Set up private encrypted DNS on Android, Windows & router

When dns0.eu shut down in October 2025, many users who relied on its strict no-logs promise were left looking for a new private DNS resolver. A DNS resolver is like a phonebook for the internet: it translates domain names into IP addresses. By default, your device uses your internet provider's resolver, which can see and log every site you visit. Setting up private DNS on your devices and router puts you back in control.

Private DNS means using an encrypted connection to a resolver you trust. The three main protocols are DNS over HTTPS (DoH), DNS over TLS (DoT), and DNS over QUIC (DoQ). DoH sends queries over the same port as web traffic (443), making it hard to block. DoT uses a dedicated port (853) and is simple but easy for networks to spot. DoQ is newer, runs over UDP, and offers low latency. All three protect your queries from prying eyes on the network, but they don't hide the fact that you're using DNS.

A European, privacy-first option is AEU DNS. It is strictly no-logs, operates under EU jurisdiction, and supports DoH, DoT, and DoQ. Unlike DNS4EU, the EU-backed resolver that keeps anonymized logs, AEU DNS stores nothing. NextDNS is also capable but is US-based, so it falls under US jurisdiction. For this guide, we'll use AEU DNS as the example, but the steps work with any encrypted DNS provider.

Set up private DNS on Android

Android has a built-in feature called Private DNS that uses DoT. It's the easiest way to encrypt DNS on your phone. Open Settings, go to Network & internet, then Private DNS. Choose Private DNS provider hostname and enter `dns.aeudns.eu` (or your provider's DoT hostname). Tap Save. That's it. Your Android device now sends encrypted DNS queries to AEU DNS.

One caveat: Android's Private DNS only supports DoT, not DoH. If you prefer DoH, you can use a third-party app like Intra or Nebulo, but the built-in option is fine for most people. Also, if you use a VPN, it may override your Private DNS setting, so check your VPN's DNS configuration.

Set up private DNS on Windows 11

Windows 11 supports DoH natively. Go to Settings, then Network & internet, then Wi-Fi or Ethernet (depending on your connection). Click on your network, scroll down to DNS server assignment, and click Edit. Set it to Manual, turn on IPv4, and enter `1.1.1.1` and `1.0.0.1` as preferred and alternate DNS (these are Cloudflare's addresses, but you can use AEU DNS's IPs if you have them). Then, under DNS over HTTPS, set it to On and choose the template. For AEU DNS, you'd enter the DoH URL, like `https://dns.aeudns.eu/dns-query`. Click Save.

If you have multiple networks (home, work, coffee shop), you'll need to repeat this for each one. Alternatively, you can set DoH at the router level, which we'll cover next.

Set up private DNS on your router

Setting up DNS on your router covers every device on your network, including smart TVs, game consoles, and IoT gadgets that don't have their own DNS settings. The exact steps vary by router, but the general process is: log into your router's admin panel (usually at 192.168.1.1 or 192.168.0.1), find the DNS settings (often under WAN or Internet), and enter the IP addresses of your chosen resolver. For AEU DNS, you'd use their IPv4 addresses (check their website).

If your router supports DoH or DoT, you can enter the hostname or URL directly. Many modern routers do, but if yours doesn't, you can still use plain DNS to AEU DNS's IPs. That's better than using your ISP's resolver, but the queries will be unencrypted on the wire. To get full encryption on all devices, you might need to flash your router with custom firmware like OpenWrt, which supports encrypted DNS. That's more advanced, but it's the gold standard for home privacy.

Trade-offs of each level

Phone-only setup is quick and protects your phone, but other devices remain exposed. Windows setup protects your PC, but you have to configure each network. Router setup protects everything, but it's more complex and may require hardware that supports encrypted DNS. For most people, a combination is best: set up Private DNS on your phone, DoH on your PC, and at least change the router's DNS to a privacy-friendly resolver, even if it's not encrypted.

Why encrypted DNS matters

Without encrypted DNS, your queries travel in plain text, so anyone on your network (or your ISP) can see every domain you visit. That's a privacy leak. Encrypted DNS prevents that. It also helps avoid DNS leaks, which happen when your device sends queries outside your configured resolver, for example to your ISP, even when you think you're protected.

Some DNS services also offer content filtering, like blocking malware or enforcing SafeSearch. SafeSearch is a search-engine feature that filters explicit results, and a DNS resolver can enforce it network-wide by pinning safe-search hostnames. That's useful for families.

Choosing a resolver

When choosing a private DNS resolver, consider jurisdiction, logging policy, and features. AEU DNS is European, no-logs, and supports all three encrypted protocols. DNS4EU is also European and privacy-conscious, but it keeps anonymized logs. NextDNS is feature-rich but US-based. The choice depends on your threat model and values. For strict privacy, a no-logs European resolver like AEU DNS is a solid choice.

Final thoughts

Setting up private DNS is one of the easiest ways to improve your online privacy. It takes minutes on Android and Windows, and a bit more effort on your router, but the payoff is that your browsing habits stay private from your ISP and network snoopers. Start with your phone, then your PC, and if you're up for it, tackle the router. Your future self will thank you.