Why this matters
Standard DNS queries are unencrypted. Your ISP, network operators, and anyone monitoring network traffic can see which domains you're accessing. Android's Private DNS feature, available since Android 9 (Pie), encrypts these queries using DNS over TLS (DoT) on port 853. The feature ships on every Android device from 2018 onward, yet remains off by default.
How it works
Private DNS offers three modes: Off (standard unencrypted DNS), Automatic (attempts encrypted DNS, falls back if unavailable), and Private DNS provider hostname (specify a provider like dns.google or one.one.one.one). Automatic mode defaults to Google's DNS servers, which raises privacy questions - the feature meant to prevent tracking often routes through the world's largest ad network.
Cloudflare, Quad9, and other providers offer alternative hostnames. For ad-blocking, some users configure AdGuard DNS, though this requires manual hostname entry.
The enterprise angle
Mobile device management tools like SureMDM now enable remote Private DNS configuration on managed Android devices running in Device Owner mode. This matters for compliance-focused sectors where DNS logging creates audit trails. The capability exists, but requires Android 9+ and specific MDM deployment.
What to watch
Public Wi-Fi networks sometimes block DoT traffic on port 853, causing "Private DNS server cannot be accessed" errors. Automatic mode should handle this by falling back to standard DNS, but implementations vary by carrier and device manufacturer. Some carriers restrict Private DNS entirely on their networks.
VPN services like ExpressVPN and NordVPN handle DNS encryption automatically, making the native Android feature redundant if you're already running a VPN. The combination can cause conflicts - your VPN provider and your Private DNS provider both trying to handle queries.
The setup
On Android 11+: Settings > Network & internet > Private DNS > Private DNS provider hostname. Enter your chosen provider (dns.google, one.one.one.one, dns.quad9.net). On older Android versions, the setting lives under Advanced in Network settings.
The feature exists. The question is whether users know it's there.