VPN and Android Private DNS: how they interact

Android's Private DNS setting and a VPN both decide where your DNS lookups go, and when both are on, the answer depends on which Private DNS mode you chose. With Private DNS set to Automatic or Off, a connected VPN's own resolver handles lookups for everything inside the tunnel. With Private DNS set to a specific provider's hostname, Android keeps using that provider even while the VPN is up, sending the encrypted lookups through the tunnel to it. That last mode is also the one that produces "VPN connected but nothing loads" when the provider cannot be reached from inside the tunnel.

What each one does on its own

Private DNS arrived in Android 9. It lives at Settings > Network & internet > Private DNS (Samsung: Settings > Connections > More connection settings > Private DNS; other manufacturers vary) and has three states:

• Off: DNS lookups go in plain text to whatever resolver the Wi-Fi or carrier hands out.
• Automatic: Android tries to talk to that same resolver over DNS over TLS; if the resolver does not support it, lookups go in plain text as before.
• Private DNS provider hostname: every lookup goes, encrypted, to the provider you named, regardless of network. If that provider is unreachable, lookups fail rather than fall back.

It protects one thing, well: the names you look up are no longer readable by the network you are on. It does nothing for the connections that follow, and it moves the record of what you looked up to the provider you chose. Where your DNS queries go goes through what each party can see.

A VPN takes a different approach. When it connects, it tells Android which resolver to use for the tunnel, normally one the VPN runs on the same server. Lookups travel inside the tunnel, encrypted along with everything else, and the network sees neither the lookup nor the connection that follows. The VPN provider's resolver sees the lookups, in the same way it already sees the traffic.

What happens when both are on

Two rows are worth a closer look.

Automatic is the mode that cooperates with a VPN. Android treats the VPN's resolver like any other and offers it DNS over TLS; if the VPN's resolver does not speak it, lookups go to it in plain text, which inside an encrypted tunnel costs nothing. Either way the lookups stay in the tunnel and go to the VPN's resolver. This is why Automatic, the default, is the setting most people should leave alone.

A provider hostname overrides the VPN's resolver. Android honours the setting on every network, and the VPN's tunnel is a network. So the lookups go to the provider you named, routed through the tunnel. The Wi-Fi still cannot read them, and the provider sees them arriving from the VPN's exit IP rather than yours, but the VPN's resolver is not used, and any privacy property that resolver offered is set aside in favour of the provider's.

The failure it causes

The provider-hostname mode has no fallback. If the named provider cannot be reached, Android reports no result for any lookup, and every app that needs a name fails. Through a VPN that is rare but real: some VPN servers do not carry traffic to that provider's DNS over TLS port, some restrictive networks interfere with it, and in all those cases the symptom is a VPN that shows connected while nothing loads. It is one of the first things to check in VPN connected but no internet: set Private DNS to Automatic, and if the pages come back, you have found it.

Which to choose

If the reason you run a VPN is that the network should see nothing, use the VPN's resolver, which means leaving Private DNS on Automatic. The lookups and the connections then travel together to one party, and there is no second provider learning what you looked up.

If you specifically trust a DNS provider more than you trust your VPN, or want its filtering, set the hostname and accept that it takes over. It is a legitimate choice; just know that you have now handed the names to a party the VPN would otherwise have kept them from, and that the no-fallback behaviour is yours to live with.

If you have excluded apps from the VPN, remember they are not in the tunnel at all. Their lookups follow the Private DNS mode as if there were no VPN, so on Off they are plain text on the local network. That is a reason to keep Automatic on even with a VPN, and a reason to keep the exclude list short. Split tunnelling on Android covers what else an excluded app gives up.

Checking where your DNS goes

A DNS leak test on Android shows which resolver answered a lookup. With a VPN up and Private DNS on Automatic, it should be the VPN's; with a hostname set, it should be that provider, reached from the VPN's exit IP. If it shows your carrier's or Wi-Fi's resolver with the VPN up, something is outside the tunnel, and the exclude list is the first place to look.

Culvert VPN's servers run their own resolver with query logging compiled out; the service does not log the sites you visit, your DNS queries or the contents of your traffic, its servers see only an opaque connection id rather than an account, and the one thing it does keep is your client IP address, for up to 30 days, for abuse handling, as set out in the privacy policy, and the app is on Google Play.