Set up dnsdome on Android (Private DNS or the app)

Two ways, both without root

Android has shipped a system-wide DNS-over-TLS setting called Private DNS since Android 9. It takes a hostname, and dnsdome gives each profile its own. That is the setup most people should use: nothing to install, works on mobile data, survives reboots. The dnsdome app is for phones where Private DNS is greyed out by a work policy or an OEM build, and for anyone who wants an on/off switch and settings on the phone.

Option 1: Private DNS (Android 9 and newer)

Sign in to the dnsdome panel and open the profile you want this phone to use. In the Encrypted DNS card, copy the DNS-over-TLS hostname. It looks like <token>.dns.dnsdome.com.
On the phone open Settings → Network & internet → Private DNS. On Samsung it is under Connections → More connection settings; on some phones search Settings for "Private DNS".
Choose Private DNS provider hostname, paste the hostname and tap Save.
Open a browser and load a site. Then check the query log in the panel: entries from this phone appear within a minute.

On the profile page the panel shows a QR code and, when you open it on Android, a button that jumps straight to the Private DNS screen, so you can do this without typing the token.

What Private DNS does and does not cover

Covers every app on the phone, on Wi-Fi and mobile data, because the system resolver is what is redirected.
Apps that use their own DNS-over-HTTPS bypass it. Chrome respects the system Private DNS setting; Firefox has its own setting you can point at the same profile, see browsers.
If a Wi-Fi network blocks port 853, Android falls back to the network's own DNS unless Private DNS is set to a hostname, in which case it fails closed and you see "no internet". That is expected and is the safe behaviour.

Option 2: the dnsdome app

On the phone download dnsdome-android.apk. It is distributed outside Google Play, so Android asks you to allow installs from the browser once.
Open the app and sign in with your dnsdome account.
Pick the profile that should filter this phone and turn the switch on. Android asks for VPN permission because the app uses a local DNS-only tunnel; no traffic other than DNS goes through it.
Leave it on. The app checks for a new version once a day and shows a banner on its home screen when one is available.

The app carries your profile identity with it, so the phone stays filtered on mobile data and foreign Wi-Fi without touching the IP allowlist. From version 0.6.0 it also exposes the profile settings: categories, blocked services, your own filter lists, schedules, pause, safe search, and the hosted block page.

Installed a version older than 0.3.0? Uninstall it first. 0.3.0 switched to the production signing key, and Android refuses to update across a key change.

Can I use both?

No. Private DNS and the app both take over the system resolver, and Android gives the VPN-style tunnel priority. Pick one per phone. Private DNS is lighter; the app is what you want when you need to pause protection or switch profiles from the phone.

Does this work on mobile data?

Yes for both options. Encrypted DNS identifies your profile by the token in the hostname, so the phone's changing IP address does not matter.

Does dnsdome see my browsing?

It sees the domain names the phone resolves, which is what makes filtering possible, and keeps them in your query log for the retention period of your plan, from 1 day on Free. dnsdome is operated in the EU under GDPR; see the privacy policy.

Can I give the kids' phones stricter rules than mine?

Yes. Add each phone as a device on the profile. Each device gets its own hostname and can override categories and blocked services, and its queries show under its own name in the log.

Is the app on Google Play?

Not yet. The sideload APK is release-signed and updates itself through the in-app banner. A Play listing is planned.