Updated October 13, 2026. Android’s Private DNS setting can route your phone’s DNS lookups through a filtering provider, which may block requests to known ad and tracker domains across apps and browsers. It is a useful no-app option, but it cannot remove every ad: ads served from the same domain as the content, or delivered without a separately blocked DNS request, can remain.
There is another important distinction in the name. “Private DNS” encrypts DNS questions and answers between your device and the resolver; it does not encrypt all of your internet traffic, hide your identity, or make browsing anonymous. Google’s Android help explicitly says the feature protects only DNS queries and responses.
Set up a filtering DNS provider
On Android 9 or later, open Settings → Network & internet → Private DNS. Choose Private DNS provider hostname, enter dns.adguard-dns.com, and tap Save. AdGuard lists this as its public filtering hostname for ads and trackers. It does not require an AdGuard account.
Menu names vary. On Samsung phones, search Settings for “Private DNS” if the menu is not where Google’s generic Android guide shows it. Android’s own instructions say to use Settings search or the phone maker’s help if the option is not visible. Android 8 and older do not offer this system-wide Private DNS control.
For a non-filtering encrypted resolver, AdGuard lists unfiltered.adguard-dns.com. Its family server, family.adguard-dns.com, adds adult-content filtering and safe-search behavior where possible. These are provider-specific services; read the provider’s current terms and privacy policy before routing device lookups through it.
What changes—and what does not
DNS is the step that turns a domain name into a network address. A filtering resolver can decline to resolve domains on its blocklist. When an app depends on a blocked domain for an ad or tracker, that request may fail before the content loads. Because Android Private DNS is a device setting, the resolver can apply to supported Wi-Fi and mobile networks without installing a separate blocking app.
- It can block: some ads, trackers, or harmful domains when the provider recognizes their hostnames and the app uses the device’s configured DNS path.
- It cannot promise: ad-free YouTube or every in-app ad. Ads can share a domain with the content, use first-party delivery, or arrive through a path the filter does not block.
- It does not do: remove the ad space in a webpage, block scripts like a browser content blocker, encrypt all traffic, or conceal your IP address from websites.
- It may disrupt: sign-in, app content, or captive Wi-Fi login if a necessary domain is blocked. Switch back to Automatic to test whether filtering caused the problem.
Private DNS also does not mean “no one can see DNS activity.” Encryption protects the query on the path to the resolver, but the selected DNS provider still receives the lookup. A 2021 research paper demonstrated that patterns in encrypted Android DNS traffic could still help identify which apps were being used under the study’s conditions. The work does not mean every observer can read every query; it shows why encryption should not be confused with anonymity.
VPNs and work profiles can change the result
A VPN or DNS-changing app may route or replace DNS separately. Google’s public DNS documentation warns that some VPN and DNS-changer apps override Android Private DNS, so the hostname you entered may not control the active resolver while that software is running. If filtering seems inconsistent, temporarily compare the setting with and without the VPN only when it is safe to disconnect; on a work-managed phone, follow your organization’s network policy.
How to turn it off or fix connection problems
- Open Settings and search for “Private DNS.”
- Choose Automatic to return to Android’s automatic resolver selection, or choose Off only if you specifically need to disable Private DNS.
- Tap Save, then retry the affected app or network.
- If only one app is broken, temporarily restore Automatic first. If that fixes it, the selected provider may be blocking a domain the app needs.
- For hotel, airport, or café Wi-Fi, reconnect and complete the network sign-in page; if it still will not appear, switch to Automatic while joining, then review whether to restore your preferred setting afterward.
FAQ
Does Private DNS block every ad on Android?
No. It filters domain lookups. It may block some known ad domains, but it cannot reliably remove ads served from the same domain as the content or ads that do not require a separately blockable domain.
Is Private DNS the same as a VPN?
No. A VPN tunnels broader network traffic through a VPN service. Android Private DNS protects DNS lookups to a chosen resolver; it does not hide your IP address or encrypt all application traffic.
Which hostname should I use for ad filtering?
AdGuard currently documents dns.adguard-dns.com as its public ad- and tracker-filtering hostname. Provider behavior and lists can change, so verify the hostname on the provider’s official page before entering it.
Will this setting work while I use a VPN?
Not necessarily. Some VPN or DNS apps override the system setting. Check the VPN provider’s DNS controls and its documentation; do not assume Private DNS is the active resolver whenever a separate network app is running.
Sources
- Google Android Help: Manage advanced network settings (menu choices, availability, and the DNS-only protection limit).
- AdGuard DNS: connect to public DNS servers (current filtering, non-filtering, and family hostnames).
- Google Public DNS: using DNS-over-TLS on Android (Android support and VPN/DNS changer caveat).
- S. Siby et al., “How Private is Android’s Private DNS Setting? Identifying Apps by Encrypted DNS Traffic” (research on app fingerprinting from encrypted DNS traffic under tested conditions; not proof of universal deanonymization).
Editorial note: This guide reflects official Android and provider documentation checked October 13, 2026. DNS filtering outcomes depend on the app, provider blocklists, VPN configuration, and network.