Private DNS (DNS over TLS, or DoT) is a feature in modern Android operating systems that encrypts Domain Name System (DNS) queries before sending them across the network. By default, Android uses an “Automatic” setting, meaning it will attempt to upgrade standard port 53 DNS queries to encrypted queries if the network’s configured DNS server supports it. While excellent for privacy on public Wi-Fi networks, this feature can cause significant problems in corporate environments. Encrypted DNS queries bypass local DNS filtering, parental controls, and enterprise firewalls that rely on inspecting plaintext DNS traffic to block malicious domains or enforce acceptable use policies.
This guide explains how to completely disable Private DNS system-wide on an Android device, forcing the operating system to send all DNS queries in standard plaintext over port 53 to the DHCP-assigned local resolver.
Disable Private DNS
To enforce a strict fallback to plaintext DNS, we must configure the network settings directly on the device.
- Open the main Settings app on your Android smartphone.
- Tap on Network & internet (or “Connections” on some manufacturer skins like Samsung’s One UI).
- Scroll to the bottom of the menu and tap on Private DNS. On some devices, you may need to tap “More connection settings” first.
- A pop-up menu will appear with three options: “Off,” “Automatic,” and “Private DNS provider hostname.”
- Select the radio button next to Off.
- Tap Save to apply the changes.
Verify the Network State
By explicitly setting this feature to “Off,” the Android OS will immediately tear down any active TLS connections on port 853 and revert to standard UDP/TCP port 53 for all subsequent DNS resolutions.
To verify the change is successful, you can monitor the network traffic using a packet analyzer (like Wireshark) on your local network router or firewall. When the Android device browses to a new website, you will clearly see plaintext DNS queries (listing the specific domains being requested) originating from the device’s IP address. If your organization utilizes a local DNS sinkhole (like Pi-hole or AdGuard Home), you will also see the device’s queries correctly appearing in the local query logs, proving that the encryption bypass has been neutralized.