Changing DNS on Android while a VPN is connected can be useful when you need a particular resolver, want encrypted DNS outside a browser, or are diagnosing name-resolution problems. The important question is not simply which DNS address to enter. Android has a system-level Private DNS setting, while many VPN apps provide their own DNS controls. Depending on the Android version and how the VPN creates its connection, those settings can take different paths or compete with each other.
This guide explains how to choose between Android Private DNS and a VPN app’s DNS option, how to apply the change carefully, and how to check whether ordinary browsing still works. It also covers what to do if websites stop loading, why a DNS test can be misleading, and how to restore the original settings. The steps use Android’s standard settings and apply even when menu names differ slightly between phone manufacturers.
Understand the two DNS controls
DNS translates a domain name, such as a website address, into the network information needed to reach it. It is separate from the VPN tunnel itself: a VPN can carry your traffic while DNS requests are handled by the VPN provider, a resolver selected in the app, or a system-level resolver. Which arrangement applies depends on the VPN client, its connection mode, and the Android version.
Android Private DNS is a system setting
On Android 9 and later, the Private DNS setting can use DNS over TLS, commonly shortened to DoT. In its provider-hostname mode, Android connects to a DNS service using a hostname supplied by that provider. This is not the same as entering an IP address into an ordinary DNS server field. If the selected provider requires a hostname, entering an IP address or an unrelated website name will not configure it correctly.
Private DNS is managed by Android rather than by one specific browser. That makes it different from a browser’s own secure-DNS option, which may apply only to that browser. However, “system-wide setting” does not guarantee that every DNS request from every app follows the same path. A VPN can provide its own DNS servers or handle name lookups inside its tunnel. Some apps also use their own resolver behavior, so their requests may not follow the system setting.
A VPN app can provide DNS for its tunnel
Many VPN apps have a DNS choice in their connection, privacy, or advanced settings. It may be described as automatic DNS, provider DNS, custom DNS, or a similar label. When the VPN establishes an Android VPN connection, it can configure DNS servers for that connection. A client may also have an internal resolver or other DNS-handling behavior, so the wording of its setting does not always reveal every detail of the route.
For this reason, do not assume that Android Private DNS always overrides the VPN, or that the VPN always overrides Private DNS. The result depends on the implementation. A VPN might route system DNS through its tunnel, use its own resolver, or interact with Android’s secure resolver in a way that varies by device and app version. If the client documents a DNS option for use while connected, treat that option as the first place to configure a custom resolver.
When comparing clients or checking setup guidance from VPNLP, keep the distinction clear: the VPN chooses how network traffic is carried, while DNS determines how names are looked up. A successful connection indicator does not by itself prove that DNS is using the route you intended.
Choose a configuration method
Before changing anything, identify your goal. If you want the VPN to use a particular resolver, use the DNS control inside the VPN app if it provides one. If you want Android’s system resolver to use an encrypted provider, configure Private DNS. If you are troubleshooting, first test the VPN with its default DNS behavior. This gives you a useful baseline and prevents a DNS change from being confused with a connection or routing problem.
| Method | Where it applies | Best starting point | Potential complication |
|---|---|---|---|
| VPN app DNS option | Usually the VPN connection or traffic handled by its client | When the custom resolver should be used with the VPN | The app may apply its own resolver behavior or offer limited choices |
| Android Private DNS | Android’s system DNS resolver | When you want system-level encrypted DNS through a supported provider | The VPN may configure a different DNS path, or the provider may be unreachable |
| Browser secure DNS | Usually the browser where the setting is enabled | When you only need to change DNS behavior in that browser | Other apps may continue using Android or VPN DNS settings |
A custom resolver must be reachable from the network path that is actually in use. A resolver that works on a home connection might not be reachable through a particular VPN route, mobile carrier, or local network. A connection timeout after changing DNS does not necessarily mean the VPN has failed; it can mean that the resolver name, encryption mode, or route is incompatible with the current setup.
Also check whether the resolver is intended for general DNS use and whether it provides the configuration format required by the setting. Android Private DNS typically expects the provider hostname for a compatible DoT service. A VPN app may instead request an IP address, offer a list of providers, or have its own custom format. Follow the field’s instructions rather than copying an address from a different configuration screen.
Set custom DNS on Android
Configure the VPN app first
- Disconnect the VPN before editing its connection settings, unless the app explicitly allows changes while connected.
- Open the VPN app and look for DNS controls under connection, network, privacy, or advanced settings. Labels vary between clients.
- Check what the selected mode expects. If it asks for a hostname, use a hostname supplied by the DNS provider. If it asks for an address, use the format specified by the app. Do not guess or paste a hostname into an IP-only field.
- Save the setting, reconnect the VPN, and wait until the app reports an active connection. If Android displays a VPN permission prompt, review it and confirm only if it is the VPN app you intended to use.
- Test a few ordinary websites and apps. If the VPN connects but names fail to resolve, restore the app’s automatic DNS mode before changing Android’s system setting.
Use the VPN app’s built-in connection profile or settings rather than editing an imported configuration unless you know that the client supports such edits. Some clients replace local changes when a subscription profile is refreshed; others keep app-level DNS preferences separately. If a setting appears to revert, check whether it belongs to the active profile, a global preference, or an imported configuration.
Configure Android Private DNS
- Open Android Settings and search for Private DNS. On many devices, it is under network or connectivity settings, but the exact path depends on the manufacturer and Android release.
- Note the current selection before changing it. The options commonly include automatic behavior, off, or a provider-hostname mode.
- Select the provider-hostname option and enter the exact hostname supplied for compatible DNS over TLS service. Do not add a URL prefix, a path, or spaces unless the provider specifically instructs you to do so.
- Save the setting, then test while the VPN is disconnected. This confirms that the hostname and the phone’s current network can establish DNS service without adding VPN behavior to the test.
- Connect the VPN and repeat the same basic checks. If resolution works before the VPN connects but stops afterward, restore the previous Private DNS value and investigate the VPN app’s DNS option.
The separation between the disconnected and connected checks is important. If you change Private DNS and connect the VPN at the same time, a failure leaves two possible causes. Testing in stages makes it easier to tell whether the provider hostname is invalid, the local network cannot reach the provider, or the VPN changes the DNS route.
When the Private DNS setting shows that it cannot connect to the provider, do not repeatedly toggle unrelated network options. Confirm that the hostname is exact, that the provider supports the expected secure-DNS mode, and that the current connection allows access to that service. If the setting remains unavailable, return to the previous option and test the VPN’s own DNS controls instead.
Verify DNS without overreading tests
Start with basic functionality: open a few known websites, use an app that needs a fresh connection, and check whether the VPN still reports an active session. If a website fails by name but a previously opened page remains visible, that can point toward a lookup problem, although cached content may make the symptom less clear. Force a fresh page load or reopen the app before drawing a conclusion.
A DNS test website can provide additional clues, but it is not a complete audit. Results may be affected by browser secure-DNS settings, cached lookups, content delivery networks, or the test page’s own detection method. A result showing a resolver does not necessarily prove that every application uses that resolver, and a result showing an unexpected resolver does not by itself establish that the VPN tunnel is inactive.
For a more useful comparison, run the same test under the same conditions: first with the VPN disconnected, then with it connected, without changing other settings between checks. If the purpose is to confirm the VPN’s DNS behavior, temporarily disable browser-specific secure DNS or record whether it is enabled. Otherwise, the browser may be using a separate resolver and obscure what Android or the VPN app is doing.
- ✅ Record the original Private DNS and VPN DNS selections before editing them
- ✅ Test the resolver with the VPN disconnected before testing it through the VPN
- ✅ Check more than one app, because browser settings may be independent
- ✅ Change one control at a time and repeat the same checks
- ❌ Treating a VPN “connected” label as proof that DNS follows the intended route
- ❌ Changing Private DNS, VPN DNS, and browser secure DNS simultaneously
If you use split tunneling or per-app routing, include that in your interpretation. An app excluded from the VPN may use the local network’s DNS path, while an included app may follow the VPN client’s route. The behavior can also differ between system services and user-installed apps. When results do not match, first check which apps are included in the VPN rather than assuming that the DNS provider is malfunctioning.
Fix failures and revert safely
If browsing stops after a DNS change, restore the last known working configuration before making a more complicated adjustment. Disconnect the VPN, return Android Private DNS to the value you recorded, and reconnect only after basic browsing works again. If you changed a DNS option inside the VPN app, switch that option back to automatic or its original selection, then reconnect and test.
If the phone connects to Wi-Fi or mobile data but websites do not load, determine whether the failure is limited to one app or affects several. A single browser may have its own secure-DNS setting, while multiple apps failing at once is more consistent with a system-wide resolver or routing problem. As a temporary diagnostic step, switch the browser’s secure-DNS setting back to its default and retry. Avoid resetting all network settings unless simpler reversions fail, because that can remove saved Wi-Fi and other network preferences.
When only VPN-connected browsing fails, check that the VPN app is using the profile you intended and that its DNS mode is supported by the current connection. Reconnect the VPN after restoring automatic DNS. If the service works with automatic DNS but not with the custom resolver, the issue is likely compatibility or reachability of that resolver on the VPN path, not proof that Android Private DNS is broken.
When only one app fails, check its own network or secure-DNS options and its VPN inclusion status. Some apps may retain cached results until they are restarted. Do not assume that clearing all application data is necessary; start by closing and reopening the affected app, then repeat the test. If the problem persists, revert the custom setting and collect the app name, Android version, VPN connection mode, and the exact setting changed before seeking support.
Frequently asked questions
Does Android Private DNS replace the VPN’s DNS?
Not in every setup. Android Private DNS configures the system resolver, while a VPN app may supply DNS for its VPN connection or handle lookups internally. The actual result depends on the VPN client and Android’s handling of that connection. Test the settings separately instead of assuming one always takes priority.
Can I enter a DNS IP address in Android Private DNS?
The provider-hostname option is intended for a compatible DNS over TLS provider hostname, not a general IP-address field. If you have an IP address rather than a hostname, check whether the VPN app has a DNS field that accepts addresses, and follow that field’s documented format.
Why does the VPN connect when no websites load?
The VPN tunnel and DNS resolution are related but separate functions. The tunnel can be active while a selected resolver is unreachable, a hostname is mistyped, or the VPN’s DNS configuration conflicts with the system setting. Restore automatic DNS first, verify browsing, and then test the custom resolver on its own.
How do I undo the change?
Open Android Settings, search for Private DNS, and restore the selection you recorded before editing it. If you changed DNS inside the VPN app, restore that option as well. Test once with the VPN disconnected and again after reconnecting so you can confirm which setting caused the problem.