Why does Private DNS fail? The Android setting, diagnosed

The symptom: you set Android's Private DNS (Settings → Network → Private DNS), and either it silently reverts to "off", or the internet appears to die — apps spin, pages time out — until you switch it back. Private DNS encrypts your phone's name lookups over DNS-over-TLS; it is one of the best one-line privacy upgrades on Android, and its failures are specific and fixable. (What it is and why it matters: the Android privacy checklist.)

Likely causes, most common first

1. The hostname is written wrong (the classic): the Private DNS field wants a provider hostname only — something like one.one.one.one or dns.google — with no https:// prefix, no slashes, and no IP address. Pasting a URL or an IP makes Android reject it or quietly fail to use it. Every provider publishes its exact hostname; copy that, the whole string, nothing else.

2. The network blocks the port (very common on public and workplace Wi-Fi): DNS-over-TLS speaks on TCP port 853. Plenty of corporate, school, hotel and airport networks block it deliberately, because encrypted DNS defeats their filtering and their captive-portal redirects. Symptom pattern: Private DNS works on mobile data and home Wi-Fi, fails on one specific network.

3. The captive portal has not been passed (related, and temporary): before you accept a hotel/airport login page, the network must answer plain DNS for the portal itself. With Private DNS in "strict" mode, that handshake can stall. Android usually falls back gracefully; when it does not, the fix is sequential — connect, pass the portal, then enable Private DNS.

4. The provider itself is down or rate-limiting (occasional): free resolvers are reliable but not immortal; a provider outage looks like "the internet is broken" on every network at once. Test by switching to a second provider's hostname.

5. An always-on VPN is fighting it (occasional): some VPN apps route or block DNS themselves; their DNS handling and Android's Private DNS can conflict, producing intermittent resolution failures. One DNS authority per device is the stable configuration — the VPN's or Android's.

Diagnosis, in the right order

Set the mode to the provider hostname exactly as published → test on mobile data first (no network blocking in the way) → then the problem network. If data works and Wi-Fi fails, it is the network's port 853 (cause 2), and no phone-side fiddling changes that. If it fails everywhere, check cause 1's formatting, then swap providers (cause 4). Android's private-DNS status also shows on the notification shade while it probes — "failed" versus "off" tells you whether it is trying and being blocked, or not configured.

The honest trade-offs

Two modes exist: automatic (use Private DNS when possible, fall back to plain DNS — never breaks, sometimes unencrypted) and the strict manual hostname (always encrypted, breaks on hostile networks). The desk's honest recommendation: automatic mode everywhere, strict mode on networks you trust, and the knowledge that blocking port 853 is a network-owner's policy choice — not your phone's malfunction.

When this fix will not work

Networks that force their own DNS through a login gateway you cannot bypass (some ISPs' hardware, some enterprises); older Android versions whose Private DNS implementation predates certain resolvers' TLS requirements; and managed/work-profile devices where policy overrides user settings entirely. On those, the honest answer is a VPN with encrypted DNS — a different tool, honestly labelled as one.

Official documentation (checked 11 September 2026): Google's Android Private DNS support notes (support.google.com), Cloudflare and Google Public DNS resolver documentation (one.one.one.one/docs, developers.google.com/speed/public-dns), and your provider's own hostname reference.