Android DNS guide · sources checked 2026-11-03
Android Private DNS and VPN DNS: how they interact
Understand Android Private DNS (DNS-over-TLS), how VPN apps may handle DNS, and safe steps to investigate an unexpected resolver result.
Short answer: is Android Private DNS the same as VPN DNS?
No. Android Private DNS is the operating system's DNS-over-TLS setting. A VPN app may route DNS through the VPN tunnel to a resolver it chooses or configures. These are different controls. What resolver actually handles a particular lookup depends on the Android version, VPN app and configuration, browser settings, and whether that traffic is routed through the VPN; do not assume both settings create two layers or that one always overrides the other.
What do Android's Private DNS choices mean?
On supported Android devices, Settings > Network & internet > Private DNS offers Off, Automatic, or a Private DNS provider hostname; labels and menu locations vary. Google says the device uses Private DNS with networks that support it by default and recommends keeping it on. The hostname option specifies a DNS-over-TLS server by name. Private DNS protects DNS questions and answers on that connection; it does not encrypt other app traffic or hide queries from the selected resolver.
What is VPN DNS?
VPN DNS is a general term for DNS requests handled by or routed through a VPN connection. It is not one Android-wide setting or a guarantee that every VPN app uses the same resolver. Check your VPN provider's current documentation for its expected DNS behavior, supported split-tunnel settings, and any app-specific controls. The VPN changes the network path and which intermediary may see traffic; it does not establish the provider's logging practices.
Can Private DNS and a VPN be used together?
They can interact, but the outcome is implementation and configuration dependent. Android's device-management API documentation warns that with a VPN and a specified Private DNS resolver, that resolver must be reachable from within and outside the VPN or the device may fail to resolve names. That is an administrative configuration note, not a universal consumer setup recipe. If DNS stops working, consult both device-management and VPN documentation before changing either setting.
How do I check an unexpected DNS resolver result?
First record the device model and Android version, whether the VPN is connected, the browser's secure-DNS setting, and any split-tunnel exceptions. Use the same reputable browser-based DNS test once with the VPN disconnected and once connected on the same network, without signing in or entering sensitive information. Compare the observed resolver with what the VPN and DNS provider document. A test observes only its own browser lookups at that moment; it does not audit every app or prove who retained a query.
Should I turn Private DNS off if a test shows an unexpected resolver?
Do not treat one test result as proof of a fault or turn off a protection by default. Check the VPN's expected DNS path, browser Secure DNS setting, Android Private DNS mode, and per-app routing; then repeat the same limited comparison. If you intentionally use a custom provider hostname, verify it with that provider. If the device is managed by work or school, stop and ask its administrator before changing network settings.
What if enabling a custom hostname breaks browsing?
Use Android Settings search for Private DNS and restore the previous mode you recorded, or return to the system's Automatic option if that was the prior setting. Then check connectivity again and consult the device maker or network administrator if the issue remains. Menu names, policy controls, and behavior vary by device and Android version.
Does an encrypted DNS result prove the VPN protects all traffic?
No. DNS-over-TLS encrypts the DNS exchange between the device resolver and the configured DNS server, while the selected resolver still processes the query. A browser DNS test says nothing conclusive about other apps, IP traffic, tunnel continuity, or a provider's retention practices. See the DNS leak test guide for how to interpret a browser result.