Public Wi-Fi is convenient, but it can expose more of your browsing than you’d expect. Android has a built-in feature called Private DNS that quietly encrypts one of the most revealing parts of your connection. Here’s what it does, how to turn it on, and what else helps.
What’s a private DNS?
Encrypting the lookups your phone makes behind the scenes
As you may or may not know, every time you tap a link or open an app, your phone has to figure out where that website or service actually lives. It does this through the Domain Name System, or DNS, which translates names like google.com into the numerical IP addresses computers use to reach each other. DNS is one of the oldest parts of the internet, and it wasn’t designed with privacy in mind. Traditional DNS requests travel unencrypted, so anyone between you and the DNS server can read them.
On your home network, of course, that usually means your internet provider. On public Wi-Fi at an airport, café, or hotel, more people could be watching. The network operator can see every domain your phone looks up, and a malicious hotspot can go further by tampering with those responses, quietly sending you to a fake login page instead of the real one. This is called DNS spoofing, and unencrypted lookups make it easier to pull off.
A private DNS is how you solve that problem. Google added support for it in Android 9 Pie, and it has been part of every version since. In the case of Android, it uses a protocol called DNS-over-TLS, which wraps your lookups in the same kind of encryption that protects HTTPS websites. Instead of sending requests in plain text, your phone opens a secure connection to a trusted resolver, checks that it’s talking to the right server, and sends its queries through that connection. Neat.
As a result, a nosy network can no longer read or alter your DNS traffic. Private DNS does have limits, though. It doesn’t hide your IP address, and a determined observer can still infer some things about the servers you connect to. It isn’t a VPN. What it does is close a common gap that’s easy to exploit, and it works at the operating-system level, so it covers every app on your phone without extra software.
How do you set it up?
Choosing a trusted provider takes less than a minute
For what it’s worth, setting up Private DNS takes less than a minute, and you don’t need to install anything. The exact path depends on who made your phone. On Pixels and most phones running near-stock Android, open Settings, tap Network & internet, and look for Private DNS. On some models, it sits under an Advanced menu. Samsung puts it somewhere else: go to Settings, then Connections, then More connection settings, and you’ll find Private DNS there. If you can’t find it, searching for “Private DNS” in the Settings search bar is usually the fastest route.
Once you open it, you’ll see three options: Off, Automatic, and Private DNS provider hostname. Automatic is often the default. It tries to encrypt your lookups using your network’s own DNS server if that server supports encryption. If it doesn’t, your phone falls back to regular, unencrypted DNS without telling you, which is exactly what you’d get on a sketchy public hotspot.
For real protection, choose the provider hostname option. This makes your phone use a specific encrypted resolver on every network. You’ll need to enter a hostname rather than an IP address because Android confirms the server’s identity as part of the encrypted handshake. Popular free choices include dns.google for Google Public DNS and one.one.one.one for Cloudflare. Personally, I use Cloudflare myself, since I’ve found it to be the fastest and most reliable. There’s also dns.quad9.net for Quad9, which blocks known malicious domains, and dns.adguard-dns.com for AdGuard, which also filters many ads and trackers. Type it in, tap Save, and you’re done.
There’s one quirk to know about. Some public networks, including certain hotel and corporate Wi-Fi setups, block the port that DNS-over-TLS relies on. If that happens, Android will warn you that the Private DNS server can’t be accessed, and pages won’t load. Switching to Automatic for a while will get you online, but you should treat that network with extra caution.
Other stuff you can do
Stacking simple habits for safer public Wi-Fi
Private DNS is a smart baseline, but it only fixes one of the things that make public Wi-Fi risky. If you often connect at airports, coffee shops, or hotels, a few other habits make a real difference.
The most effective upgrade is a reputable VPN. Private DNS encrypts only your lookups, while a VPN encrypts all of your traffic between your phone and the VPN server, hiding which sites and services you use from the local network. Most VPN apps send DNS through their own encrypted connection and override your Private DNS setting while connected, so the two don’t conflict. Choose carefully, though. A free VPN with a vague privacy policy can end up seeing more of your data than the café network ever would.
You can also be stricter about how your phone joins networks. Android can remember open networks you’ve used before and reconnect to them automatically. That makes it easier for an attacker to set up a fake hotspot with a familiar name. Forget public networks when you’re done, and turn off any setting that connects to open Wi-Fi automatically. When you don’t need Wi-Fi, switching it off further reduces your exposure.
Pay attention to what you do while connected. Almost every major website now uses HTTPS, but check for it before entering passwords or payment details, and never click past a browser warning about an invalid certificate. For sensitive tasks like banking, your mobile data connection is generally safer than shared Wi-Fi. If you need to get a laptop online, your phone’s hotspot works too.
Finally, keep your phone updated. Android security patches and Google Play system updates regularly fix vulnerabilities in the networking stack and elsewhere, but they only help if you install them.
Private DNS is a small step with real benefits
Private DNS won’t turn public Wi-Fi into a secure network, but it closes an easy gap attackers love to exploit. Set a trusted hostname, pair it with a VPN and sensible habits, and your Android phone becomes far harder to snoop on.