Android VPN and Private DNS: Setup Tips

Most Android phones have two separate features that both deal with DNS, the lookups that turn a website name into an address. One is the system setting called Private DNS, which encrypts those lookups. The other is your VPN app, which creates a tunnel and usually brings its own DNS arrangements along. When both are active, they sometimes cooperate quietly and sometimes produce the classic symptom: the VPN says connected, but pages will not load.

This article is a setup guide for people who want to use both. It does not repeat the full theory of how the two interact, which is covered in Private DNS and VPN on Android. Instead it gives you a practical order of steps, a way to choose the mode, hostname details that trip people up, a testing routine and a troubleshooting table. If you want the background on lookups first, how DNS works is a short read.

Where the setting is and what its modes mean

Private DNS arrived in Android 9. The setting is usually under network or connection settings, in a section that may be called Private DNS or Advanced connections. The exact menu names vary by phone maker and Android version, so search the settings for "Private DNS" if you cannot find it.

You will normally see three choices:

• Off. Android uses the DNS servers handed out by the current network, in the traditional unencrypted way.
• Automatic. Android tries to use an encrypted connection (DNS over TLS, described in RFC 7858) to whichever server the network provides. If that server does not support encryption, Android falls back to normal lookups.
• Private DNS provider hostname. You type the hostname of a server that supports DNS over TLS. Android then insists on that server and does not fall back. If it cannot be reached, lookups fail.

The important point is that the hostname mode is strict by design. That strictness is useful when you trust one particular resolver and want to be sure nothing else answers. It is also the mode most likely to clash with a VPN, because a VPN changes which networks and servers your phone can reach.

How Android picks DNS when a VPN is on

A VPN app on Android creates its own virtual network. Android's own explanation of connecting to a VPN describes the system asking you to approve the connection, after which the app routes traffic through it. That virtual network normally comes with DNS servers of its own, supplied by the VPN service, so that your lookups travel inside the tunnel.

What happens to Private DNS then depends on the mode and the phone:

• In Automatic mode, the phone tries an encrypted lookup to the VPN network's DNS server if it supports it, and otherwise uses the ordinary lookup inside the tunnel. Either way, the lookup usually stays within the VPN.
• In hostname mode, many phones keep sending lookups to your chosen hostname even when a VPN is connected. That can mean the lookups travel inside the tunnel to the third-party server, or, on some devices and VPN apps, that they do not follow the tunnel as you expect.
• In Off, the VPN's DNS arrangement is the only one in play.

Because behaviour differs between devices and apps, do not assume. You will test in a later section. The key lesson is that the safest combination is the one you have actually checked on your own phone. For a broader view of whether encrypted lookups and a tunnel overlap, see DNS over HTTPS vs VPN.

A sensible setup order

The order in which you change things makes troubleshooting much easier. Change one variable at a time.

1. Start with the VPN alone. Set Private DNS to Off, install and sign in to the VPN app by following how to set up a VPN on Android, and connect. Confirm that pages load and that a test shows the expected result.
2. Write down the baseline. Note which DNS resolver a leak test page reports with the VPN connected. This is your reference.
3. Switch Private DNS to Automatic. Reconnect the VPN, load a few sites and repeat the test. Note any change.
4. Only if you want a specific resolver, try a hostname. Enter it exactly (see the next section), reconnect the VPN and repeat the test.
5. Test on both networks. Run the checks on Wi-Fi and on mobile data, because the DNS handed out by each network is different.
6. Keep the combination that works, and write it in your notes. If something breaks later, you can go back to a known state.

If any step breaks things, undo only that step. That is the point of the order.

Three everyday setups compared

Situation	Suggested Private DNS mode	Why
Commuter who connects the VPN on and off during the day	Automatic	No fixed server to fail when the network changes
Remote worker whose employer expects a specific resolver	Hostname, only if the employer asks	Their policy sets the resolver; test with the VPN
Student on dorm Wi-Fi with a heavy filter	Automatic, then Off if pages fail	Local filters can block the encrypted port
Family phone shared by several people	Automatic	Fewer settings to break, easier for non-technical users
Traveller on hotel and airport networks	Automatic	Captive portals often fail with strict hostnames
Someone testing for leaks	Off, then Automatic	Easy to compare cleanly

The common thread is that Automatic changes the least. Only choose a hostname when you have a reason, and be prepared to switch back.

Hostname details that trip people up

If you do use a hostname, small mistakes cause large problems.

• Enter a hostname, not an IP address or a URL. Android expects something like dns.example.net, with no https:// in front and no path afterwards. An address in numbers will be rejected.
• The server must support DNS over TLS on the standard port. A resolver that only offers DNS over HTTPS (RFC 8484) will not work in this field, even if it is excellent.
• Spelling errors fail silently. A typo can leave your phone with no working lookups, because strict mode refuses to fall back. If pages stop loading right after you saved the setting, suspect the typo first.
• Copy and paste from the provider's own page, not from a forum post, and check the page uses HTTPS.
• Captive portals need an escape. Hotel and café Wi-Fi often show a sign-in page that must resolve through the local DNS. With a strict hostname, the sign-in page may not open. Turn Private DNS to Automatic or Off until you have signed in, then switch back.
• Some company networks block the encrypted port. If your workplace blocks port 853, a hostname setting will fail on that network.

How to test the combination in ten minutes

Testing is the one step that separates a working setup from a hopeful one.

1. Test with the VPN off, Private DNS in your chosen mode. Visit a DNS leak test page and note the resolver.
2. Connect the VPN and open the same page. Note the resolver again. If the resolver changed to one that belongs to the VPN service, lookups follow the tunnel. If it still shows your own network's operator, they are not following it.
3. Open an IP check page too. The address should be the VPN's, not your home or mobile network's. Our guide on what a DNS leak is explains how to read the results.
4. Load three different kinds of site: a news site, a video site and an app that uses its own servers. A site that fails while others load can point to a DNS problem specific to a single service.
5. Switch networks between Wi-Fi and mobile data, and repeat step 2.
6. Check after disconnect. When you turn the VPN off, lookups should return to your Private DNS setting.

For a general checklist of connection checks beyond DNS, the guide to checking whether your VPN is working is a good companion.

Troubleshooting by symptom

Symptom	Likely cause	Try
VPN connected, no page loads	Strict hostname unreachable from the VPN network	Set Private DNS to Automatic and reconnect
Pages load slowly, then work	Lookups timing out before a fallback	Check the hostname spelling; test Automatic
Only some sites fail	One service uses its own resolver or filters lookups	Test the same site with VPN off and on
Leak test shows your operator while connected	Lookups not following the tunnel	Try Off or Automatic; reconnect
Hotel sign-in page will not open	Strict mode blocks the portal's lookup	Switch to Automatic, sign in, switch back
Works on Wi-Fi, fails on mobile data	The carrier network blocks the encrypted port	Use Automatic on that network
Worked yesterday, fails today	Android update or app update changed behaviour	Re-run the baseline test

When the tunnel is connected but nothing opens, our general guide to VPN connected but no internet covers non-DNS causes as well.

Common mistakes

• Treating Private DNS as a replacement for a VPN, or a VPN as a replacement for encrypted lookups. They protect different things.
• Typing a hostname with https:// or a trailing slash.
• Setting a hostname, forgetting about it, and later blaming the VPN for slow or failed pages.
• Changing Private DNS, the VPN app's settings and the network at the same time, so that you cannot tell what fixed or broke something.
• Testing only on Wi-Fi and assuming mobile data behaves the same.
• Believing a "connected" badge proves lookups are safe. Only a leak test shows where they go.
• Copying a hostname from an unknown source. Whoever runs that resolver can see the names you look up.
• Leaving a strict hostname on while travelling and then being unable to use captive portals.

Limits and what to watch for

Private DNS encrypts the lookup between your phone and one server. That helps against someone on the same network reading the names you request. It does not hide which addresses you connect to afterwards, it does not give you a different IP address, and it does not protect you from a malicious site. A VPN tunnel hides your traffic from the local network and gives websites the VPN's address, but it does not make you anonymous. Used together, the two cover different gaps, provided they cooperate.

Remember also that someone always runs the DNS server you choose. Choosing a hostname moves trust from your network operator to the resolver's operator. That can be a good trade, but make it knowingly.

Summary

For most people, the least troublesome arrangement is to set up the VPN first, keep Private DNS on Automatic, and test with a leak page on both Wi-Fi and mobile data. Use a fixed hostname only when you have a reason, enter it exactly, and be ready to switch back to Automatic when a network or captive portal gets in the way. Change one thing at a time and keep notes of what worked.

If you want a simple VPN to test these settings with, the prepaid passes on the pricing page work with the free VPNclient app, and the download page lists the official app links.