# Android setup (Private DNS)

Android 9 and later has encrypted DNS built in. Two minutes, no app required, and it works on every network: home Wi-Fi, school Wi-Fi and mobile data.

## Steps

1. Open **Settings**.
2. Go to **Network and internet** (on Samsung: **Connections**), then **Private DNS**. On some phones it is under **More connection settings** or findable via the settings search.
3. Select **Private DNS provider hostname**.
4. Enter your configuration's hostname: `<configid>.dns.gracedns.eu`, replacing `<configid>` with the id from your GraceDNS configuration (for example `7f3a9c12.dns.gracedns.eu`).
5. Tap **Save**.

## Verify

Open a browser and visit a domain that your configuration blocks (add `example-blocked.test` style test entries to your denylist if you have none). The page should fail to load or show your block page. Your configuration's query log (if enabled) shows the blocked lookup.

## Notes

- Private DNS uses DNS over TLS (port 853). Some restrictive networks block it; Android then shows "Private DNS server cannot be accessed". Your traffic is not silently unprotected: Android refuses to fall back to unencrypted DNS while a Private DNS hostname is set.
- The setting applies phone-wide, to all apps, on all networks.
- To pause filtering, switch Private DNS back to **Automatic**. If you are setting up a child's device, use your platform's parental controls (for example Family Link) to lock the settings app so the entry cannot be changed.

Back to [docs](../index.md).