operate at different layers and provide different protections. Understanding the distinction helps you choose the right tool for your needs.
| Feature |
Private DNS |
VPN |
| What it encrypts | DNS queries only | All internet traffic |
| Hides your IP | No | Yes |
| Speed impact | Minimal (1-5 ms) | Noticeable (10-50 ms+) |
| Cost | Free (most providers) | Paid (typically $3-12/month) |
| Setup complexity | Easy (one setting) | Moderate (app install) |
| Protects against ISP logging | DNS queries only | All traffic |
| Bypasses geo-restrictions | No | Yes |
Use Private DNS when: You want to prevent your ISP from seeing which domains you visit, you need a lightweight solution with no speed penalty, or you are on a trusted network and only need DNS privacy.
Use a VPN when: You want to hide your IP address, encrypt all internet traffic (not just DNS), bypass geo-restrictions, or protect yourself on untrusted public Wi-Fi networks.
Use both when: You want maximum privacy. A VPN encrypts all your traffic and hides your IP, while Private DNS ensures your DNS queries are encrypted even if the VPN tunnel drops or is configured incorrectly. This defense-in-depth approach protects you at multiple layers.
Frequently Asked Questions
What is Private DNS?
Private DNS is a device setting that encrypts DNS queries using DNS over TLS (DoT) or DNS over HTTPS (DoH). Instead of sending DNS requests as plaintext to your ISP's default resolver, Private DNS routes them through an encrypted tunnel to a provider you choose, preventing eavesdropping and manipulation of your browsing traffic.
How do I enable Private DNS on Android?
On Android 9 or later, go to Settings > Network & internet > Advanced > Private DNS. Select "Private DNS provider hostname" and enter your provider's DoT hostname (e.g., 1dot1dot1dot1.cloudflare-dns.com for Cloudflare). Tap Save. All DNS queries from your device will now be encrypted.
Is Private DNS the same as DoT?
Private DNS is a general term for using an encrypted DNS resolver. On Android, the "Private DNS" setting specifically uses DNS over TLS (DoT). However, Private DNS can also refer to DNS over HTTPS (DoH), which achieves the same encryption but over port 443. Both prevent your ISP from seeing your DNS queries.
Does Private DNS slow down my internet?
Private DNS adds minimal latency — typically 1-5 milliseconds per query due to the TLS or HTTPS handshake. After the initial connection is established, subsequent queries reuse the encrypted session with almost no overhead. The privacy benefit far outweighs the negligible speed cost for most users.