Google’s DNS gets a hidden backup path on Android, leaving ad blockers stranded

Using AdGuard DNS as a Private DNS on a Pixel blocks ads inside apps without a VPN, but on many public Wi‑Fi networks the connection fails and Android shows a “Private DNS server cannot be accessed” warning. Switching the Private DNS hostname to Google’s dns.google instantly restores connectivity on the same networks. The difference is that Android gives Google’s resolver a newer DNS‑over‑HTTP/3 protocol that most firewalls allow, while other providers remain on DNS‑over‑TLS. This hidden fallback path means ad‑blocking DNS services are more fragile than users realize. Understanding the split protocol handling is crucial for anyone relying on Private DNS for privacy or ad‑blocking.

What happened

Android’s Private DNS implementation supports two distinct transport protocols. Google’s dns.google (and its DNS64 variant) and Cloudflare’s 1dot1dot1dot1.cloudflare-dns.com are allowed to use DNS‑over‑HTTP/3, which runs over UDP port 443, while every other hostname is forced onto DNS‑over‑TLS on TCP port 853.

Google announced the DNS‑over‑HTTP/3 capability on July 19, 2022, delivering it through a Google Play system update for Android 11 and later. The Android team said the faster protocol would replace DNS‑over‑TLS only for well‑known servers, naming Google and Cloudflare at launch, with the possibility of adding more later. The public resolver code still lists only Google, its DNS64 variant, Cloudflare, and a few test entries for the new protocol.

Because UDP 443 is the same port used for regular web traffic, many captive‑portal or corporate firewalls that block TCP 853 let DNS‑over‑HTTP/3 through. As a result, on networks that drop port 853, switching to dns.google restores name resolution, while ad‑blocking services such as AdGuard DNS, NextDNS, Control D, Mullvad, and Quad9 remain unreachable.

Why it matters

The split handling creates a reliability gap: users who configure a privacy‑focused DNS provider may lose connectivity on restrictive networks, whereas those who stick with Google’s resolver stay online. For ad‑blockers that rely on Private DNS, this means a higher chance of being forced to disable the blocker or fall back to plain DNS, exposing traffic to eavesdropping. The situation also raises privacy concerns, as the hidden fallback nudges users toward Google’s infrastructure, consolidating more DNS query data under a single corporate provider.

How to think about it

If you prioritize uninterrupted connectivity on public or corporate Wi‑Fi, consider using Android’s Automatic Private DNS mode, which falls back to the network’s plain DNS when the encrypted connection fails. This keeps you online but sacrifices the privacy of encrypted DNS. For privacy‑first users, weigh the risk of occasional loss of connectivity against the benefit of keeping all queries off Google’s servers; you may want to carry a secondary DNS app or VPN that can switch providers on the fly. Finally, stay aware of network policies: on venues that block UDP 443, even Google’s fallback can fail, so having a manual override or a trusted VPN remains a good safety net.

FAQ