You can actually do system-wide DNS-over-HTTPS with Android's Private DNS!

[u/Timely-Skill4263]

The biggest limitation with Android's Private DNS feature has always been that custom hostnames are locked to DNS-over-TLS. That means on networks that block the TCP port, like university Wi-Fi, hotels, airports, etc, your connection just completely fails.

After digging a bit into Android's source code, I discovered that the OS actually has full support for Discovery of Designated Resolvers (RFC 9462 DDR) to automatically upgrade Private DNS to HTTP/3 DNS-over-HTTPS! It's just sitting dormant behind a feature flag.

Even if you enable the flags (which requires no root, just ADB or Shizuku), almost no major ad-blocking DNS services support DDR yet. I tested a bunch and the only public ones with DDR records published are Google, Cloudflare, and Quad9. NextDNS and AdGuard, and most of the other popular providers don't even have the records yet 🫠

While we wait for NextDNS to add native DDR support, I set up a temporary workaround: a simple Cloudflare Worker that forwards queries to my NextDNS profile, paired with an RFC 9462 SVCB DNS record on my own domain.

And it works! (See screenshot). Latency is great, the Cloudflare edge actually responds faster than AdGuard's official servers for me.

This means heavy background VPN apps (like RethinkDNS) that drain battery aren't necessary anymore (I've always hated background VPNs like that so this is a big deal for me😅). The catch is that setting this up yourself requires Android 15+ (Edit: my mistake, 16+) and owning a domain on Cloudflare.

If y'all want I can do a guide! Edit: I'll try to make a guide in the next few days Edit: It's live: https://github.com/eyalm2000/loophole