How to Configure Private DNS, DNS-over-TLS (DoT), and Custom Resolver Endpoints on Android

Architectural Foundation of Android Private DNS and DNS-over-TLS

Traditional Domain Name System (DNS) queries transmit across local networks and transit internet service providers in cleartext over UDP or TCP port 53. This legacy architecture exposes every hostname resolution request to eavesdropping, packet sniffing, on-path manipulation, and DNS spoofing. Beginning in Android 9 (Pie) and enhanced through Android 14 and 15, Android incorporates Private DNS, a platform-level network security subsystem built natively upon DNS-over-TLS (DoT, RFC 7858) running across encrypted TCP port 853.

Rather than delegating name resolution to untrusted local DHCP-assigned gateway resolvers, Private DNS encapsulates all system DNS requests inside Transport Layer Security (TLS) tunnels. This establishes cryptographic confidentiality and mutual endpoint authentication between the Android device and an upstream recursive resolver. Crucially, Android enforces DNS-over-TLS at the operating system level, ensuring that native applications, background system services, web browsers, and third-party frameworks automatically inherit encrypted DNS routing without requiring application-level modifications.

DNS Protocol Specification	Transport Protocol & Port	Encryption Standard	Android Operational Mode	Network Interception Exposure
Standard Legacy DNS	UDP / TCP Port 53	None (Plaintext)	Fallback / Off	Vulnerable to ISP inspection, spoofing, and MITM attacks
DNS-over-TLS (DoT)	TCP Port 853	TLS 1.2 / TLS 1.3	Native Private DNS	Cryptographically secured; SNI and payload encrypted
DNS-over-HTTPS (DoH)	TCP Port 443	HTTP/2 or HTTP/3 (QUIC)	App-level / Chrome internal	Blends with standard HTTPS web traffic; requires browser engine

Android Private DNS Operational Modes

Android exposes three distinct operational profiles within the network subsystem that govern how TLS handshakes and connection timeouts are resolved:

• Off: Disables DNS-over-TLS entirely. The device defaults to standard, unencrypted UDP port 53 DNS servers supplied by the local Wi-Fi router via DHCP or cellular operator via 3GPP PDP context.
• Automatic (Opportunistic Mode): The default state on modern Android devices. The operating system attempts to establish a TLS handshake on port 853 with the network’s default local DNS server. If the local resolver supports RFC 7858, queries are encrypted. However, if the server fails the TLS handshake or rejects port 853, Android silently drops back to unencrypted plaintext DNS without notifying the user, leaving queries vulnerable to active interception.
• Private DNS provider hostname (Strict Mode): The user or enterprise administrator explicitly supplies a Fully Qualified Domain Name (FQDN) of a verified secure resolver (for example, dns.google, one.one.one.one, or an internal enterprise resolver). In this mode, Android strictly mandates TLS negotiation. If the remote endpoint cannot be reached or the TLS certificate chain fails cryptographic validation, all DNS resolution is terminated, preventing any plaintext query leakage.

Configuring Private DNS via Android System Settings

To enforce encrypted DNS resolution with a designated provider on stock Android and Pixel devices:

1. Open the Settings application from the app drawer.
2. Navigate to Network & internet (or Connections > More connection settings on Samsung One UI).
3. Tap Private DNS.
4. Select Private DNS provider hostname.
5. Enter the cryptographic hostname of your preferred recursive resolver in the text entry field:
   • Cloudflare: one.one.one.one (or malware-blocking: security.cloudflare-dns.com)
   • Google Public DNS: dns.google
   • Quad9 (Malware blocking): dns.quad9.net
   • NextDNS (Custom profile): [custom-id].dns.nextdns.io
   • AdGuard DNS: dns.adguard.com
6. Tap Save.

Configuring Private DNS via Android Debug Bridge (ADB)

For fleet management, enterprise rollouts, or automated device provisioning, administrators can configure and lock the Private DNS subsystem programmatically using the Android Debug Bridge (ADB):

# 1. Query the current Private DNS configuration state
adb shell settings get global private_dns_mode
adb shell settings get global private_dns_specifier

# 2. Configure Strict Mode with a designated recursive resolver hostname
adb shell settings put global private_dns_mode hostname
adb shell settings put global private_dns_specifier "dns.quad9.net"

# 3. Verify that the settings have taken effect in system settings
adb shell settings get global private_dns_mode
# Returns: hostname

adb shell settings get global private_dns_specifier
# Returns: dns.quad9.net

# 4. Optional: Revert configuration to Automatic (Opportunistic) mode
adb shell settings put global private_dns_mode opportunistic
adb shell settings delete global private_dns_specifier

Verifying Encrypted DNS Status and Packet Isolation

Once configured, verify that DNS-over-TLS negotiation is operational and that unencrypted port 53 traffic is eliminated:

1. Launch Google Chrome or any modern web browser on the Android handset.
2. Navigate to an authoritative DNS verification portal such as:
   • https://1.1.1.1/help (Cloudflare Diagnostic Engine)
   • https://on.quad9.net/ (Quad9 Encryption Check)
   • https://test.nextdns.io/ (NextDNS Protocol Auditor)
3. Verify that the telemetry reports:
   • Using DNS-over-TLS (DoT): Yes
   • DNSSEC Validation: Yes
   • Encrypted SNI / ECH: Supported
4. For low-level network engineers, inspect Android logcat output filtering for the internal resolver daemon:

   adb logcat -d | grep -i "DnsTlsTransport"

   Confirm successful TLS handshakes: Handshake complete on port 853.

Troubleshooting Private DNS Errors and Connection Drops

Observed Error / Behaviour	Probable Root Cause	Diagnostic Verification	Technical Remediation Procedure
“Couldn’t connect” notification & Internet drops	Outbound TCP port 853 blocked by local Wi-Fi router, firewall, or ISP	Connect to cellular data; if connection succeeds, Wi-Fi firewall blocks port 853	Temporarily switch Private DNS to Automatic or open outbound TCP 853 on router
Wi-Fi Captive Portal login page fails to load	Strict Mode prevents resolving unauthenticated local captive portal gateway	Browser displays ERR_NAME_NOT_RESOLVED when redirected to hotel/airport portal	Switch Private DNS to Automatic or Off to complete portal login, then re-enable
IP Address typed instead of Hostname	Private DNS specification requires a valid FQDN, not raw IP addresses	Save button greyed out or persistent “DNS server cannot be reached” error	Enter the cryptographic hostname (e.g., dns.google rather than 8.8.8.8)
TLS Certificate Validation Failure	Device system clock out of sync or custom root CA untrusted by Android Trust Store	Check Android device date and time settings	Enable Set time automatically; verify custom CA certificates in Credential Storage
VPN Split-Tunnel DNS Leak	Third-party VPN client enforces internal DNS forwarders, conflicting with DoT	Run DNS leak test; queries resolve through VPN gateway instead of Private DNS	Configure VPN application to inherit OS DNS or enable “Bypass VPN for Private DNS”