To remove a Private DNS hostname on Android, open Settings > Network & internet > Private DNS, choose Automatic (or Off for a short test), and tap Save; the phone then stops using that custom provider. To change Private DNS on Android to another provider, record the current mode, choose Private DNS provider hostname, and enter only a hostname supplied by a DNS provider or administrator you trust. Test both Wi-Fi and mobile data before treating either change as complete.

Key Takeaways

Android uses Private DNS by default on networks that support it, and Google recommends leaving it enabled.［1］

The custom field expects a provider hostname, not a regular DNS server IP address.

Private DNS protects DNS questions and answers; it does not encrypt every connection, change your public IP, or replace a VPN.

A captive portal, wrong hostname, filtered network, or managed policy can make a correct-looking setting fail.

Save the original mode and restore it after a temporary diagnostic test.

Start with the device and app troubleshooting guide if you have not yet shown that DNS is the failing layer. A Wi-Fi icon, a browser error, and a broken app can point to different problems.

What does Android Private DNS change?

Private DNS is Android's system setting for encrypted DNS on compatible networks. It protects the questions your device sends to a DNS resolver and the answers it receives. Google explicitly limits that protection to DNS traffic.

It does not prove that a website is trustworthy, encrypt an app that uses an insecure connection, hide your public IP address, or repair a router or mobile carrier outage. The broader DNS guide explains how resolver selection differs from the rest of a network connection.

Android presents three modes:

Mode	What it means	When to use it
Off	Do not request Android Private DNS	A short, controlled diagnostic or a network that cannot support it
Automatic	Use Private DNS when the current network supports it	The safest normal default for most users
Private DNS provider hostname	Connect to one named provider	Only with an exact, trusted hostname

Menu names can vary by manufacturer and Android version. Google advises searching Settings for “Private DNS” or asking the device manufacturer when the option is not in the expected location. Pixel's current advanced-network guide also notes that steps can vary by device.［2］ Do not install an unrelated app or configuration profile merely to make the menu appear.

What should you record before changing Android Private DNS settings?

Create a small recovery record before touching the setting:

The current mode: Off, Automatic, or provider hostname.
The exact provider hostname, including spelling, if custom mode is active.
Whether the phone is personal, managed by work or school, or supervised.
One website and one app that work before the change.
Whether the phone works on Wi-Fi, mobile data, or both.

Do not store passwords, internal hostnames, or organization details in a public ticket. If the field is locked, a value returns after you change it, or the hostname belongs to an organization, stop and contact its administrator. A device policy, security product, or work profile may own the setting.

If every device fails on the same Wi-Fi, use the Android Wi-Fi no-internet checklist before changing one phone. If only mobile data fails, use the Android mobile data guide.

How do you change Private DNS on Android?

Use the system setting rather than a third-party shortcut:

Open Settings.
Tap Network & internet.
Tap Private DNS. If it is missing, search Settings for Private DNS.
Choose Off, Automatic, or Private DNS provider hostname.
For a custom provider, enter the exact trusted hostname supplied by its owner.
Tap Save.
Reopen the setting and confirm that the selected mode remains in place.

These are Google's current Android steps, but the manufacturer may rename or relocate them. A custom hostname is not the same field as a numeric DNS address shown in Wi-Fi IP settings. Do not paste an IP address, a web URL, a username, or a search result into the hostname field.

Change one variable at a time. Do not simultaneously forget the Wi-Fi network, reset mobile settings, disable a proxy, and change Private DNS; that would make the result impossible to attribute.

How do you verify a Private DNS provider hostname?

Verification should show that ordinary use still works on each network type you rely on:

Keep Wi-Fi on and open two unrelated HTTPS sites.
Reopen one app that previously worked and one that previously failed.
Turn Wi-Fi off and repeat the same checks on mobile data, if your plan allows it.
Return to Private DNS and confirm that the custom hostname is still selected.
Record the exact error and network type if the phone reports that it cannot connect.

Do not use a marketing “DNS leak” page as the only proof. A web page can show one resolver observation, but it cannot prove that every app, work profile, local network name, or captive portal behaves correctly.

If the change fixes only one network, document that network dependency. If it breaks both Wi-Fi and mobile data, first recheck the hostname for transcription errors and confirm that the provider still supplies that hostname.

Why is Private DNS blocking a captive portal or local network?

Hotel, airport, school, and guest networks may require a sign-in page before normal internet access is allowed. A custom resolver can be unreachable before that authorization or can conflict with the network's local naming and filtering design.

For a network you are authorized to use:

Record the current custom hostname.
Change Private DNS to Automatic for the sign-in test.
Reconnect to the Wi-Fi and open a new browser page to trigger the portal.
Complete only the expected network terms or login.
Restore the original custom hostname and test again.

Use Off only when Automatic does not isolate the problem and you understand the temporary loss of encrypted DNS. Do not leave protection disabled merely because one captive portal was poorly designed. Never bypass an organization policy or certificate warning to force access.

Local printers, NAS names, parental controls, and split DNS can also depend on a resolver chosen by the network or organization. If a custom hostname breaks only those destinations, ask the network owner how local names are intended to resolve instead of adding random exceptions.

How do you remove a Private DNS hostname or restore the original mode?

To stop using a custom hostname you no longer want:

Open Settings > Network & internet > Private DNS.
Select Automatic to keep encrypted DNS on networks that support it, or Off only for a brief diagnostic.
Tap Save.
Repeat one website and one app check on Wi-Fi and on mobile data.

Switching the mode is the removal step; you do not need to reset network settings or install another app. If the hostname comes back or the option is grayed out, treat it as a managed value and follow the support steps below.

To undo a test instead, return to the same screen and select the mode from your recovery record. If it was custom, enter the exact original hostname, save, and repeat the same Wi-Fi and mobile-data checks.

If the setting will not save, immediately reports a connection failure, or keeps returning to a managed value, preserve the error and stop changing adjacent settings. Give support the phone model, Android version, network type, chosen mode, hostname owner, and the comparisons you ran. Do not send private account details or organization credentials.

Summary

Record the original Android Private DNS mode before changing it.
Use Automatic for the normal default or an exact trusted provider hostname for custom mode.
Test Wi-Fi and mobile data separately with the same sites and apps.
Treat Off as a temporary diagnostic state, not a universal fix.
Keep Private DNS separate from proxies, VPNs, public IP changes, captive portals, and router faults.

FAQ

Is Private DNS on by default on Android?

Android uses Private DNS by default on networks that support it. The normal Automatic mode lets the device use it when available.

What should I enter as a Private DNS provider hostname?

Enter only the exact hostname published by a resolver provider or administrator you trust. Do not enter an ordinary IP address, webpage URL, or search result.

Does Private DNS change my public IP address?

No. It changes how compatible DNS queries are handled; it does not replace the network address assigned by your carrier, router, or internet provider.

Is Private DNS the same as a VPN?

No. Private DNS protects DNS questions and answers. A VPN is a separate network layer that can carry broader traffic through a tunnel.

Why does Android say it cannot connect to Private DNS?

The hostname may be wrong, the provider may be unavailable, the current network may block the connection, or a captive portal may not be complete. Restore Automatic and compare networks before changing anything else.

Should I turn Private DNS off for a hotel sign-in page?

Try Automatic first, complete the authorized captive portal, and then restore your original mode. Use Off only as a brief diagnostic when you understand the tradeoff.

Can a work profile control Private DNS?

A managed device or network policy may control network settings. If a value is locked or returns automatically, contact the administrator rather than trying to remove the policy.

Will changing Private DNS fix every Android connection problem?

No. It cannot repair weak Wi-Fi, an expired mobile plan, a failed router, an app outage, a wrong proxy, or a blocked account. Scope the symptom before using it as a fix. Android Private DNS configures resolver transport; a VPN carries traffic through a tunnel, so neither one repairs a broken router or an unavailable app account.

Sources:

Android Help - Manage advanced network settings on your Android phone — https://support.google.com/android/answer/9654714
Pixel Phone Help - Manage advanced network settings on your Pixel phone — https://support.google.com/pixelphone/answer/9655181?hl=en

Sources checked 4 October 2026.

Related articles:

How to Change Private DNS on Android