Among the searches that reach this site from Android there’s a very specific one: what to type in the “Private DNS provider hostname” field. People type 1.1.1.1, the phone rejects it, and that’s where the search comes from. The answer is short and goes first; the why comes after.
The names, by provider
| Provider | Hostname | What it does |
|---|---|---|
| Cloudflare | one.one.one.one | Unfiltered, fast |
| Cloudflare, malware | security.cloudflare-dns.com | Blocks malware |
| Cloudflare, family | family.cloudflare-dns.com | Malware and adult content |
dns.google | Unfiltered | |
| Quad9 | dns.quad9.net | Blocks malware |
| Quad9, unfiltered | dns10.quad9.net | Unfiltered |
| AdGuard | dns.adguard-dns.com | Ads, trackers, malware |
| AdGuard, family | family.adguard-dns.com | The above plus adult content |
| DNS4EU | protective.joindns4.eu | Malware (European resolver) |
| DNS4EU, ad-free | noads.joindns4.eu | Malware and ads |
| DNS4EU, child | child.joindns4.eu | Malware and adult content |
| Control D | p0.freedns.controld.com | Unfiltered (p1 malware, p2 ads, p3 social) |
| CleanBrowsing, family | family-filter-dns.cleanbrowsing.org | Adult content and safe search |
| Mullvad | dns.mullvad.net | Unfiltered (adblock.dns.mullvad.net with ads) |
| NextDNS | <your-id>.dns.nextdns.io | Whatever you configure in your account |
Type it exactly as shown: no https://, no trailing slash, no port. One dot too many or one hyphen too few and Android will say it can’t connect.
Where the setting is
Settings → Network & internet → Private DNS. On Samsung: Settings → Connections → More connection settings → Private DNS. On Xiaomi and others, under Connection & sharing or similar; if you can’t find it, the Settings search finds it if you type “Private DNS”. It has existed since Android 9.
It has three options:
- Off: ordinary, unencrypted DNS, whatever each network hands out.
- Automatic: Android tries encrypted DNS with the DNS the network gives it and, if that doesn’t support it (usually the case), falls back to ordinary DNS. It’s the default and in practice changes little.
- Private DNS provider hostname: the one that matters. You type one of the names above and Android uses it on every network, Wi-Fi and data, always encrypted.
Why it asks for a name and not an IP
“Private DNS” is DNS over TLS (DoT): queries travel inside an encrypted connection to port 853, like a website over HTTPS. To know it’s talking to Cloudflare and not someone in the middle, Android checks the server’s certificate, and certificates are issued to a domain name, not an IP. That’s why the field asks for one.one.one.one and not 1.1.1.1: they’re the same machine, but only the name allows verification.
It’s also what makes the setting work against ISPs that intercept DNS: they can’t read or replace what goes inside that connection. We cover it in DNS to open blocked sites.
”Couldn’t connect”: the three causes
- Typo. The cause in most cases. Copy the name from the table; the trickiest are
one.one.one.one(four “one”s separated by dots) anddns.adguard-dns.com(with a hyphen). - The network blocks port 853. Some corporate, university and hotel Wi-Fi networks cut everything that isn’t web. Switch to mobile data and save the setting; if it works on data, it was the network. On that Wi-Fi you’ll have to set “Automatic” temporarily.
- Captive portal. In hotels and airports, the accept-terms page needs to intercept DNS to appear. With Private DNS on, it doesn’t. Turn it off for a moment, accept, turn it back on.
If it won’t connect on mobile data with any name from the table either, the carrier is blocking port 853, which is rare but happens. The alternative is the provider’s app (Cloudflare, AdGuard and NextDNS have one), which uses DNS over HTTPS on port 443 and can’t be blocked without blocking the whole web.
Which one to pick
It depends on what you want and where you are, and the best way is to measure from the phone itself with the speed test, on Wi-Fi and on data. As a guide: unfiltered and fast, Cloudflare or Quad9; ads gone from every app, AdGuard; in Europe, DNS4EU. The phone article goes into the criteria, and the ad-blocking one into what a filter can and can’t do.
One last detail: Private DNS applies to the whole phone except apps that bring their own DNS (some browsers with DoH enabled, and VPNs). If you use a VPN, the VPN wins.