How to Check If Private DNS Is Working on Android (3 Quick Tests)

To check if Private DNS is working on Android, open a browser on your phone and run a DNS leak test — if the result names your provider (for example Cloudflare, Google or Quad9) instead of your mobile carrier, the setting is working. If it still shows your carrier, the setting saved but your lookups are not actually using it.

That distinction matters. Saving a hostname in Settings is not proof that anything changed. The setting can save cleanly while your queries still go to your carrier, a VPN can quietly take over DNS, or Automatic mode can fall back to plain DNS without telling you. The only way to know is to check if Private DNS is working with a test that shows who is really answering your lookups — and each of the three tests below takes about a minute.

Quick answer: how to check if Private DNS is working in under a minute

Open dnsleaktest.com in your phone's browser and run the Standard test. If the server listed is your Private DNS provider — Cloudflare, Google, Quad9 or AdGuard — instead of your carrier, Private DNS is working. If it still shows your carrier, the setting saved but your queries are not using it; work through the fixes below. Keep Automatic as your safe fallback while you test, and never copy a hostname from a random comment or video — only use one published on the provider's own site.

What is Private DNS?

Private DNS is Android's built-in setting for encrypted DNS, available on Android 9 and later. DNS is the lookup that turns a website name into the address your phone connects to. Without encryption, that lookup travels in plain text and can be read by whoever runs the network. Private DNS sends it over an encrypted connection (DNS-over-TLS) to a resolver you choose, so the lookup itself is harder to read or change on the way. Google's own help page puts the scope plainly: "Private DNS helps secure only DNS questions and answers. It can't protect anything else."

If you have not set it up yet, start with our guide to using Android Private DNS to block trackers without installing an app. This article is for the next step: proving the setting you already saved is actually doing its job.

What "working" actually means

"Working" has two parts, and a test has to confirm both:

• Your lookups are encrypted. They travel to the resolver over DNS-over-TLS (port 853) instead of plain text (port 53).
• Your lookups go to the provider you typed. The answers come from Cloudflare, Google, Quad9 or whichever hostname you entered — not from your carrier or your Wi-Fi router.

A test that only shows "the internet works" proves neither. A page loading proves name resolution works, not that it is encrypted or that it used your provider. A VPN, a cached page, or another resolver could still be answering. That is why each test below shows you the name of the server that actually answered.

What Private DNS can and cannot do

It can encrypt your DNS lookups on Wi-Fi and mobile data, system-wide, without installing an app — when it is working. It cannot hide your IP address, encrypt the content of your browsing, block every tracker, or act as a VPN. It also cannot force a network to accept encrypted DNS: if a network blocks it, Android either falls back or the connection fails. Knowing that limit matters when you read a test result, because a result that shows your carrier is often the setting working exactly as designed on a network that does not support it — not a fault in your phone.

Before you start

Note your current setting before you run any test, so you can get back to it: open Settings > Network & internet > Private DNS (on Samsung: Settings > Connections > More connection settings > Private DNS) and write down which option is selected — Off, Automatic, or a provider hostname — and the exact hostname if one is entered. That note is your way back. If a test result confuses you, return to Automatic first; it is the safe fallback Google recommends keeping on. If your phone is a work or school device, check with whoever manages it before changing network settings — an administrator policy may control this setting, and changing it may not be allowed.

Also close and reopen your browser before testing, or test with a site you have not just visited. A page your browser already loaded can come from its cache, and a cached page involves no new DNS lookup at all — which makes the test meaningless. The tests below take about a minute each, and they are the only way to check if Private DNS is working — the setting screen itself shows no confirmation.

Test 1: check if Private DNS is working with a DNS leak test

This is the test that works for every provider, and it is the one to run first. It is the fastest way to check if Private DNS is working, whatever provider you use.

1. Open your phone's browser and go to dnsleaktest.com.
2. Tap Standard test and wait a few seconds for the results.
3. Read the ISP (provider) column in the results. It names the company whose server answered your lookups.
4. Compare it with the provider you entered in Private DNS. If you set one.one.one.one, you should see Cloudflare. If you set dns.google, you should see Google. If you set dns.quad9.net, you should see Quad9. If you set dns.adguard-dns.com, you should see AdGuard.

How to read the result: if the ISP column shows your provider, Private DNS is working. If it shows your mobile carrier or your home internet provider instead, your lookups are not going through Private DNS — skip to the troubleshooting section below. If you want a deeper check, run the Extended test on the same site; it sends several queries and lists every resolver that answered, which can reveal a mix (for example, your provider for most queries and your carrier for one or two).

One honest limit: a leak test shows who answered, not how the query travelled. It cannot by itself prove the query was encrypted. For that proof, use Test 2 — but only if your provider is Cloudflare.

Test 2: check if Private DNS is working on your provider's own page

If your Private DNS hostname is Cloudflare's (one.one.one.one), Cloudflare runs a check page that answers the encryption question directly.

1. Open your phone's browser and go to 1.1.1.1/help.
2. Wait for the page to finish loading — the status lines show "Checking..." first, then settle.
3. Read the Debug Information lines. The ones that matter are:

• Connected to 1.1.1.1 — should say Yes.
• Using DNS over TLS (DoT) — should say Yes.
• Using DNS over HTTPS (DoH) — may say No; that is fine, because Android's Private DNS uses DNS over TLS, not DNS over HTTPS.

How to read the result: "Using DNS over TLS (DoT): Yes" is the direct confirmation that your lookups are encrypted. If it says No while Test 1 shows Cloudflare, your queries are reaching Cloudflare but not over the encrypted channel — check the troubleshooting steps below, especially the VPN and captive-portal ones.

This test only works for Cloudflare. If your provider is Google, Quad9 or AdGuard, their check pages do not offer the same simple status, so rely on Test 1 and Test 3 instead. Do not switch providers just to run this test; the leak test already answers the question that matters most.

Test 3: check if Private DNS filtering is working (AdGuard only)

This test only applies if your Private DNS hostname is a filtering one — AdGuard's dns.adguard-dns.com (or the family version, family.adguard-dns.com). If you use an unfiltered provider such as Cloudflare's standard one.one.one.one or Google's dns.google, skip this test; there is nothing to filter, and the page will not show a meaningful result.

1. Open your phone's browser and go to adguard.com/test.html.
2. Scroll to the AdGuard DNS section of the diagnostics page.
3. Look at the server status it reports. If it shows the public server as running, your device's lookups are reaching AdGuard DNS — your filtering hostname is working.

How to read the result: a running AdGuard DNS status confirms your filtering provider is in the path. If the page says AdGuard DNS is not running, or it cannot recognise your device, your lookups are going somewhere else — work through the troubleshooting steps below. Remember what this test does not prove: AdGuard DNS blocks known ad and tracker domains, but it cannot remove every ad — in particular, ads served from the same domain as the content you asked for (such as many YouTube ads) usually still appear.

Which test proves what

For most people, Test 1 alone is enough. Run Test 2 as well if you use Cloudflare and want the encryption confirmed in so many words. Run Test 3 only if you chose a filtering provider and want to confirm the filtering itself.

What the results mean: troubleshooting when the test still shows your carrier

If you check if Private DNS is working and Test 1 shows your carrier instead of your provider, work through these causes in order. Stop at the first one that explains what you see.

1. Automatic never engaged — and you are on Automatic

This is the most common confusion. Automatic only encrypts your lookups when the network's own resolver supports it. On most home routers and public Wi-Fi networks it does not, so Android quietly falls back to plain DNS without showing any warning. The setting still says Automatic, but nothing is encrypted. If you want encryption on every network, you need the provider-hostname option, not Automatic. For the full explanation, see our guide on why Private DNS keeps turning off on Android.

2. A VPN or DNS app took over

A VPN app that runs its own DNS usually takes over DNS lookups while it is connected. Some ad-blocker and DNS-changer apps do the same. That is expected behaviour, not a fault: only one DNS path can be in charge at a time. Turn the VPN off, run the leak test again, and if the result now shows your provider, the VPN was the cause. Google's own help page notes the same limit — Private DNS has no effect while a VPN is active.

3. The hostname is mistyped

Private DNS needs a hostname, not an IP address, and one wrong character is enough. one.one.one.one has four "one"s; dns.adguard-dns.com has a hyphen. Check the spelling character by character against the provider's own site — Cloudflare publishes one.one.one.one in its Android setup guide — and never type https://, a trailing slash, or a port number. If Android showed "couldn't connect to private DNS server" when you saved it, this is very likely the cause; our guide to fixing the Private DNS server cannot be reached error walks through it step by step.

4. The network blocks encrypted DNS

Some corporate, school and hotel networks block port 853 (the port DNS-over-TLS uses), so Android cannot reach your provider at all. Test on mobile data: if the leak test shows your provider on mobile data but your carrier on Wi-Fi, that Wi-Fi network is the cause. On that network, return to Automatic for the time being — you cannot force a network to accept encrypted DNS.

5. A captive portal got in the way

Hotel, airport and café Wi-Fi login pages intercept DNS to show the login screen, and encrypted DNS can break that. The correct move is to switch Private DNS off, sign in, then switch it back on — and then re-run the leak test, because the second half is the part people forget.

6. Chrome's own Secure DNS answered instead

Chrome has its own "Use secure DNS" setting, and when it is on, the browser can resolve names through its own resolver instead of Android's Private DNS. If the leak test looks right in Firefox but wrong in Chrome, Chrome's setting is the cause. Turn Chrome's Secure DNS off (Chrome > Settings > Privacy and security > Use secure DNS) and test again, or run the leak test in a different browser.

The question everyone asks

Does Private DNS work on Wi-Fi and mobile data?

Yes — the setting is system-wide, so the same provider hostname applies on both. That is exactly why you should test on both: run the leak test on Wi-Fi, then turn Wi-Fi off and run it again on mobile data. Different results on the two networks usually mean one network blocks encrypted DNS (cause 4 above), not that your phone is faulty.

Does Private DNS hide my IP address?

No. It encrypts the lookup — the question "what is the address of this site?" — but it does not hide your IP address, change your location, or encrypt the rest of your traffic. Websites you visit still see your IP address. If that is what you need, a VPN is a different tool for a different job, and our Private DNS vs VPN comparison explains where each one stops — Private DNS covers the lookup, a VPN covers the traffic.

Limitations of these tests

• A leak test shows who answered, not how the query travelled. Only the provider's own check page (Test 2) confirms encryption directly, and only for Cloudflare. No single test can check if Private DNS is working perfectly on its own; that is why this guide gives you three.
• A cached page involves no new lookup, so always close and reopen the browser, or test with a site you have not just visited.
• Some apps bring their own DNS and ignore the system setting entirely — a leak test in a browser only proves what the browser's lookups do.
• A single test is a snapshot. Networks change, captive portals appear, and a VPN can start later; if something stops working, re-run Test 1 before changing anything.
• These tests check your phone's setting. They say nothing about other devices on the same Wi-Fi network, which keep using the router's DNS unless you change them too.

How to turn Private DNS off safely

If a test result worries you, or a network stops working, return to the safe fallback rather than deleting the hostname in a hurry:

1. Open Settings > Network & internet > Private DNS (on Samsung: Settings > Connections > More connection settings > Private DNS).
2. Choose Automatic and tap Save. Automatic is the default Google recommends keeping on.
3. If the connection is still broken, choose Off temporarily, test, then return to Automatic.
4. Re-run the leak test after each change, so you know what actually changed.

Your hostname stays saved in the field when you switch back to Automatic, so you can return to it later without retyping it — just re-select the provider-hostname option and check the spelling before saving.

Frequently asked questions

How do I check if Private DNS is working on mobile data?

Turn Wi-Fi off, open dnsleaktest.com in your browser and run the Standard test. If the ISP column shows your provider instead of your carrier, Private DNS is working on mobile data. Test on Wi-Fi separately — the two networks can give different results.

How often should I check if Private DNS is working?

Once, right after you set it up, and again after anything that can change the setting — a system update, a restart, a new VPN app, or a trip where you used hotel or airport Wi-Fi. There is no need to test daily; the setting does not drift on its own.

Does the leak test work if I use a VPN?

It shows the result for the VPN's DNS, not your Private DNS setting, because the VPN takes over DNS while it is connected. Turn the VPN off first, run the test, then turn the VPN back on if you need it.

Why does the leak test show my carrier even though I saved a hostname?

When you check if Private DNS is working and the result still shows your carrier, the usual causes, in order, are: you are on Automatic (which never engaged on this network), a VPN or DNS app took over, the hostname is mistyped, the network blocks port 853, or a captive portal is in the way. Work through the troubleshooting section above in order.

Is dnsleaktest.com safe to use?

It is a widely used diagnostic site that shows your IP address and the DNS server answering your queries — the same information any website you visit can already see. It runs in your browser, needs no install, and no account. If you prefer not to use it, your provider's own check page (Test 2 for Cloudflare) is the alternative.

Can I check if Private DNS is working without a browser?

Not easily on a normal phone. There is no built-in indicator that shows the resolver in use. The browser tests above are the practical way; the developer-only alternative (checking the setting over ADB with adb shell settings get global private_dns_specifier) only shows what you typed, not whether it is actually being used.

Final checklist

Run through this list after you check if Private DNS is working — every box ticked means the setting is proven, not just saved.

• [ ] You noted your current Private DNS setting and hostname before testing.
• [ ] You closed and reopened the browser, so no cached page skewed the result.
• [ ] Test 1 (dnsleaktest.com, Standard test) shows your provider, not your carrier.
• [ ] If you use Cloudflare, Test 2 (1.1.1.1/help) shows "Using DNS over TLS (DoT): Yes".
• [ ] If you use a filtering hostname, Test 3 (adguard.com/test.html) shows AdGuard DNS running.
• [ ] You tested on both Wi-Fi and mobile data, or you know why one of them differs.
• [ ] If a result showed your carrier, you worked through the troubleshooting causes in order — and you know your safe fallback is Automatic.

Final takeaway

The habit to keep is simple: check if Private DNS is working the moment you set it up, and again whenever anything changes — one leak test, one minute, and the ISP column tells you the truth. A saved setting is a promise; a test result is proof. If the result shows your provider, you are done. If it shows your carrier, the cause is almost always one of the six above, and the safe move while you sort it out is Automatic — never an unfamiliar hostname copied from a comment.

Checking a family or shared phone

On a shared or family phone, the same tests apply — but only check a phone with the owner's permission, and tell them what you changed and why. For a child's phone, a single test is not enough: a filtering setup needs more than this setting alone, because anyone holding the phone can change it in a few taps. Our guide to setting up Private DNS for kids on Android covers the family setup, and the test in this article is the way to confirm that setup is actually holding. Keep a short note of the hostname, the date you set it, and the test result — the next person to check the phone will thank you for it.

When not to rely on these tests

Do not treat a good test result as a guarantee about a different network. A result on your home Wi-Fi says nothing about the hotel Wi-Fi you join tonight, and a result on mobile data says nothing about your office network. Every time the network changes, check if Private DNS is working again before assuming the earlier result still holds.

Originally published on Dubydex Blog: https://dubydex-blog.wasmer.app/how-to-check-if-private-dns-is-working-on-android/