Chapter 8 of The Privacy Diet explains why DNS gives away every site you visit, and why the router is the best place to encrypt it — every device at home is covered at once. Your phone leaves home, though. On mobile data, or a café’s Wi-Fi, it uses whatever DNS that network hands it. This page puts encrypted DNS on the phone itself, so it goes with you, and shows how that fits with a Pi-hole at home.
Pick a resolver
The DNS resolver comparison is Chapter 8’s table. This page uses Quad9 — a Swiss nonprofit that doesn’t log your IP address, and blocks known malware domains. Its hostname is dns.quad9.net.
Quad9 doesn’t block ads. For that, your browser’s blocker from Quick Win 1 still does the work away from home, and Pi-hole at home.
Android
Android 9 and later has Private DNS built in. It encrypts every DNS lookup the phone makes, on any network.
- Open Settings → Network & internet → Private DNS. On a Samsung it’s Settings → Connections → More connection settings → Private DNS. On any phone, typing Private DNS into the search bar at the top of Settings finds it.
- Choose Private DNS provider hostname.
- Enter
dns.quad9.netand tap Save.
If Android can’t reach the hostname — a typo, or a network that blocks it — it says so under the setting, and the phone can’t look anything up until you fix it or switch back.
iPhone
iOS has no switch for this. Encrypted DNS comes from a configuration profile — a small settings file you install once.
- In Safari on the iPhone, open Quad9’s iOS guide. The download only works in Safari.
- Download the recommended profile, 9.9.9.9 HTTPS.
- Open Settings. Near the top there’s Profile Downloaded — tap it, then Install, enter your passcode, and Install again past the warning.
- To see it, or remove it later: Settings → General → VPN & Device Management.
Quad9’s current profiles expire on 19 January 2027, and quietly switch off when they do. Put a reminder in your calendar a few days before, to download the new one.
The book’s other iPhone route, Settings → Wi-Fi → (i) → Configure DNS → Manual, changes which resolver one Wi-Fi network uses, but doesn’t encrypt anything. The profile does both, everywhere.
Check it works
On the phone, with Wi-Fi off so you’re on mobile data:
- Open on.quad9.net. It should answer YES.
- Run the extended test at dnsleaktest.com, which Chapter 8 also suggests. Every server listed should belong to Quad9, not your mobile network.
If you use a VPN
A VPN (Chapter 6) carries your DNS inside its tunnel, to its own resolver, and on both systems that takes over from Private DNS and profiles. Quad9 recommends using the VPN’s own DNS setting instead. If your VPN app asks you to turn Private DNS off, do what it says.
If you run Pi-hole at home
Here’s the catch nobody mentions. With a hostname set, the phone sends DNS to Quad9 on every network — home included. At home, that means it skips your Pi-hole. You lose Pi-hole’s blocking on the phone, and the names from Be Your Own Cloud’s Chapter 8, like vault.home.yourdomain.com, stop working, because only Pi-hole knows them. The Bitwarden and Immich apps can’t find your server.
| Phone setting | At home | Away from home |
|---|---|---|
| Quad9 hostname or profile | Skips Pi-hole: no blocking, no home.yourdomain.com names | Encrypted, to Quad9 |
| Android Automatic, or iPhone without the profile | Uses Pi-hole | Uses the network’s DNS, often unencrypted |
Pick the one that suits you:
- Switch by hand. On Android, set Private DNS to Automatic at home and back to the hostname when you go out. On an iPhone, the dependable way is to remove the profile under VPN & Device Management and install it again when you need it.
- Fix the names with Tailscale. Be Your Own Cloud’s Chapter 20 puts your phone on your home network with Tailscale, and its split DNS sends just your
home.yourdomain.comnames to Pi-hole, from anywhere. Everything else still goes to your resolver. Your server’s apps keep working; Pi-hole’s blocking still only applies at home.
Troubleshooting
- A hotel or café Wi-Fi login page won’t appear. Switch Private DNS to Automatic (or turn the profile off), log in, then switch back.
- No internet on one Wi-Fi network only. Some networks block encrypted DNS. Android’s Private DNS uses DNS-over-TLS, on port 853, which is the easier one to block — the protocol comparison from Chapter 8 explains the difference. Switch to Automatic on that network. The iPhone’s HTTPS profile is harder to block.
- No internet anywhere, all of a sudden. Check whether the phone is still set to
dns.mullvad.net— see the warning at the top.
Official documentation
- Quad9: setup guides — including Android and iOS
- Mullvad: DNS over HTTPS and DNS over TLS, with the closure notice
Stuck on a step? Get in touch.