Web tower · floor

What is private DNS, and what it cannot protect you from

The question what is private DNS has two honest answers, because the phrase names two different things that have nothing to do with each other. Worth settling which one you want before reading further.

Start with what DNS is doing at all, because the setting only makes sense once that is clear. Google’s description is as plain as it gets: “The first step of almost every connection on the internet is a DNS query.” Your device asks a server to turn a name like www.google.com into an address, and then connects to that address. By default that question travels unencrypted — which means the name you asked about is visible to whoever is carrying it.

Private DNS changes the question, not the answer. It is Android’s implementation of a protocol called DNS over TLS, standardised by the Internet Engineering Task Force as RFC 7858, and Google compares it to HTTPS: the same kind of secure channel, applied to the lookup.

It is worth sitting with that limit for a moment, because it draws the boundary of the whole feature. After turning private DNS on, the network still sees that your device connected to a particular address at a particular time. What it stops seeing is the name you asked for on the way there. That is a real improvement and a narrow one, and the two facts belong in the same sentence.

The distinction between those two modes is the most useful thing on this floor, and it is not the one the settings screen suggests. Leaving it alone and typing in a hostname look like two levels of the same thing. What actually separates them is whether the server is verified, and Google’s wording is unambiguous: without that verification, the protection is against passive observation only.

One more limit, and it belongs to apps rather than networks. Google notes that DNS over TLS “automatically secures the DNS queries from all apps on the system”, but adds that “apps that perform their own DNS queries, instead of using the system’s APIs, must ensure that they do not send insecure DNS queries when the system has a secure channel.” In other words the setting covers the system’s resolver, and an app that goes around the system is outside it. That is not a reason to leave the setting off; it is a reason not to treat it as a guarantee about every byte the phone sends.

The requirement is modest: Google documents configuration on Android 9 or higher, and the control lives in the network settings rather than anywhere labelled privacy or security — Google’s own announcement places it there. If it is not where you expect, the search box inside Settings finds it by name.

The floors below take it three ways: what the lookup is and why it leaks, the two modes and what each one actually defends against, and the neighbouring settings people are usually looking for when they arrive at this one.

What this tower will not do

It will not tell you private DNS makes you anonymous. Google’s own announcement says the secure channel applies to DNS and nothing else, and that sentence is quoted here rather than skipped.

It will not recommend a DNS provider. Choosing one is choosing who sees every name you look up, and that is a judgement this floor is not going to make on your behalf from a distance.

And it will not treat Automatic and a provider hostname as two flavours of the same protection. Google documents them as different privacy profiles defending against different attackers. What holds instead is simple: the description of DNS as the first step of almost every connection, the note that the secure channel applies only to DNS, the definitions of the opportunistic and strict privacy profiles, the “No internet access” behaviour and the Android 9 requirement are quoted from Google’s own documentation, listed below.