Changing networks should not mean forgetting about the privacy of your phone’s name lookups. This guide explains how to use private DNS on a mobile plan, choose a provider, and check the setting on mobile data as well as Wi-Fi. Start with Android’s built-in controls, or follow the iPhone route below.
Last checked October 28, 2026.
Too long; didn’t read?
- Start with the phone’s built-in encrypted DNS option rather than adding another app.
- Consider Quad9 for a straightforward setup with threat blocking.
- Choose a provider deliberately, and read its privacy policy.
- Test on mobile data and Wi-Fi, then repeat with your usual VPN enabled.
- Treat DNS privacy as one layer; do not rely on it to hide your location or identity.
Why private DNS matters on mobile data
DNS translates a website name into the numbered internet address your phone needs to connect.2 Think of it as looking up a contact before making a call. A resolver is the service that answers that lookup.
The Internet Society explains that traditional, unencrypted DNS exposes queries to observers along the connection.2 Encrypting those lookups protects their contents while they travel to the resolver.2 DNS over TLS and DNS over HTTPS are two ways to provide that encrypted connection.2
The resolver still receives the questions: encryption changes who you trust, rather than removing trust altogether.2 Choose a provider whose handling of that information you are comfortable with. The Academy’s beginner’s guide to encrypted DNS provides more background.
What your mobile carrier can still see
Google describes Private DNS as protecting DNS questions and answers only.1 The Internet Society notes that destination IP addresses and other connection information can still reveal activity even with encrypted DNS.2 A claim that the carrier can no longer tell which services the phone uses goes further than those sources.
Keep the goal modest: protect the lookup, then consider your wider needs separately. Read what the internet provider can still see before treating a DNS change as a complete privacy setup.
Your options for private DNS on a mobile plan
Quad9 through Android’s built-in setting
Quad9 offers a free, threat-blocking service with the encrypted DNS hostname dns.quad9.net.3 Its privacy policy says it does not collect or record user IP addresses.4 Android 9 and later support the built-in Private DNS feature.7
- Pros: A short setup on Android 9 and later, with threat blocking and no extra app.
- Cons: The hostname above is Quad9’s threat-blocking service.
- Best for: Android phones on version 9 or later, when a hostname in the system setting is enough.
Cloudflare through the same Android setting
Cloudflare’s instructions give one.one.one.one as its standard resolver hostname and security.cloudflare-dns.com for malware blocking.5 Decide whether filtering belongs in your setup before choosing between them.
- Pros: The same Android setting, with a separate hostname for the standard resolver and for malware blocking.
- Cons: The malware-blocking hostname is a different name from the standard resolver, so copy the one you chose.
- Best for: Readers who want Cloudflare’s resolver through Android’s Private DNS setting.
Quad9 Connect for extra Android controls
F-Droid lists Quad9 Connect 1.2.4, added July 28, 2026, for Android 6.0 or newer, under the GNU AGPL v3.0-or-later licence.6 Its listed features include a DNS query log and application exclusions.6 The app uses Android’s VPN interface to configure DNS.6 Quad9 says the built-in Private DNS feature does not work while Quad9 Connect is installed and enabled.7
- Pros: A query log and per-app exclusions, which the hostname setting does not offer.
- Cons: Turn the app off before relying on built-in Private DNS. Quad9 says the two do not work at the same time.
- Best for: Readers who need the query log or per-app exclusions.
For broader Android connection controls, see the Academy’s Rethink DNS guide. Choose one approach first, then assess whether you need more.
Step-by-step: set up Private DNS on Android
- Record the starting point. Note the current Private DNS setting so you can restore it. Use your own phone; ask the administrator before changing a managed work device.
- Find the control. Open Settings, then Network & internet and Private DNS, or search Settings for “Private DNS,” as Google’s instructions suggest.1
- Choose a provider. Select Private DNS provider hostname, enter
dns.quad9.net, and save, following Quad9’s Android instructions.7 Copy the name carefully; leave outhttps://and any extra path. - Check mobile data first. Turn Wi-Fi off and try a few familiar sites and apps. Android’s configured Private DNS resolver applies across networks, including cellular, according to Cloudflare’s documentation.5
- Check the provider. Quad9 directs users to on.quad9.net to verify configuration.7 Repeat after reconnecting to Wi-Fi. Treat this as a check of the browser’s lookup, rather than proof about every app.
- Test your everyday setup. Re-enable your usual VPN and repeat the checks. Quad9 says the Private DNS feature is not used while a VPN is on. Set Quad9’s IP addresses in the VPN’s custom DNS settings, and follow the VPN provider’s documentation.7
How to use encrypted DNS on an iPhone
Quad9 provides an encrypted DNS configuration profile for iOS 14 and later.8 A profile is a file that installs settings. Use the official guide linked in Sources, choose its recommended HTTPS profile, download through Safari, then follow Settings > Profile Downloaded to install it.8 Read the installation prompts before accepting.
The current profiles expire on January 19, 2027; Quad9 says they automatically disable at expiry until replaced.8 Add a renewal reminder now. Quad9 also warns that iCloud Private Relay and most VPN clients do not respect this profile.8 If you already use either, follow its DNS guidance rather than installing overlapping settings.
Common mistakes and connection problems
- Changing everything together. Adjust one setting at a time, then test. Keep a note of what worked.
- Leaving a broken setup in place. If sites stop opening, check the hostname and compare mobile data with Wi-Fi. Restore the previous setting if needed, then ask the provider for help.
- Forgetting to restore protection. After temporarily changing DNS to troubleshoot a network, put your chosen configuration back and test again.
- Assuming a successful page load proves privacy. Use the provider’s verification instructions as well as checking that everyday apps work.
Frequently asked questions
Does Private DNS work on mobile data?
Yes: Android’s configured Private DNS resolver covers cellular as well as Wi-Fi.5 Test both connections before relying on your setup away from home.
Should I choose Automatic or a provider hostname?
Choose the hostname option when you want to specify a provider. Google lists Automatic and Private DNS provider hostname as separate choices.1 Record the original choice before changing it.
Does Quad9 block every advert?
Choose Quad9 for its stated threat blocking; its standard service is described as threat-blocking DNS.3 Treat advertising controls as a separate requirement when planning your setup.
Do I need to pay for Quad9?
No: Quad9 describes its DNS services as free.3 Start with the built-in setting if that meets your needs.
