Private DNS on Android: Block Trackers at the System Level

I remember the first time I looked at a network log on my Pixel. I saw hundreds of requests to domains I didn't recognize, mostly background "pings" from apps I hadn't even opened that day. It felt like my phone was participating in a conversation I wasn't invited to. Setting up a Private DNS was the first thing that actually made me feel like I owned my device again. It’s a simple change that works across your whole phone, whether you're on Wi-Fi or cellular data, and it doesn't require any technical wizardry.

What Private DNS does

Normally, when you type a website name into your browser, your phone asks a server—usually owned by your ISP—for the IP address. This is the Domain Name System (DNS). The problem is that standard DNS is usually unencrypted. Your ISP, or anyone sitting on the same public Wi-Fi at a coffee shop, can see exactly where you're going. Even worse, many default DNS servers are slow and don't block anything.

Android 9 introduced a feature called "Private DNS." Technically, it uses a protocol called DNS-over-TLS (DoT). It does two big things for you. First, it encrypts those requests so your ISP can't snoop on your browsing habits. Second, if you use a provider that filters traffic, it can stop your phone from even connecting to known tracking and ad servers. Think of it like a polite bouncer standing at the door of your phone, checking the ID of every server that tries to talk to your apps. Since this happens at the system level, it works for apps, games, and web browsers all at once.

Choosing a provider

You can't just leave the setting blank; you need to point your phone to a specific provider. I've tried several over the last few years, and there are three I usually recommend depending on what you want to achieve.

AdGuard DNS

This is my go-to for most friends because it's the "set it and forget it" option for blocking ads. They have a public server that filters out most common trackers and advertising domains. When I switched a family member's phone to this, their data usage dropped by about 12% over a month just because they weren't wasting bits on video ads and background telemetry.

NextDNS

If you're a bit of a data nerd like me, NextDNS is incredible. It lets you create a custom account where you can toggle specific blocklists on and off. You can see real-time logs of what your phone is trying to contact. It's eye-opening to see a single weather app try to ping a dozen different data brokers in five minutes. It has a free tier that's plenty for most people, but it does require setting up an account to get the most out of it.

Mullvad DNS

For those who care strictly about privacy and don't want a "filtering" service that might break things, Mullvad is excellent. They are well-known in the VPN world for their radical transparency. They offer different versions: one for pure privacy, one that blocks ad/trackers, and even one that blocks social media sites if you're trying to do a digital detox.

Setting it up

The setup is surprisingly easy, but the setting is buried deep in the menus. On a standard Android 14 or 15 device (like a Pixel or a Motorola), here is where you go:

1. Open your Settings app.
2. Tap on Network & internet.
3. Scroll down to the bottom and tap Private DNS.
4. Select Private DNS provider hostname.
5. Type in the hostname of your chosen provider.

For example, if you're using AdGuard, you would type dns.adguard-dns.com. For Mullvad's basic ad-blocking service, you'd enter adblock.dns.mullvad.net. One thing I found out the hard way: you can't use an IP address here. It has to be a "hostname" (the URL-looking string). Once you hit save, your phone will quickly cycle its connection, and you're good to go.

Where to find it on each OEM

Not every manufacturer puts this in the same spot, which is honestly pretty annoying when you're trying to help a friend with a different phone. Manufacturers like to "skin" Android, and they often hide these privacy tools in weird places.

Samsung (One UI 6 & 7)

Samsung hides this under "More connection settings." Go to Settings > Connections > More connection settings > Private DNS. It works exactly like the Pixel version once you find it.

Xiaomi (HyperOS / MIUI)

On Xiaomi devices, it’s usually under Settings > Connection & sharing > Private DNS. Xiaomi likes to put things behind extra menus, but the terminology is the same.

OnePlus / Oppo / Realme

Look under Settings > Connection & sharing. If you don't see it there, use the search bar at the top of the settings menu and type "DNS"—that's usually the fastest way on these devices because their menu layouts change so frequently between updates.

Verifying it's working

Once you hit save, you want to make sure it's actually doing something. If you made a typo in the hostname, your internet will simply stop working. That’s actually the first test: if you can still load a webpage, you didn't break it.

To be sure, I usually head over to dnscheck.tools or BrowserLeaks. These sites will show you which DNS server your browser is using. If you set up AdGuard, you should see "AdGuard" or an IP address associated with them rather than your ISP's name (like Comcast or AT&T). If you're using NextDNS, their website has a status page that literally says "All good! This device is using NextDNS." It's a nice bit of reassurance that you've successfully stepped out of the default tracking loop.

What Private DNS doesn't block

As much as I love this fix, it isn't a magic wand. It's important to understand the limits so you don't feel a false sense of security. Private DNS blocks tracking based on the "address" an app tries to reach. If an app like Instagram or YouTube has ads served from the same domain as the content, DNS can't block it. This is why you'll still see ads in the YouTube app or your Facebook feed.

Also, it doesn't hide your IP address from the websites you visit; for that, you still need a VPN. And occasionally—though it's rare now—you might find a public Wi-Fi login page (like at a hotel or airport) that won't load properly while Private DNS is active. In those cases, you have to temporarily switch it back to "Automatic," sign in, and then turn it back on. It’s a minor hassle, but for the amount of junk it keeps off my phone every day, I find it worth the five seconds of clicking.