Android setup (Private DNS)#

Android 9 and later has encrypted DNS built in. Two minutes, no app required, and it works on every network: home Wi-Fi, school Wi-Fi and mobile data.

Steps#

1. Open Settings.
2. Go to Network and internet (on Samsung: Connections), then Private DNS. On some phones it is under More connection settings or findable via the settings search.
3. Select Private DNS provider hostname.
4. Enter your configuration's hostname: <configid>.dns.gracedns.eu, replacing <configid> with the id from your GraceDNS configuration (for example 7f3a9c12.dns.gracedns.eu).
5. Tap Save.

Verify#

Open a browser and visit a domain that your configuration blocks (add example-blocked.test style test entries to your denylist if you have none). The page should fail to load or show your block page. Your configuration's query log (if enabled) shows the blocked lookup.

Notes#

• Private DNS uses DNS over TLS (port 853). Some restrictive networks block it; Android then shows "Private DNS server cannot be accessed". Your traffic is not silently unprotected: Android refuses to fall back to unencrypted DNS while a Private DNS hostname is set.
• The setting applies phone-wide, to all apps, on all networks.
• To pause filtering, switch Private DNS back to Automatic. If you are setting up a child's device, use your platform's parental controls (for example Family Link) to lock the settings app so the entry cannot be changed.

Back to docs.

View as markdown