Private DNS on Android: Block Ads Without an App

Updated October 2026. Hostnames, settings paths and prices checked against Google's Android help and each provider's own pages on 23 October 2026.

Short answer: Android has a built-in setting called Private DNS that can block most ads across the whole phone, in apps and browsers, without installing anything. Open Settings, search for Private DNS, choose Private DNS provider hostname, type dns.adguard-dns.com and tap Save. That's it. It won't touch YouTube ads, and a VPN will override it, but for banner ads and trackers in free apps and games it works surprisingly well.

Below are the hostnames worth using, where the setting hides on Pixel, Samsung, Xiaomi and OnePlus phones, how to check it's really working, and what to do when it breaks your Wi-Fi.

Jump to:

• How Private DNS blocks ads
• Step 1: Pick a server
• Step 2: Find the setting
• Step 3: Enter the hostname
• Step 4: Check it works
• Step 5: Fix connection errors
• What it can't block
• iPhone, Windows and Mac
• FAQ

How Private DNS blocks ads

Every time an app wants to load an ad, it first asks a DNS server for the address of the ad server, something like googleads.g.doubleclick.net. Normally your phone sends that question to whatever DNS your Wi-Fi router or mobile carrier hands out, and gets a real answer back.

An ad-blocking DNS server keeps a list of known ad and tracking domains. When your phone asks about one of them, it answers with a dead address (usually 0.0.0.0) and the ad never loads. Everything else resolves normally. It's the same idea as running Pi-hole or AdGuard Home at home, except someone else runs the server and it follows your phone onto mobile data and other people's Wi-Fi.

Android's Private DNS, added in Android 9, uses DNS-over-TLS. That means your lookups are encrypted on port 853, so the café Wi-Fi or your carrier can't read or quietly rewrite them. The catch is that it only takes a hostname, not an IP address and not a full URL. Typing https://, tls://, an IP like 94.140.14.14 or a path like /dns-query won't work.

Step 1: Pick a DNS server that blocks ads

Plenty of popular DNS services don't block ads at all. Cloudflare's one.one.one.one and Google's dns.google are fast and private but filter nothing, and Quad9 (dns.quad9.net) only blocks malware. If you put those in, you get encryption and no ad blocking. These are the ones that do block ads:

If you just want ads gone, start with dns.adguard-dns.com. It has been around for years, needs no sign-up, and its list is tuned so it doesn't break many sites. Control D's p2 server is a good second choice if AdGuard is slow where you live.

NextDNS is the one I'd pick if you like to tinker. You make a free account, choose blocklists, and get a personal ID that becomes part of the hostname, for example abc123.dns.nextdns.io. You can also put a device name in front, like Pixel--8-abc123.dns.nextdns.io (two hyphens stand for a space), so the logs show which phone made which request. The free tier stops filtering after 300,000 queries in a month and just resolves normally, which a single phone rarely hits but a family might. Pro is $1.99 a month or $19.90 a year, about ₹189 and ₹1,889 at today's rate of roughly ₹94.9 to the dollar. AdGuard also has a free personal account with a dashboard and custom rules if you outgrow the public server.

One to avoid: older guides still recommend Mullvad's ad-blocking DNS. Mullvad says it is shutting down its public DNS service on 2 November 2026, so don't set it up now. And the old dns.adguard.com hostname from 2019-era tutorials has been replaced by dns.adguard-dns.com.

Step 2: Open the Private DNS setting

The fastest way on any Android phone is to open Settings and type Private DNS into the search bar at the top. If you'd rather tap through menus, here's where it sits on the big brands:

• Google Pixel and stock Android (Motorola, Nothing): Settings > Network & internet > Private DNS. On some older versions it's under Advanced.
• Samsung Galaxy (One UI): Settings > Connections > More connection settings > Private DNS.
• Xiaomi, Redmi and Poco (HyperOS, MIUI): Settings > Connection & sharing > Private DNS.
• OnePlus, Oppo and Realme: Settings > Wi-Fi & network (or Mobile network) > Private DNS.

You'll see three choices. Off uses your network's DNS in plain text. Automatic, the default on most phones, encrypts DNS only if your network's own server supports it, and falls back to plain DNS if it doesn't, so it never blocks ads. Private DNS provider hostname is the one you want.

If the option is greyed out or missing, the phone is probably managed by a school or employer, or a work profile policy is locking it. Google's help page says some settings may differ on managed devices, and there isn't a way around that without the admin.

Step 3: Enter the hostname and save

Choose Private DNS provider hostname, type the hostname exactly, for example dns.adguard-dns.com, and tap Save. No spaces, no https://, nothing after the domain.

The setting applies to every network: home Wi-Fi, mobile data, hotspots, all of it. Unlike the old trick of changing DNS per Wi-Fi network, you only do this once. To make sure apps stop using cached answers, turn Airplane mode on and off, or just restart the phone.

A typo matters more than you'd think. The phone checks the server's TLS certificate against exactly what you typed, so dns.adguard.dns.com or a missing letter fails completely and you lose internet on every app until you fix it. If things stop loading right after you hit Save, check the spelling first.

Step 4: Check that it is actually blocking

Each provider has its own test page. With AdGuard, open adguard.com/en/test.html in your browser and it'll tell you whether you're on the default, family or non-filtering server. With NextDNS, test.nextdns.io shows whether your phone is using your profile.

A rougher check: open an ad-heavy free game or a news site in Chrome. You should see blank gaps where banners used to be. Some apps show a small "ad failed to load" placeholder instead, which is fine.

To see what the servers return, I sent the same lookups to several of these resolvers from a Linux server over encrypted DNS on 23 October 2026. AdGuard's default server and Control D's p2 both answered 0.0.0.0 for doubleclick.net and googleads.g.doubleclick.net, while Cloudflare and Google returned real Google ad server addresses. All of them resolved www.youtube.com normally, which is the YouTube problem in one line. That was a quick check of the servers, not a test on a phone, but the phone asks the exact same question.

Step 5: Fix "Private DNS server cannot be accessed"

This is the error people hit most. Android shows it under the Wi-Fi network's details, or the network says "connected, no internet". It means the phone couldn't open an encrypted connection to your DNS server on port 853, and because you chose a specific hostname, it refuses to fall back to unencrypted DNS. That's by design, but it feels like the Wi-Fi is broken.

The usual causes, in order:

• A typo in the hostname. Retype it.
• Hotel, airport or café Wi-Fi with a login page. These captive portals need their own DNS to show the sign-in screen and often block port 853 until you've signed in. Set Private DNS to Automatic, sign in, then switch back.
• Office or school Wi-Fi that blocks port 853 to force everyone onto its own DNS. Use Automatic on that network or stay on mobile data.
• The provider is down or very slow from where you are. Android gives up on a server that takes too long to respond. Try a different one from the table.

The annoying part is that the setting is global. Android won't remember "use Automatic on the hotel Wi-Fi and AdGuard everywhere else", so you have to flip it back yourself. If you travel a lot, that's a real reason to consider an app instead.

What Private DNS cannot block

DNS blocking only works when ads come from a different domain than the content. That rules out a few big ones:

• YouTube ads. Video ads are served from the same Google servers as the videos, so blocking them would block YouTube. No DNS service, Pi-hole included, gets rid of them.
• Sponsored posts on Instagram, Facebook, X and TikTok. Same reason. They're part of the feed.
• Ads inside some Google and Samsung apps that share domains with things you need, like the Play Store.

Other things that quietly switch it off:

• VPN apps. When a VPN is connected, your DNS usually goes through the VPN's own servers, and Private DNS stops applying. Some VPNs let you set a custom DNS or have their own ad blocker, so look there.
• Chrome's own secure DNS setting. Chrome on Android has Settings > Privacy and security > Use secure DNS. If you pick a specific provider there, like Cloudflare, Chrome's lookups go to that provider instead of your ad-blocking server. Leave it on the default.
• Apps that ship their own DNS. A few apps bypass the system resolver entirely. Not common, but it explains the odd ad that still gets through.

And occasionally it blocks something you wanted, like a shopping link that goes through a tracking domain, or a deal site's redirect. With the public servers you can't whitelist anything. If that bugs you, NextDNS or a free AdGuard DNS account lets you allow specific domains, or you can turn Private DNS to Automatic for a minute.

iPhone, Windows and Mac

The same servers work on other devices, the setup is just different.

iPhone and iPad don't have a hostname box. You install a configuration profile instead. AdGuard, Control D, NextDNS and DNS4EU all offer one on their sites. Download it in Safari, then go to Settings > General > VPN & Device Management (on newer iOS versions the screen is called VPN, DNS & Device Management) and install it. AdGuard notes the profile is ignored while a VPN is running, and iCloud Private Relay can take over DNS in Safari too.

Windows 11 supports encrypted DNS over HTTPS under Settings > Network & internet > Wi-Fi (or Ethernet) > Hardware properties > DNS server assignment. macOS uses profiles, like the iPhone. Each provider's setup page lists the exact addresses.

If you want ad blocking for every device in the house, including smart TVs and consoles that have no DNS setting at all, putting the filter on the network is the better fix. I've written up how to set up AdGuard Home and a full Pi-hole and WireGuard build on a Raspberry Pi, which also lets your phone use your home blocker when you're out.

Is Private DNS enough, or do you need an app?

For most people, Private DNS is the right first step. It costs nothing, doesn't run in the background, doesn't drain battery and doesn't need a permission that can read your traffic. You lose nothing by trying it, and you can switch it back to Automatic in ten seconds.

An ad-blocking app that runs as a local VPN can do more, like per-app rules and cosmetic filtering inside browsers, but it takes the VPN slot, so you can't run a real VPN at the same time. A browser with a built-in blocker, like Firefox with uBlock Origin or Brave, handles web ads better than DNS ever will. I'd use Private DNS for apps and games, and a good browser for the web.

FAQ

Does Private DNS slow down my phone or internet?

Usually not in a way you'd notice. Encrypted lookups add a few milliseconds, and pages often load faster because the ads never download. If a provider is far from you and feels sluggish, try another from the table.

Which Android versions have Private DNS?

Android 9 and newer. That covers almost every phone still getting updates. Older phones need an app or a DNS change on the router.

Can I use an IP address like 94.140.14.14 in Private DNS?

Sadly no. Android wants a name there, since it verifies the server's certificate against whatever you type, and an IP won't match. Put dns.adguard-dns.com in and forget about AdGuard's IPs, those are for routers.

Why are YouTube ads still showing?

Because YouTube serves ads from the same servers as the videos. DNS can only block whole domains, so it can't separate the two. That's true for every DNS blocker.

Does Private DNS work on mobile data?

Yes. It applies to Wi-Fi and mobile data alike, which is the main advantage over changing DNS on your router.

Is Private DNS safe to leave on?

Yes, as long as you trust the provider, since it sees which domains you look up. AdGuard, Control D and NextDNS all publish privacy policies, and the free AdGuard and Control D servers don't need an account. Just remember to switch to Automatic when a hotel or airport Wi-Fi login page won't load.