encrypt your phone's dns in two settings

the coffee shop wifi is reading your mail, sort of

every time your phone needs to turn "google.com" into an actual ip address, it asks a dns server "hey where does this live." by default that question and answer travel in plaintext. anyone on the same wifi, the router owner, the isp, a guy with a laptop at the next table running a packet sniffer, can see exactly which domains you're looking up. not the content of the page, but the list of every site you visited. that's still a lot. medical sites, dating apps, your bank, that weird forum. two settings fix this. let's go through it.

what private dns actually does

private dns over tls wraps your dns queries in encryption before they leave your phone. instead of shouting "where's reddit.com" across an open room, your phone whispers it through an encrypted tunnel straight to a trusted resolver like quad9. the person on the same wifi still sees that your phone is talking to something, but not what you're asking. it's the difference between someone reading your postcards versus seeing a sealed envelope.

quad9 specifically also checks domains against threat intelligence feeds and refuses to resolve known malicious or phishing domains. so it's encryption plus a basic malware filter, for free, built into your phone.

android: the settings menu way

this is the easiest path and works on basically any modern android phone.

go to settings > network & internet > private dns (sometimes buried under "advanced" or "connections > more connection settings" depending on your manufacturer's skin). select "private dns provider hostname" and type in:

dns.quad9.net

save it. that's it. your phone now encrypts dns lookups over any network it connects to, wifi or cellular.

android: the adb way, for setting it up from a laptop

if you're setting up a device you don't have physical access to constantly, or you just like doing things from a terminal, you can push this setting with adb (android debug bridge). plug the phone in, enable usb debugging in developer options, then run:

adb shell settings put global private_dns_mode hostname

let's break that down piece by piece:

adb shell opens a command shell on the connected android device so you can run commands directly on it.

settings put global tells android you're writing a system-wide setting, not just something scoped to one app.

private_dns_mode is the specific setting key that controls whether dns is off, opportunistic, or set to a specific hostname.

hostname is the value, meaning "use the hostname mode," which then requires you to also set which hostname to use:

adb shell settings put global private_dns_specifier dns.quad9.net

run both commands and your phone is locked to quad9's encrypted resolver regardless of what wifi it joins later. useful if you're provisioning a bunch of devices and don't want to tap through the ui on each one.

iphone: the profile method

apple doesn't have a native "type in a hostname" toggle like android. instead you install a configuration profile from your dns provider. quad9, cloudflare, and nextdns all publish these. you go to their site, download the ios profile for encrypted dns, then go to settings > general > vpn & device management and install it. after that your dns queries are encrypted the same way, system wide, no third party app needed. just make sure you're downloading the profile straight from the provider's official site and not some random mirror.

what this does not protect you from

be honest with yourself about scope here. encrypted dns hides which domains you're resolving, not the actual traffic to those sites, and not your ip address, and not the fact that you're on a given network. it's not a vpn. it won't stop a malicious wifi network from doing other kinds of snooping or a captive portal from intercepting your initial connection. think of it as one solid layer, not a force field. pair it with https everywhere (which is already the default on most sites) and a vpn if you're on genuinely untrusted networks like airport or hotel wifi.

the takeaway

this is a two minute setting change that closes a leak most people don't know exists. your phone has been broadcasting your browsing history in plaintext to every network you've ever joined, and now it doesn't have to. do it on your own phone, do it on your kid's phone, do it on your parents' phones next time you're home for dinner. it costs nothing, breaks nothing, and quietly removes one more thing strangers on public wifi get to know about you.