DNS over HTTPS, Private DNS and VPNs: 2026 Guide

DNS over HTTPS (DoH), Android Private DNS and VPNs are all privacy-related technologies, but they operate at different layers. Confusing them can create DNS leaks or unexpected routing.

What DoH protects

DoH sends DNS queries inside HTTPS. This can prevent a local network from reading DNS requests directly, but it does not route all application traffic through a new network path.

What Private DNS does

Android Private DNS generally uses encrypted DNS transport when a compatible provider is configured. It protects name resolution, not every packet generated by every app.

What a VPN changes

A VPN can route both DNS and application traffic through its tunnel. Many VPN apps provide their own DNS resolvers to keep name resolution inside the same trust boundary.

Where conflicts appear

A browser-level DoH setting may bypass the VPN provider's DNS resolver. That is not always a security failure, but it means DNS and web traffic may use different providers. Enterprise networks may also deliberately manage DNS for filtering or internal hostnames.

2026 checklist

• Run a DNS leak test after connecting to the VPN.
• Check IPv4 and IPv6 separately.
• Verify whether the browser has its own secure DNS setting.
• On Android, test with Private DNS enabled and disabled if connectivity breaks.
• Prefer one intentional DNS design rather than several overlapping defaults.

Bottom line

Encrypted DNS and VPNs complement each other, but they are not substitutes. A predictable configuration is safer than stacking features without knowing which resolver actually receives your queries.