How to Configure Private DNS and DoH Over Encrypted Profiles in Android 14

Domain Name System (DNS) queries traditionally travel across networks in unencrypted plain text, exposing user browsing activity, app network endpoints, and metadata to interception, eavesdropping, and manipulation by Internet Service Providers (ISPs) or malicious actors on untrusted local networks. Starting with Android 9, Google introduced native Private DNS based on DNS over TLS (DoT). Android 14 expands this foundation with support for DNS over HTTPS (DoH) and granular network security controls, allowing mobile devices to maintain encrypted domain resolution across both cellular and Wi-Fi connections.

Understanding Encrypted DNS Architecture in Android 14

Android 14 implements DNS encryption within its system-level resolver daemon (netd) and modern mainline connectivity modules. The operating system handles encrypted resolution through two primary modes:

• Automatic Mode: Android attempts opportunistic DoT connections to the DNS servers provided by the active network (such as DHCP or router advertisements). If the local resolver does not negotiate TLS on port 853, Android falls back to standard unencrypted UDP/TCP port 53.
• Strict Private DNS Mode: The user or system administrator specifies a dedicated resolver hostname. In this mode, Android requires all system applications to resolve hostnames exclusively through the encrypted channel. If the configured secure resolver cannot be reached, internet access is halted to prevent unencrypted DNS leakage.
• DNS over HTTPS (DoH) Acceleration: In Android 13 and Android 14, system components can negotiate DoH (port 443) using modern HTTP/2 or HTTP/3 transport when supported by the provider, blending DNS traffic with regular web traffic to resist port-based filtering.

Configuring Private DNS via Android Settings

To enable strict encrypted resolution through the standard system interface on any modern Android 14 device:

1. Open the Settings app on your Android device.
2. Navigate to Network & internet and tap Private DNS (often located near the bottom of the list).
3. By default, the setting is set to Automatic. Tap the radio button for Private DNS provider hostname.
4. Enter the fully qualified domain name (FQDN) of your preferred encrypted resolver. Common verified providers include:
   • dns.google (Google Public DNS)
   • one.one.one.one or 1dot1dot1dot1.cloudflare-dns.com (Cloudflare Public DNS)
   • dns.quad9.net (Quad9 threat-blocking DNS)
   • dns.adguard-dns.com (AdGuard ad-blocking DNS)
5. Tap Save. Android immediately attempts a secure TLS handshake with the specified endpoint.

Deploying Encrypted DNS via ADB for Fleet and Development Devices

System administrators and developers managing test benches or corporate devices can automate Private DNS configuration over Android Debug Bridge (ADB) without navigating touch menus:

# Verify connected device
adb devices

# Set Private DNS mode to strict hostname provider
adb shell settings put global private_dns_mode hostname

# Set the secure resolver provider FQDN
adb shell settings put global private_dns_specifier dns.quad9.net

# Verify the updated global settings
adb shell settings get global private_dns_mode
adb shell settings get global private_dns_specifier

To revert the configuration back to standard automatic behaviour when troubleshooting local network infrastructure, execute:

adb shell settings put global private_dns_mode opportunistic
adb shell settings delete global private_dns_specifier

Validating Encrypted Resolution and Leak Protection

Once configured, verify that outgoing queries are encapsulated inside encrypted sessions rather than leaking via unencrypted port 53:

1. Open Google Chrome or any browser on the Android device and visit https://one.one.one.one/help or https://on.quad9.net/.
2. Confirm that the diagnostics page reports Using DNS over TLS (DoT) or DNS over HTTPS (DoH) as Yes.
3. Alternatively, connect the device to an ad-hoc Wi-Fi hotspot monitored by Wireshark or tcpdump on a desktop computer. Filter traffic using:

   port 53

4. Browse several distinct websites. If Private DNS is operating correctly, zero packets appear on UDP port 53, while encrypted packet streams appear on TCP port 853 or port 443.

Troubleshooting Captive Portals and Public Wi-Fi Handshakes

Strict Private DNS mode can occasionally conflict with captive portals found in hotels, airports, and public transport networks. When connecting to an untrusted public network, the local router must redirect HTTP requests to an authentication web page before granting broad internet routing. Because the router intercepts and blocks external TLS handshakes, Android cannot reach the Private DNS host, producing a “Couldn’t connect” warning and disabling all web traffic.

To overcome captive portal stalls, temporarily switch the Private DNS setting to Automatic or Off while completing portal authentication. Once authenticated and network routing opens, return Private DNS to Private DNS provider hostname to resume fully encrypted browsing sessions.