How to Set Up Custom DNS on Android VPN Apps (2026 Guide)
If a site will not load with your Android VPN on, DNS settings may be worth checking. Follow the app-specific setup steps, test name resolution, understand how Android Private DNS interacts with VPN DNS, and learn how to revert changes if they cause connection trouble.
If a website stops loading after you connect an Android VPN, DNS is one possible cause—but it is not the only one. A wrong or unreachable DNS server can prevent a domain name from resolving even when the VPN tunnel is connected. The same symptom can also come from a browser’s Secure DNS setting, a filtering rule, an app outage, or a network that blocks the connection. This guide explains where Android VPN apps may expose DNS controls, how Android Private DNS can interact with them, and how to test changes without losing track of what fixed—or broke—the connection.
DNS translates a domain name, such as example.com, into information a device can use to connect to a service. Changing DNS does not change your VPN exit location or public IP address, and it does not encrypt all traffic by itself. A VPN app may send DNS requests through its tunnel, use a DNS server supplied by its configuration, or offer a custom DNS field. The exact behavior depends on the app, its settings, the Android version, and sometimes the device manufacturer.
Understand the DNS settings that can interact
On Android, “custom DNS” can refer to more than one setting. Before editing anything, identify which layer you intend to change. A VPN app’s DNS option may apply while that VPN is connected, whereas Android’s Private DNS setting is configured in the system network settings. A browser may also offer its own Secure DNS option. These settings are related, but they are not interchangeable.
| Setting | Where to look | What to keep in mind |
|---|---|---|
| VPN app DNS | The VPN app’s connection, profile, advanced, or DNS settings. | It may be used only while the VPN is active. Some apps accept an IP address, some accept a hostname, and some do not offer a manual DNS field. |
| Android Private DNS | Android Settings, usually under Network & internet or Connections. | On supported Android versions, this commonly configures DNS-over-TLS using a provider hostname. It is not the same field as a plain DNS server IP address. |
| Browser Secure DNS | The browser’s privacy or security settings. | A browser may resolve names through its own configured service rather than the system resolver, so a browser-only issue may not be fixed by changing VPN DNS. |
When an Android VPN app establishes a VPN connection, it can provide DNS settings for that connection. Android’s system resolver and the app’s implementation then determine how requests are handled. Private DNS may also be enabled at the system level. Their interaction can vary across Android versions, apps, and device builds, so do not assume that one setting always overrides the other. If both are configured, test the combination rather than relying on the labels alone.
First note the current values and whether each feature is enabled. If a DNS field is blank, that may mean the app uses its configured default; it does not necessarily mean DNS is disabled. Avoid copying a hostname into a field that expects an IP address, or an IP address into Android Private DNS when it asks for a provider hostname. The required format should be stated by the app or DNS provider.
3
Common DNS layers
1
Setting to change per test
0
Changes to the VPN exit from DNS alone
Check the VPN app before changing Android settings
Start with the app that creates the VPN connection. Open its connection or profile settings and look for terms such as “DNS,” “custom DNS,” “remote DNS,” or “use system DNS.” Menu names differ, and some clients expose DNS only in an advanced configuration. If you use a subscription-based configuration, an imported profile may control DNS; editing a field may be unavailable or may be overwritten when that profile updates.
If the app provides a custom DNS option, read its description before entering anything. Confirm whether it expects an address, a hostname, or a protocol-specific value. Use a resolver you trust and obtain the exact details from its provider. A typo can make name lookups fail; an untrusted resolver can observe the domain names sent to it. DNS providers may also filter domains or apply their own retention policies, so review the provider’s documentation rather than assuming that every resolver offers the same privacy or filtering behavior.
Apply one change, reconnect the VPN if the app requires it, and check more than one domain. If the app has separate settings for a profile and for the whole client, determine which one is active for the connection you selected. Do not edit protocol parameters or routing rules at the same time: changing several variables together makes it difficult to identify the cause of a result.
Set up and test a custom DNS one step at a time
The following sequence works for most Android VPN clients, but the precise labels and available options depend on the app. Keep a note of the original settings so that you can restore them. If your client has no DNS control, do not assume that it is broken; some clients use DNS values delivered by their configuration and provide no manual override.
- Record a baseline. Connect the VPN with its current settings. Try the affected website and at least one unrelated site. Note whether the problem happens in one browser, one app, or across the device. If possible, try the affected site without the VPN as a comparison, while considering that the network path and applicable access rules will differ.
- Check the app’s DNS option. Open the active connection or profile and inspect its DNS setting. If you have a trusted provider and the app accepts a custom value, enter it in the documented format. If the format is unclear, leave the field unchanged and consult the app’s own help or configuration instructions.
- Reconnect and repeat the same tests. Disconnect and reconnect if needed, then retry the same domains and apps. A connection indicator only confirms that the client reports a tunnel; it does not prove that every DNS request or website is working.
- Test Android Private DNS separately. If you also want to test Private DNS, first return the VPN app to its previous DNS setting. In Android Settings, search for “Private DNS” if the menu is hard to find. Choose the mode and enter only a provider hostname when Android requests one. Save the setting, reconnect the VPN if needed, and repeat the baseline tests.
- Restore the last known working configuration if needed. Remove the custom value or restore the original selection. If you cannot reach the affected settings reliably, turn off the experimental Private DNS option and return the VPN app to its previous DNS setting. Then reconnect and test again.
Android menu paths differ. Depending on the device, Private DNS may appear under Settings > Network & internet, Connections, or a similarly named section. Searching Settings for “Private DNS” is often the simplest route. The exact options may include automatic, off, or a provider-hostname mode; wording varies by Android release and manufacturer.
For a simple name-resolution check, use a reputable network diagnostic tool or the diagnostic feature built into your VPN client, if available. Compare the same domain under the original and changed settings. A browser can complicate this test if it has Secure DNS enabled, so check its settings when only that browser behaves differently. A single successful page load is useful evidence, but it does not prove that every app uses the same resolver.
- ✅ Change one DNS layer at a time and keep a record of the original setting.
- ✅ Test the same affected domain and a separate site after each change.
- ✅ Check browser Secure DNS when the problem appears limited to one browser.
- ❌ Do not treat a connected VPN indicator as proof that DNS resolution is working.
- ❌ Do not enter an unverified address or hostname simply because it appears in an online post.
Troubleshoot Private DNS conflicts and failed lookups
If websites fail only while the VPN is connected, begin by comparing the VPN app’s DNS behavior with Android Private DNS. Temporarily return one layer to its previous setting and test again. If the problem disappears, reintroduce settings one at a time to confirm which combination causes it. This is more reliable than turning every privacy feature off at once, which may restore access without identifying the source of the problem.
If Android reports that a Private DNS provider cannot be reached, the hostname may be incorrect, the provider may be unavailable, or the current network path may not reach it. Confirm the hostname against the provider’s official documentation. If the provider uses an encrypted DNS service, check that the value is specifically intended for Android Private DNS; an ordinary resolver IP is not automatically a valid provider hostname.
If only one app or browser fails, check its own DNS, proxy, or secure-connection options before changing the system resolver again. Also consider cached results: an app may temporarily retain a previous lookup or connection. Fully close and reopen the app, or use its normal refresh controls, then repeat the test. Avoid clearing all application data unless you understand what else that action will remove.
If all domains fail, restore the last known working DNS configuration first. Then check whether the VPN app reports a connection error, whether the selected profile has valid settings, and whether the underlying Wi-Fi or mobile connection is working. A blocked or unavailable website, a captive Wi-Fi login page, a routing rule, or a temporary service problem can resemble a DNS failure. Changing DNS will not correct those causes.
Android may offer an always-on VPN option or a setting to block connections that do not use the VPN. Those protections are separate from DNS selection. If enabled, they can affect what happens when the VPN disconnects or cannot establish its tunnel. Do not disable them casually to troubleshoot a single domain. If you need to change such a setting for a controlled test, understand the privacy trade-off and restore it afterward.
Choose a configuration you can maintain
For most users, the best configuration is the simplest one that resolves the actual problem. If the VPN app’s default DNS works, there may be no benefit to adding a second resolver. If you need a custom resolver, choose a provider whose operating details and policies you understand, enter only the format requested by the active setting, and verify that the configuration continues to work after reconnecting and changing between Wi-Fi and mobile data.
Keep in mind that DNS is only one part of a connection. It does not provide a fixed VPN exit, replace the VPN tunnel, or make an unsafe website trustworthy. A DNS provider can receive the queries sent to it, while the VPN app and network path determine how those queries travel. The exact visibility depends on the resolver, encryption, and routing configuration. Avoid making privacy claims based solely on a “secure” or “private” label in a settings screen.
If a custom value causes repeated connection trouble, revert it rather than accumulating workarounds. Save the app name, Android version, connection profile, DNS mode, and the domains affected before seeking help. Do not post a subscription link, account credentials, or other private configuration details in a public support request. A clear description of the setting and symptom is usually more useful than sharing the full configuration.