DNS-over-HTTP/3 in Android

security.googleblog.com

8 points·codewiz··4 comments

>Some Android 10 devices which adopted Google Play system updates early will also receive this feature.

DNSResolver was made a modular system component in Android 10, but as for why DNS-over-HTTP/3 will only be supported on "some Android 10 devices", it's because the APEX module was only optional at the time. DNSResolver became a mandatory APEX module to ship for GMS devices upgrading to or launching with Android 11.

I believe you can check if support for DNS-over-HTTP/3 has rolled out for your device through this shell command:

adb shell cmd device_config get netd_native doh

There's a duplicate of this post with more comments: https://news.ycombinator.com/item?id=32163757#32164763

I don't understand how it was posted, since the url is identical to the one in this post.

If your network has DoH3 set up, will Android use it? The fear is that this dodges all the network configurations.

By default, Android will use the network assigned servers, trying to upgrade to an encrypted protocol if available. The owner of the device can configure a custom Private DNS server (either DoH or DoT) which bypass local networks.

This has been possible for a long time on Linux, Windows, Mac, iOS and Android. Network "security" based on blocking DNS queries is really snake oil. Always has been.

Reply on news.ycombinator.com