Private DNS Server Cannot Be Reached on Android: What to Do and How to Fix It

The private DNS server cannot be reached Android message appears when your phone cannot connect to the encrypted DNS provider you entered. Android Private DNS is a built-in setting that can encrypt your DNS lookups without installing another app. When it works, it is quiet. When it does not, Android may show “Private DNS server cannot be reached” and block internet access, even though Wi-Fi or mobile data still shows full bars.

This guide explains what that message means, why it usually happens, and what you can safely do to restore internet access. The steps apply to many Android phones running Android 9 or newer, although menu names differ between Samsung, Google Pixel, Xiaomi, Motorola, OnePlus, and other devices.

Disclosure: This is an independent informational guide and is not affiliated with Google, Samsung, Cloudflare, or any DNS provider. We cannot view your phone, your network, or your provider account, and we cannot promise a fix for every case.

Quick answer: the safest way to fix it

If the private DNS server cannot be reached Android error appears, open Settings, search for Private DNS, and change it to Automatic. Test a website and an app. If internet returns, the problem was the Private DNS connection, not your Wi-Fi or mobile data. You can then check the hostname spelling, test again later, or leave the setting on Automatic until you know why the provider could not be reached. Do not copy a hostname from a random comment or video description.

Private DNS server cannot be reached Android: what does it mean?

The private DNS server cannot be reached Android message generally means Android tried to connect to the DNS provider you entered, using an encrypted connection, and the connection failed. Android then stops most internet traffic rather than silently falling back to an unencrypted lookup, when you have entered a specific provider hostname.

That is different from a normal Wi-Fi problem. Your phone may still be connected to the router, and the Wi-Fi icon may look normal, while browsers, messaging apps, and other apps report no internet or a timeout.

Only your phone, your network, and your provider can confirm the exact cause in your case. Do not assume the phone is broken, or that your account has been hacked, from this message alone.

Why does it happen?

Android Private DNS uses DNS over TLS, an encrypted connection to the provider, usually on port 853. The connection can fail for several general reasons. Possible examples include:

• A mistyped hostname: Private DNS needs a hostname, not an IP address. For example, one.one.one.one can work, while 1.1.1.1 in this field usually does not. A single wrong letter can cause the error.
• The provider is temporarily unavailable: A provider can be down, slow, or unreachable from your network at that moment.
• Port 853 is blocked: Some public Wi-Fi, hotel, office, or school networks block the port encrypted DNS needs, often to show a login page first.
• A captive portal is waiting: A hotel, airport, or café Wi-Fi may need you to sign in on a login page before it allows internet access. Encrypted DNS can prevent that page from appearing.
• A VPN or another app is interfering: A VPN, firewall, or filtering app may provide its own DNS and conflict with the Private DNS setting.
• A work or school device policy: A managed device may restrict DNS changes or require a particular resolver.
• An old or custom Android build: The option may behave differently on older Android versions or heavily customised software.

These are general possibilities, not a diagnosis of your phone. Check the exact message and your current setting before changing anything else.

What to do first

1. Note your current setting. Open Settings, search for Private DNS, and write down whether it is Off, Automatic, or a provider hostname, and what hostname is entered, if any.
2. Switch to Automatic. Change Private DNS to Automatic and save. This lets Android try an encrypted connection when the network supports it, and fall back when it does not.
3. Test basic internet. Open a website you have not just loaded, use a search engine, and open one important app. Test both Wi-Fi and mobile data, because a network can treat encrypted DNS differently.
4. Toggle Wi-Fi or mobile data off and on. If internet returns after switching to Automatic, the Private DNS connection was the problem.
5. Restart the phone only if needed. If switching to Automatic does not help, restart Wi-Fi or mobile data, then restart the phone once and test again.

If the private DNS server cannot be reached Android error is gone after switching to Automatic, do not immediately re-enter the same hostname. First check the spelling and the provider status, as described below.

How to check the hostname is correct

A hostname is not a website address. Remove https:// and any trailing path. It should be only the provider hostname.

Examples of hostnames published by well-known providers include one.one.one.one for Cloudflare and dns.google for Google. Other providers publish their own hostnames on their official websites, for example Quad9 and AdGuard. Always check the hostname on the provider’s official website before entering it. Providers can change hostnames, and a hostname copied from a comment may be wrong or untrustworthy.

To test a hostname safely:

1. Open Settings and search for Private DNS.
2. Choose Private DNS provider hostname.
3. Type the hostname exactly as published by the provider.
4. Tap Save and wait a few seconds. Android usually tests the connection and shows a brief confirmation when the server is reachable.
5. Test a website and an app. If the error returns immediately, the hostname may be mistyped, the provider may be unreachable, or your network may block the connection.

If you are unsure which provider to trust, do not choose one at random. A DNS provider can see the DNS requests sent through its service, so this is a privacy decision. Read its privacy policy and check its status page first.

How to fix it on public Wi-Fi, in a hotel, or at work

Public and managed networks are the most common place for the private DNS server cannot be reached Android error. They often need a login page, and encrypted DNS can prevent that page from loading.

1. Switch Private DNS to Off or Automatic before joining the network. Use Settings search for Private DNS.
2. Join the Wi-Fi again. Forget the network and join it again, or toggle Wi-Fi off and on. The login page should appear.
3. Complete the login. Accept the terms or enter the code the network asks for. Get fully online first.
4. Turn Private DNS back on only after you are online. Once you are connected, you can try your preferred setting again. If the error returns, leave it on Automatic for that network.

Do not leave Private DNS off permanently after one hotel stay. Turn your preferred setting back on once you are on a trusted network, if it works there.

If you use a work, school, or hospital network, ask the network administrator before changing DNS. Their security systems may require a particular resolver, and a custom setting can prevent access or break acceptable-use rules.

How to fix the private DNS server cannot be reached Android error on all networks

If the private DNS server cannot be reached Android error appears on Wi-Fi and on mobile data, on more than one network, the problem is more likely to be the hostname, the provider, or another app on the phone.

1. Check the hostname again, letter by letter. A common mistake is entering an IP address, a website address, or a hostname with a typo.
2. Try Automatic for a day. If internet works on Automatic, the provider connection was the problem, not your phone.
3. Try a different trusted provider hostname, one at a time. Change only the hostname, test, and note the result. Do not change the browser, VPN, and DNS settings at the same time, because you will not know which change fixed or caused the problem.
4. Check for a VPN or filtering app. Turn the VPN off temporarily and test. Some VPN apps provide their own DNS inside the tunnel and override Private DNS. That is normal, but it can cause confusion when troubleshooting.
5. Check for a recent change. Did the error start after you changed the hostname, installed a new app, updated Android, or joined a new network? That timing is useful information.
6. Reset network settings only as a last step. This can remove saved Wi-Fi networks and Bluetooth pairings, so record them first if you need them. On most phones this is in Settings, under System, Reset options, or a similar menu. Menu names differ by manufacturer.

If the private DNS server cannot be reached Android error persists on all networks after these steps, contact the provider’s official support or your phone manufacturer’s support, with the exact error message, your Android version, your phone model, and what you have already tested.

How to test whether Private DNS is working after a fix

Once the private DNS server cannot be reached Android error is fixed, seeing the setting saved is still not proof that DNS queries are really encrypted or going to the provider you chose.

1. Open a website you have not just loaded. Close and reopen the browser, or refresh several times, so a cached page is not mistaken for a new DNS lookup.
2. Use a DNS leak test. Open a reputable DNS leak test page in the browser and run its standard test. It should show the provider you chose, not your carrier or internet provider.
3. Use the provider’s own check page, if it has one. For Cloudflare, for example, its help page can show whether DNS over TLS is in use.
4. Test both Wi-Fi and mobile data. Android should carry the configured Private DNS setting across both. Different results can mean a VPN, carrier feature, or network policy is changing the path.
5. Test an app, not only a browser. A browser may reuse a cached lookup, while an app making a fresh lookup can behave differently.

A test result can confirm which resolver answered, but it cannot prove that every tracker is blocked or that the provider keeps no logs.

What not to do

• Do not copy a hostname from a random comment, video description, or social media post.
• Do not pay anyone who promises to fix Private DNS for a fee, or who claims to be a support agent and asks for remote access to your phone.
• Do not share your password, one-time code, or account details with an unsolicited caller.
• Do not install remote-access tools at the request of an unsolicited caller.
• Do not change many settings at once. Change one thing, test, and note the result.
• Do not assume a provider is safe because it is popular. Read its privacy policy first.

If you think someone has accessed your account or phone, follow your phone manufacturer’s and your account provider’s official guidance for a potentially compromised account.

Frequently asked questions

Does “Private DNS server cannot be reached” mean my phone is hacked?

Not necessarily. In most cases it means the encrypted DNS connection failed, often because of a mistyped hostname, a blocked port, or a login page waiting on a public network. Check the setting and test on Automatic before assuming a security problem.

Will switching to Automatic remove my privacy protection?

Automatic is a safer fallback than Off. It tries an encrypted connection when the network supports it, and falls back when it does not. It does not make you anonymous, and it does not hide your IP address, but it is usually better than leaving the setting off permanently after one failure.

Can I use Private DNS on mobile data?

Yes, in most cases. Android should carry the setting across Wi-Fi and mobile data when the provider is reachable. Test each connection separately, especially when travelling, because a carrier can block or handle encrypted DNS differently.

Why does the browser work but apps do not?

A browser may reuse a cached lookup or trigger a network sign-in page, while an app making a fresh lookup needs a new DNS answer right now. In strict Private DNS mode, if that lookup cannot be completed, the app can hang while the browser still loads a cached page.

Should I use a different provider hostname?

Only if you trust and have verified that provider. Compare its published privacy policy, retention statements, filtering behaviour, and status page. A provider that blocks more domains may also cause more false positives. A provider focused on speed may not offer tracker filtering.

Final checklist

• Note the current Private DNS mode and hostname before changing anything.
• Switch to Automatic and test a website and an app, on Wi-Fi and on mobile data.
• Check the hostname spelling on the provider’s official website.
• On public Wi-Fi, switch to Off or Automatic, complete the login page, then try your preferred setting again.
• Test with a DNS leak test or the provider’s own check page.
• Change one setting at a time and note the result.
• Keep Automatic as a safe fallback, and do not copy hostnames from random comments.

Final takeaway

The private DNS server cannot be reached Android message is usually a fixable connection problem, not a broken phone. The safest first step is to switch to Automatic, test, and then check the hostname and the network. Its strongest benefit is simple, encrypted DNS transport without installing another app. Its limits are just as important: it cannot fix a blocked network, make you anonymous, replace a VPN, or protect a vulnerable device by itself. Choose a provider carefully, test the result, and keep Automatic available as a safe fallback.

This article is for general educational purposes and is not technical support for your individual phone or network. Always verify current procedures with your phone manufacturer and your DNS provider.