How to Fix Private DNS Server Cannot Be Reached on Android

Have you ever unlocked your Android phone only to find a persistent notification stating "Private DNS server cannot be reached" or "No internet connection", even though your Wi-Fi or mobile data indicator shows full bars?

When this error occurs, your phone completely blocks internet traffic—browsers won't load pages, messaging apps stop syncing, and apps report connection timeouts.

The good news is that this issue is rarely a hardware fault. It usually stems from a breakdown in the DNS-over-TLS (DoT) handshake between your Android system and your configured custom DNS provider (such as AdGuard, Cloudflare, NextDNS, or Quad9).

This guide provides a step-by-step walkthrough to resolve the Private DNS server error and restore your internet access immediately.

Quick Fix Checklist (Try This First)

If you need internet access immediately, use this 10-second workaround:

1. Open Settings on your Android device.
2. Go to Network & Internet (or Connections).
3. Tap Private DNS.
4. Select Automatic or Off, then tap Save.

Toggle your Airplane mode on and off. Your internet connection should return instantly. Once you are back online, follow the steps below to properly fix or switch your Private DNS server.

Why Does the "Private DNS Server Cannot Be Reached" Error Happen?

Android introduced native support for Private DNS in Android 9 (Pie). Unlike standard DNS requests that travel in plain text, Private DNS encrypts your requests using DNS-over-TLS (DoT) on port 853.

The error appears when your phone fails to establish an encrypted TLS tunnel with the DNS server. Common causes include:

• Public Wi-Fi Gateway Blocks: Hotels, cafes, and airports often block outbound traffic on port 853 to force users onto their captive portal login screens.
• DNS Provider Outages: The hostname server you configured (e.g., AdGuard or NextDNS) may be experiencing temporary server downtime.
• Network Handshake Glitches: Toggling between Wi-Fi and mobile data can cause Android's network manager to lock onto an expired DNS socket.
• Typo in Hostname: A misspelled hostname in settings prevents your phone from resolving IP addresses.

Step-by-Step Solutions to Resolve the Error

Step 1: Verify and Correct Your Private DNS Hostname

A single typo in the hostname will prevent Android from connecting. Ensure you are using a valid, active Private DNS provider string:

• Cloudflare (Fast & Secure): one.one.one.one
• Google Public DNS: dns.google
• AdGuard (Ad Blocking): dns.adguard-dns.com
• Quad9 (Malware Protection): dns.quad9.net

How to update: Depending on your device, the setting usually located on Settings → Network & Internet → Private DNS → Private DNS provider hostname. Paste the correct address, and tap Save.

Step 2: Temporarily Disable Private DNS on Public Wi-Fi

Most public Wi-Fi networks require you to sign in via a captive portal page before granting internet access. Because these networks intercept DNS requests to redirect you to their login page, encrypted Private DNS connections fail automatically.

1. Set Private DNS to Off before connecting to a public Wi-Fi network.
2. Complete the web portal login screen.
3. Once connected to the internet, turn Private DNS back on.

Tip: If the captive portal page still won't load, type http://neverssl.com in your browser address bar to force the login page to appear.

Step 3: Flush the Chrome and Android DNS Cache

Sometimes your device caches stale DNS records after switching networks. Clearing the browser DNS cache forces Android to request fresh IP routes:

1. Open Google Chrome on your Android device.
2. Type chrome://net-internals/#dns in the address bar and press Enter.
3. Tap the Clear host cache button.
4. Restart Chrome and attempt to load your web page again.

Step 4: Reset Android Network Settings

If the error persists across all Wi-Fi networks and mobile data, reset your device's network sockets:

1. Go to Settings → System → Reset Options.
2. Select Reset Wi-Fi, mobile & Bluetooth (or Reset Network Settings).
3. Confirm with your PIN or pattern lock.
4. Reconnect to your Wi-Fi network and test your Private DNS settings again.

Top Free Private DNS Hostnames Compared

If your current Private DNS provider suffers frequent downtime, switch to one of these reliable public providers:

Provider	Private DNS Hostname	Primary Benefit
Cloudflare	one.one.one.one	Ultra-fast response times & privacy.
Google	dns.google	Extremely stable with near-zero downtime.
AdGuard	dns.adguard-dns.com	Blocks pop-up ads and tracking scripts system-wide.
Quad9	dns.quad9.net	Automatically blocks malicious domains and phishing attempts.

Summary

The "Private DNS server cannot be reached" error is an Android security feature protecting you from unencrypted or failed connection routes. Switching your Private DNS setting to Automatic or changing the provider hostname to a stable server like one.one.one.one or dns.google resolves the issue in most cases.

Are you experiencing DNS connection errors with a specific network provider or custom hostname? Drop your device model and DNS provider in the comments below!