DNS setup generator

Last reviewed October 2026

Which devices and protocols does this cover?

Every mainstream platform that supports encrypted DNS: phones and computers through system settings, and browsers on their own. Pick the row for your device.

DoT or DoH: which should you use?

Use the one your device supports natively. The privacy is the same, and the difference is how networks treat them.

DoT runs on its own port, 853, so it is easy for a network to spot and block. DoH runs on port 443 inside HTTPS and passes almost everywhere. If your server offers both, use DoT on Android and DoH in browsers and on Windows.

If it does not work

Android says it cannot connect

The hostname must be the TLS name, not a URL, and port 853 must be reachable. Some networks block 853, so try mobile data to rule out the Wi-Fi.

Windows ignores the DoH server

The IP must be registered with Add-DnsClientDohServerAddress before the template is accepted, and the adapter must use that same IP as its DNS server.

Linux still shows plain DNS

Check resolvectl status. If another tool such as NetworkManager sets its own DNS, the Domains=~. line in the drop-in makes this server the one used for all names.

Everything resolves, but ads are not blocked

The server you entered may not filter. Filtering is set up on the server side, so your device settings are not the cause.

Frequently asked questions

Do I need the server's IP address?

Only for Windows, Linux (systemd-resolved), Unbound and Stubby, which cannot look up the hostname before DNS is working. Android, iPhone, Mac and browsers only need the hostname or URL. To find the IP, run nslookup your.dns.host and paste the address in the optional field.

Should I use DoT or DoH?

Use whichever your device supports natively. Android Private DNS is DoT only. Browsers and Windows use DoH. Apple supports both. DoT uses port 853 and is easy for a network to block, DoH uses port 443 and passes more networks.

Is anything I type sent to a server?

No. This page works entirely in your browser and makes no network requests, so the hostname and IP stay on your device. Profiles are generated locally and downloaded.

How do I check that it works?

Use the Test this server link under the generator. It checks the certificate, TLS versions, DNSSEC and response time of the server you entered. On Android, the setting shows a connection error if the hostname cannot be reached.