Private DNS on Android vs a DoH app

Android's Private DNS encrypts lookups with DNS over TLS, no app needed. When a DoH app works better, how the two conflict, and what neither can fix.

Published 7 min readĐọc bằng tiếng Việt →

If you have searched for "encrypted DNS on Android", you have probably met two answers. One says: you do not need an app, just turn on Private DNS. The other says: install an app that does DNS over HTTPS. Both are reasonable. They solve the same problem in different ways and fail in different places. This guide explains how each works, where each one struggles, and how to pick. We make GreenTunnel, which includes a DoH client, so read with that in mind.

What Private DNS actually is

Google added Private DNS in Android 9. It is usually found under Settings → Network & internet → Private DNS, though the exact path differs between phone makers. It has three choices:

  • Off: lookups go in plain text to whatever DNS server the current network hands out.
  • Automatic: the default. Android tries DNS over TLS with the network's own DNS server and uses it if that server supports it. If not, lookups stay in plain text. This is often called opportunistic mode, and on most home and mobile networks it means no encryption at all.
  • Private DNS provider hostname: you type a provider's hostname, for example dns.google for Google Public DNS. Android then insists on that server. If it cannot reach it, it does not quietly fall back to plain DNS. Google's announcement says Android marks the network as having no internet access instead.

DNS over TLS is standardised in RFC 7858 and uses its own port, 853. That dedicated port is both its strength and its weakness: it is clean and lean, but it is also easy for a network to recognise and block.

What about DNS over HTTPS in Android?

There is a nuance that many guides miss. In July 2022 Google announced that, through a Google Play system update, devices on Android 11 and later use DNS over HTTP/3 instead of DNS over TLS for well-known DNS servers that support it. Google and Cloudflare were the providers covered at launch. Google's post stresses that the DNS service you use does not change, only the transport. You still type a hostname in the same Private DNS box. There is no field for an arbitrary DoH address, and for other providers Private DNS stays DNS over TLS.

What a DoH app does differently

A DoH app, or a VPN app with a DoH client, takes over DNS for the whole device through Android's VPN slot. Each lookup travels inside HTTPS to a DoH server such as https://cloudflare-dns.com/dns-query, defined in RFC 8484.

  • It uses port 443. To the network it looks much like any other HTTPS connection. A network that blocks port 853 to stop DNS over TLS usually leaves it alone.
  • You choose the server and the protocol. Apps can offer DoH and DoT providers side by side and switch between them.
  • It can avoid the network's resolver entirely. A good client connects to fixed bootstrap IP addresses for the DoH server, so even finding the DNS server does not depend on the network's DNS.
  • It costs the VPN slot. Android allows one VPN at a time. A DoH app cannot run alongside another VPN app.

Side by side

Private DNS (hostname)DoH app
Extra app neededNoYes
ProtocolDNS over TLS, or DNS over HTTP/3 for some well-known providers on Android 11+DNS over HTTPS (some apps also offer DoT)
Port853 for DoT443
If the server is blockedNetwork shows no internet until you change the settingDepends on the app. Some switch to another provider
Uses the VPN slotNoYes
Works with another VPN appYes, with the conflicts described belowNo, only one VPN at a time
Helps against name filtering in HTTPSNoOnly if the app also does that

Where Private DNS struggles

  • Networks that block port 853. Some workplaces, schools and public Wi-Fi block it. In hostname mode, the network then looks broken. See Site opens on mobile data, not Wi-Fi? for how this shows up.
  • Per-network quirks. The setting is global, but networks are not. A hostname that works on mobile data can fail on one particular Wi-Fi.
  • Login pages on public Wi-Fi. Hotel and café networks with a sign-in page can misbehave with a fixed hostname until you finish signing in. Switching to Automatic for a moment usually clears it.
  • Automatic is often unencrypted. Most ISPs' own DNS servers do not offer DNS over TLS, so Automatic quietly stays on plain DNS.

Where a DoH app struggles

  • It must keep running. If Android stops the app to save battery, DNS protection stops too. See keeping a VPN running on Android.
  • It blocks other VPNs. You cannot combine it with a work VPN on the same phone.
  • Its server can be blocked by IP address. Port 443 does not help if the network blocks the address of the DoH server. Clients that can fall back to another provider handle this better.

The conflict: Private DNS plus a VPN app

Since Android 10, a Private DNS hostname also applies while a VPN app is running. Google's own Public DNS instructions note that on Android 9 a VPN overrode Private DNS, and that this was fixed in Android 10. In practice that means if you set a hostname and then turn on a VPN app with its own DNS, Android sends lookups to your Private DNS provider instead. The VPN's encrypted DNS and its block list never see those names. If that provider is blocked on the current network, every site fails.

With GreenTunnel, set Private DNS to Off or Automatic while you use it. This is one of the first checks in Site still blocked?

How GreenTunnel handles DNS

GreenTunnel is a local VPN with a built-in encrypted DNS client. Under Settings → DNS you choose one of three providers, or Automatic:

  • Cloudflare, DoH, https://cloudflare-dns.com/dns-query
  • Google, DoH, https://dns.google/dns-query
  • Quad9, DoT, dns.quad9.net:853

Automatic tries Cloudflare, then Google, then Quad9, and keeps using whichever one answered. Each provider is reached through built-in bootstrap IPs, so your ISP's DNS is never asked. DoQ is not supported. The full walkthrough is in DoH and DoT explained.

The difference from a DNS-only app is what happens after the lookup. GreenTunnel also reshapes the first packet of HTTPS connections to get past simple name filtering, shows per-app connections in Requester, and can test a site with Inspect URL. We never collect the domains you look up.

Honest limits of encrypted DNS

Encrypted DNS, whichever way you get it, fixes one kind of block: a network that fakes or drops DNS answers. It does not stop a network from reading the site name in the HTTPS handshake, which needs packet reshaping or ECH. It does not get past IP blocking. It does not hide your IP address, and your ISP can still see which addresses you connect to. The DNS provider you pick sees your lookups instead of your ISP, so choose one whose policy you trust. GreenTunnel is not an anonymity tool either.

Which should you use?

  • Just want lookups encrypted on networks that behave? Private DNS with a provider hostname is simple and needs no app.
  • Your network blocks port 853, fakes DNS, or filters site names? A DoH app, ideally one that also handles name filtering, is the better fit. Turn Private DNS to Off or Automatic.
  • You already use a work VPN? Stay with Private DNS, because only one VPN app can run.

GreenTunnel is free on Android and iPhone, with optional Premium. See how it works on the home page.

FAQ

Does Android Private DNS use DoH or DoT?

DNS over TLS on port 853. Since a 2022 Google Play system update, Android 11 and later use DNS over HTTP/3 instead for some well-known providers that support it, starting with Google and Cloudflare. You cannot enter a custom DoH address.

Should I keep Private DNS on while using GreenTunnel?

Set it to Off or Automatic. A provider hostname makes Android send lookups to that provider directly, so GreenTunnel's encrypted DNS and your block list are skipped.

Is DoH more private than DoT?

Both encrypt the lookup equally well. The difference is how easy it is to spot and block. DoT uses a dedicated port, while DoH blends in with HTTPS on port 443.

Will encrypted DNS unblock every site?

No. It only fixes DNS-based blocking. Sites blocked by name filtering need more, and sites blocked by IP address need a different route entirely.

Sources

← All posts