WhoSeesWhat DNS is
Before an app can connect to a website, your phone has to look up its address, a bit like checking a phone book. That lookup is called DNS. Normally it isn't encrypted, so your Wi-Fi or mobile network can see every website name your phone looks up.
What Private DNS does
Private DNS (available since Android 9) encrypts those lookups and sends them to a DNS provider you trust. Some providers, like AdGuard DNS, can also block known ad and tracking websites for every app on your phone.
The three settings
| SETTING | WHAT IT MEANS |
|---|---|
| Off | Lookups aren't encrypted and go to your network's DNS. |
| Automatic | The default on most phones. Encrypts lookups when your network's DNS supports it; otherwise works as normal. |
| Private DNS provider hostname | Always uses the provider you name, for example dns.google, one.one.one.one or dns.adguard-dns.com. |
How to change it
- Samsung: Settings → Connections → More connection settings → Private DNS.
- Google Pixel and most other phones: Settings → Network & internet → Private DNS.
- Any phone: open Settings and search for Private DNS.
Private DNS and WhoSees
When Private DNS is set to a named provider, website lookups are encrypted all the way to that provider, so WhoSees can't read the website names. It still shows which app sent data, which company received it and where, because those come from the address each app connects to.
Switch Private DNS to Off while you look, then switch it back on afterwards. WhoSees tells you when Private DNS is on, and reminds you to turn it back on when you press Stop.
Should you keep it on?
For everyday privacy, yes: encrypted lookups are better, and a blocking provider cuts down on trackers. Turning it off is only useful for the few minutes you want to see exactly which websites your apps visit.