Private DNS encrypts only your name lookups; a VPN encrypts all your traffic and hides your IP address from the sites you visit. With a VPN on, the usual choice is to leave Private DNS on Automatic so lookups use the VPN's own resolver inside the tunnel. If you set a provider's hostname instead, your lookups still travel encrypted through the tunnel, but the VPN's DNS filters stop applying.
Android has a setting called Private DNS, and a lot of people turn it on thinking it's a lighter kind of VPN. It isn't, but it isn't useless either. The two protect different things, and they interact in ways worth knowing before you combine them.
What each one does
Every time an app opens a site, your phone first asks a DNS resolver for the site's address. Private DNS protects that question. A VPN protects everything that follows.
| Private DNS | VPN | |
|---|---|---|
| What it encrypts | Only DNS lookups (the names of the sites and services you reach) | All traffic from your apps, lookups included |
| Who can still see the names | The DNS provider you chose | The VPN provider's resolver, if you use it |
| Hides your IP address from websites | No | Yes, sites see the VPN server's address |
| Hides the sites you visit from the network | Partly: lookups are hidden, but addresses and the site name at the start of an HTTPS connection often aren't | Yes, the network sees one encrypted connection |
| Blocking of trackers or malware | Only if the DNS provider offers it | Only if the VPN offers it |
| Built into Android | Yes, since Android 9 (DNS over TLS) | Needs a VPN app |
So Private DNS is a good upgrade on its own: it stops the Wi-Fi or your internet provider from reading or tampering with your lookups. It just leaves the rest of your traffic as visible as before. Our guide on what your internet provider can see explains what that rest is.
The three Private DNS options
Open Settings › Network & internet › Private DNS (on Samsung: Settings › Connections › More connection settings › Private DNS). You'll see three choices:
- Off: lookups go unencrypted to whatever resolver the network hands out.
- Automatic: Android tries DNS over TLS with the network's resolver and falls back to unencrypted lookups if that resolver doesn't support it. This is the default.
- Private DNS provider hostname: Android sends every lookup, encrypted, to the provider you name, and only there. If it can't reach that provider, lookups fail rather than falling back.
That last behavior explains the common error "Private DNS server cannot be accessed": the hostname is mistyped, the provider is down, or the network blocks DNS over TLS (port 853). Switching back to Automatic fixes it straight away.
People often ask what the downside of Automatic is. On its own, it may use unencrypted lookups on networks that don't support DNS over TLS, and you won't be told. With a VPN on, that doesn't matter, because the lookups travel inside the encrypted tunnel anyway.
What happens when you use both
This is where the combination gets interesting.
- VPN on, Private DNS on Automatic or Off. Android uses the DNS server the VPN sets up, inside the tunnel. Everything is encrypted, and any DNS filters the VPN offers work.
- VPN on, Private DNS set to a hostname. Android keeps sending lookups to that provider. They still travel encrypted, through the tunnel, so the network can't see them. But they skip the VPN's resolver, so its filters don't apply, and two companies now see parts of your activity instead of one.
Neither setup leaks your lookups to the network. The choice is about who resolves your names, and whose filters you want.
Which one should you use?
- You want your whole connection protected on public Wi-Fi: use a VPN, and leave Private DNS on Automatic.
- You only want encrypted lookups and trust a particular DNS provider: Private DNS on its own is fine. Remember that the network still sees which servers you connect to.
- You want a specific DNS provider and a VPN: set the hostname and accept that the VPN's DNS filters won't apply. Or use the VPN's own custom DNS option, if it has one.
Filters: what a DNS filter can and can't do
A DNS filter answers "no such site" for names on a list: known trackers, malware and phishing domains, sometimes ads. It's light and it works in every app. But it only sees names. It can't scan files, stop malware that's already on your phone, or catch a phishing site that isn't on a list yet. It isn't an antivirus.
How PryVPN handles DNS
- While you're connected, your phone looks up names on the resolver of your PryVPN server, inside the tunnel. The resolver checks DNSSEC and keeps no query logs.
- In the Protection tab you choose what it filters: Trackers and Malware are on by default; ad domains are off unless you turn them on. Some known malware and phishing domains are always blocked on our servers to stop abuse.
- Settings › Custom DNS lets you use another resolver, still reached through the tunnel; the filters then stop working.
- If Android's Private DNS is set to a hostname, the filters don't apply. The in-app leak test warns you when it's on. Our help article on DNS filters and Private DNS has the details.
To check which resolver you're really using, run the in-app leak test; our leak test help article explains the results. For the protocol behind the tunnel, see our page on WireGuard.
Frequently asked questions
Should Private DNS be on or off with a VPN?
Automatic is the usual choice. Off works the same way while the VPN is connected. Set a hostname only if you specifically want that provider to resolve your names.
Is Private DNS enough on public Wi-Fi?
It hides your lookups, which is an improvement. The network can still see the addresses you connect to, often the site names, and any unencrypted traffic. A VPN covers all of it.
Does Private DNS slow down browsing?
Encrypted lookups add a little work to each new connection to the resolver. Phones and resolvers cache answers, which keeps that cost small.
If you'd like DNS filtering and a VPN in one free app, join the PryVPN beta.
Sources
Spotted a mistake? Write to support@pryvpn.com and we'll fix it and update the date.
