Configure Android for Secure DNSaaS

📋 Overview

Android includes built-in support for DNS-over-TLS (DoT) via the Private DNS feature. This guide will help you configure Android to use our secure DNSaaS service with token-based authentication.

Service	Endpoint	Authentication
Primary DNS	`dns1.oss.co.za` (DoT hostname)	Token in URL path
Protocol	DNS-over-TLS (DoT) • Port 853 • TLS 1.3
Android Version	Android 9+ (Pie) with Private DNS support

💡 Android vs Other Platforms Android uses DNS-over-TLS (DoT) natively, not DoH. This is a different protocol that uses port 853 instead of 443.

⚠️ Important Android's Private DNS feature requires a DoT hostname (not a URL). Your token must be included in the hostname path. For example: dns1.oss.co.za with the token in the SNI or path.

✅ Prerequisites

Android 9 (Pie) or newer
Your token: token_testclient123 (replace with your actual token)
Internet connectivity (Wi-Fi or mobile data)
Access to Settings app

💡 Token Format Your token is provided by the DNSaaS administrator. It looks like: token_xxxxxxxxxx

🤖 Configure Android Step-by-Step

1 Open Settings

Open the Settings app on your Android device.

This is usually a gear icon on your home screen or in the app drawer.

2 Navigate to Network & Internet

Tap Network & internet (may be named differently on some devices).

Look for Connections, Wi-Fi & Network, or similar.

3 Find Private DNS

Tap Private DNS (or Advanced → Private DNS).

On some devices: More connection settings → Private DNS.

💡 Search Tip You can also search for "Private DNS" in the Settings search bar.

4 Enter the DoT Hostname

Select Private DNS provider hostname.

Enter the following hostname (replace token_testclient123 with your token):

dns1.oss.co.za

⚠️ Important

Do NOT include https:// or /dns-query in the hostname.

Correct: dns1.oss.co.za

Wrong: https://dns1.oss.co.za/dns-query

Android Private DNS uses DoT (DNS-over-TLS), not DoH.

⚠️ Token Support

Currently, Android's Private DNS feature does not support tokens in the hostname path. You must use a DoT endpoint that includes the token in the SNI or configure a custom DoT server with token support.

If your DoT server does not support token authentication, you may need to use a third-party DoH app (see Method 2).

5 Save and Verify

Tap Save or OK to apply the settings.

Android will validate the DoT server. If successful, it will show "Connected" or "Secure" status.

✅ Success Indicator The Private DNS status should show "Connected" or "Secure".

📱 Method 2: Third-Party DoH App Alternative

If your DoT server doesn't support token authentication, you can use a third-party app that supports DoH with custom headers.

Option A: Intra (by Google)

Installation

Download Intra from the Google Play Store.

Configure with your DoH endpoint:

https://dns1.oss.co.za/testclient123/dns-query

Option B: DNS66 (F-Droid)

Installation

Download DNS66 from F-Droid.

Add a custom DNS server with your DoH endpoint.

Option C: AdGuard DNS (App Store)

Installation

Download AdGuard DNS from the Google Play Store.

Configure with your DoH endpoint and token.

💡 Why Use a Third-Party App?

Supports DoH (port 443) instead of DoT (port 853)
Allows custom headers and token authentication
Works on older Android versions
Provides additional filtering and logging features

🧪 Test Your Configuration

Use these test sites to verify your Android configuration is working correctly.

Browser Tests

Test Domain	Expected Result
`https://example.com`	✅ Should load normally
`http://zycdjz.com`	❌ Should show "This site can't be reached"
`http://adult.filterdns.net`	❌ Should show "This site can't be reached"

DNS Leak Test

Test Domain	Expected Result
`https://dnsleaktest.com`	Should show `dns1.oss.co.za` or `102.220.218.218`

Private DNS Status Check

Test	Expected Result
Settings → Private DNS	Should show "Connected" or "Secure"

🔧 Troubleshooting

❌ "Can't connect" or "Failed to connect"

Check that your device has an active internet connection
Verify the hostname is correct: dns1.oss.co.za
Ensure your DoT server is running and accessible
Check if your network blocks port 853 (DoT)
Try using a third-party DoH app instead

❌ Private DNS setting not available

Your device may be running Android 8 or older
Some manufacturers hide the Private DNS option
Use a third-party app as an alternative

❌ Token not working with Private DNS

Android Private DNS does not support tokens in the hostname
Use a third-party DoH app that supports custom headers
Configure your DoT server to accept tokens via SNI

✅ Verify It's Working

Check Private DNS status in Settings → should show "Connected"
Visit http://adult.filterdns.net - should show "This site can't be reached"
Visit https://dnsleaktest.com - should show your DNS server
Use a network monitoring app to confirm DoT traffic on port 853

↩️ How to Roll Back

To revert to your previous DNS settings:

Step 1: Open Private DNS Settings

Go to Settings → Network & internet → Private DNS.

Step 2: Revert to Automatic

Select Automatic (or Off depending on your device).

This will restore your ISP's default DNS settings.

Step 3: Clear DNS Cache

Restart your device to clear the DNS cache.

Or use a network reset: Settings → System → Reset → Reset network settings.

🎯 Summary

🤖 Android supports DoT natively via Private DNS
✅ Working hostname: dns1.oss.co.za
🔒 All DNS queries are encrypted via DoT (port 853) with TLS 1.3
⚠️ Android Private DNS does not support token authentication directly
📱 Use a third-party DoH app for token-based DoH authentication

🚀 Quick Reference:

Private DNS: dns1.oss.co.za
DoH (3rd-party): https://dns1.oss.co.za/testclient123/dns-query

🤖 Android Navigation Path:

                Settings → Network & internet → Private DNS → Private DNS provider hostname
            