Every time a mobile device connects to an application, navigates to a website, or checks for incoming email, it initiates a Domain Name System (DNS) query to resolve human-readable domains into numeric IP addresses. By default, cellular carriers and public Wi-Fi access points transmit standard DNS requests in unencrypted plaintext on UDP port 53. This exposes user browsing habits to internet service providers (ISPs), eavesdroppers on public networks, and targeted advertising trackers. Android 15 includes Private DNS, a system-level encryption engine that routes all mobile DNS queries over encrypted DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH) tunnels.
Understanding DNS-over-TLS (DoT) vs DNS-over-HTTPS (DoH)
Android’s Private DNS architecture protects mobile traffic across cellular data, private Wi-Fi, and public hotspots without requiring third-party VPN apps that drain battery life:
| Protocol | Network Port | Transport Security | Privacy Benefit |
|---|---|---|---|
| Standard Legacy DNS | UDP / TCP 53 | None (Plaintext) | Zero privacy; vulnerable to ISP logging and DNS spoofing. |
| DNS-over-TLS (DoT) | TCP 853 | TLS Encryption | Default Android protocol; prevents tampering and snooping. |
| DNS-over-HTTPS (DoH) | TCP 443 | HTTPS Encryption | Blends DNS queries into standard web traffic, bypassing port 853 firewalls. |
Configuring Private DNS in Android 15 Settings
Setting up encrypted Private DNS in Android 15 applies globally across all installed applications, background sync daemons, and system processes:
- Open the Settings app on your Android 15 device.
- Tap Network & internet and select Private DNS.
- By default, Android is set to Automatic (which attempts opportunistic opportunistic encryption only if supported by the local Wi-Fi router).
- Select Private DNS provider hostname to enforce strict encryption.
- Enter the TLS hostname of a privacy-focused DNS provider:
- Cloudflare (Speed & Privacy):
one.one.one.one - Google Public DNS:
dns.google - Quad9 (Malware & Phishing Blocking):
dns.quad9.net - AdGuard DNS (Ad & Tracker Blocking):
dns.adguard-dns.com
- Cloudflare (Speed & Privacy):
- Tap Save. Android validates the TLS handshake on port 853 and secures all outbound traffic.
Verifying Encryption and Leak Testing
To confirm that your Android 15 device is successfully routing queries through an encrypted tunnel:
- Open Google Chrome or your default mobile browser.
- Navigate to one.one.one.one/help or dnsleaktest.com.
- Verify that Using DNS over TLS (DoT) shows Yes, and that the identified DNS servers match your configured provider rather than your mobile cellular carrier.
Troubleshooting Captive Portal and Public Wi-Fi Blocks
Some restrictive hotel or airport Wi-Fi networks block TCP port 853, preventing Android from establishing the Private DNS handshake and causing an error stating “Private DNS server cannot be accessed”.
In this situation, temporarily toggle Private DNS to Automatic to complete the captive portal splash screen login. Once authenticated to the public network, toggle Private DNS back to your custom hostname to restore encrypted domain privacy.