Using Android private DNS with VPN

Question

Android allows now to set "private DNS" in the settings (which also allows using DNS over TLS - sadly over HTTPS atm only works for specific DNS providers).

What I am trying to establish is: if I set private DNS and use VPN at the same time, will the DNS queries go through VPN connection - aka will the DNS service only receive the IP of the VPN node I am connected to.

Tried using AdGuard DNS as private DNS with VPN on. In this case I could see in AdGuard logs that the IP was indeed the IP coming from VPN (not my actual IP).

The test I did would suggest that indeed the DNS queries are going through VPN. Which would also make sense as I did use the option to block connections without VPN. But would like to see if anybody can confirm that this is always the case.

With regards to version of Android - let's say we are talking only about 13 (with January 1, 2023 security patch version).

Answer 1

Android's private DNS is DoT (DNS over TLS) and it doesn't really matter where requests will go: they will be encrypted regardless.

But yes, when you up a VPN connection, all the outside traffic will be routed via VPN by default, thus your VPN provider will see DNS connections but it won't be able to snoop on them.

Answer 2

Apparently, some VPNs such as Google’s Google Fi VPN and Google One VPNs will respect Android’s Private DNS setting which—if I’m not mistaken—is a relatively recent development. (On other platforms such as macOS, the Google One VPN still uses Google’s DNS servers instead of system DNS information.)

Some other VPNs require that DNS be specified in the VPN app; for example, hide.me and Mozilla VPN. Sometimes this is restricted; Mozilla VPN, for example, defaults to its own DNS servers and only allows a single IPv4 DNS address to be specified (despite otherwise supporting IPv6) making it more or less useless for services like NextDNS.