VPN vs Private DNS: what each one actually encrypts

Private DNS on Android encrypts one thing: the lookups that turn a name like example.com into an IP address, sent over TLS to a resolver you choose. Everything else your phone sends still travels as it always did, from your own address, visible to the network. A VPN encrypts all of it, lookups included, inside one tunnel to a server elsewhere, and the websites see that server's address instead of yours. Private DNS is a good setting to have on; it is not a substitute for a VPN, and the two are meant to be used with an understanding of how they interact.

What DNS is, and what Private DNS changes

Before your phone can connect to any site, it asks a resolver for the site's address. Traditionally that question travels in plain text, which means the Wi-Fi owner, the carrier or anyone on the same network can read a running list of every name you look up, and can answer with a wrong address. Where your DNS queries go shows how much that list reveals.

Private DNS, in Android's Network settings, sends those questions over TLS instead, a standard called DNS over TLS. The network sees an encrypted connection to a resolver on port 853 and nothing about the names inside it. It is a meaningful improvement, it is free, and it takes ten seconds to enable.

What it does not change is the connection that follows. Once your phone has the address, it connects to the site directly, from your own IP, and the network can see that connection. With HTTPS the page contents are encrypted, but the site's name is still visible in the connection's setup on most networks, so the network learns the destination anyway.

Side by side

Where the two overlap, and where they collide

A VPN that runs its own resolver, as Culvert VPN does, already carries your lookups inside the tunnel to a resolver on the VPN server. That achieves what Private DNS achieves, and adds the rest. The resolver on Culvert VPN's servers has query logging compiled out, so the names you look up are not written down anywhere on the way.

The collision is this: if Private DNS is set to a specific provider's hostname, Android treats that as an instruction and may keep sending your lookups to that provider even while the VPN is up, through the tunnel. The lookups are still encrypted and the local network still sees nothing, but a third party you chose earlier is now receiving the list of names you visit, which is one more party than the VPN alone would involve. Setting Private DNS to automatic lets the VPN's resolver take over. VPN and Android Private DNS goes through the modes and what each does when a tunnel is active.

Which one you need

Private DNS only is a sensible baseline for a phone that mostly lives on networks you trust. It stops lookups being read or tampered with, costs nothing, and does not change your address.

A VPN is for networks you do not trust, and for keeping your own address out of sites' logs. On hotel, campus or café Wi-Fi, encrypted lookups are not enough, because the connections themselves still reveal where you went, and the network can still see your traffic pattern in full. The VPN moves all of that inside the tunnel.

Both, with Private DNS on automatic, is the arrangement that makes sense if you want the baseline whenever the VPN is off and no third-party resolver in the loop when it is on.

Checking it is doing what you think

A DNS leak is the case where the VPN is up but lookups still go somewhere outside it, and a strict Private DNS setting is one way that happens on Android, alongside apps that carry their own resolver. What a DNS leak is explains the mechanism, and running a DNS leak test on Android shows how to confirm where your lookups actually go.

Culvert VPN carries DNS inside the tunnel to a resolver on its own server, so with Private DNS on automatic your lookups and your traffic go through the same encrypted path, and the app is on Google Play.