Android gives Google's DNS a backup route that ad blockers don't get

Android's Private DNS setting works differently depending on who runs your DNS. DNS is the lookup step that turns a website name into an address. Google's resolver gets a backup route when a network blocks the usual one. Ad-blocking providers such as AdGuard DNS do not. On some public Wi-Fi networks, that can leave a phone with no internet at all, while Google's DNS keeps working on the same network.

What changed

Google announced a faster protocol called DNS-over-HTTP/3 for Private DNS on July 19, 2022. It came through a Google Play system update for Android 11 and above. The Android team said it would replace the older DNS-over-TLS only for well-known servers, naming Google and Cloudflare. It said other servers might be added later.

In Android's public resolver code, only Google's dns.google, its DNS64 variant, Cloudflare and a few test entries remain on that list. AdGuard DNS, NextDNS, Control D, Mullvad and Quad9 still use DNS-over-TLS on port 853. Google rejected a request to open the faster protocol to any server in January 2025.

Why it matters on public Wi-Fi

Port 853 carries only encrypted DNS, so a network can block it with one firewall rule. Captive portals often block it until you sign in. Some hotel and office networks block it for good. The faster protocol uses UDP port 443, the same port as ordinary web traffic, which networks tend to leave open.

Typing a provider hostname into Private DNS puts Android in strict mode. If the secure connection fails, Android will not fall back to the network's plain DNS, so apps cannot load anything. With dns.google, Android checks both routes. If port 853 fails and port 443 works, it switches over with no warning. TrackerControl, an open source tracker blocker, documented the strict-mode behavior on a Pixel 8 running Android 17 in August 2026.

The limits of Google's edge

A network that also blocks QUIC on UDP 443 breaks the backup route. Cloudflare users are not guaranteed it either. Android only upgrades the exact hostname cloudflare-dns.com, while Cloudflare's Android guide tells users to enter one.one.one.one, which Android treats like any other DNS-over-TLS server.

What to do

• Set Private DNS to Automatic before joining a restrictive network. Find it in Settings > Network & internet > Private DNS.
• Automatic keeps you online, but your DNS traffic is readable and unfiltered. Switch back afterward.
• Or use a DNS app such as RethinkDNS or the AdGuard and NextDNS apps. They send DNS over port 443.
• Those apps use your VPN slot, and Android allows only one VPN app at a time.

What happens next

Google's 2022 post said Android aimed to support Discovery of Designated Resolvers. The resolver now has a path for DNS-over-HTTPS settings from outside its fixed list. The writer found nothing that uses it for a hostname typed into Private DNS. Opening HTTP/3 to any typed hostname, or finishing that discovery work, would put AdGuard and NextDNS users on equal footing. Google has not announced any such change.