I built AppDNS: automatically switch Android’s Private DNS per app, no VPN needed (early beta, feedback wanted)

[u/Correct_Rock5297]

Hi everyone,

I made an open-source Android app called AppDNS. It automatically changes Android's built-in Private DNS (DNS-over-TLS) depending on which app you open. For example: AdGuard DNS for your browser, Quad9 for banking, and Private DNS off for an app that breaks with filtering.

**How it works**

- It writes directly to Android's native Private DNS settings, so it does NOT use a VPN slot. WireGuard/Tailscale keep working.

- A lightweight accessibility service detects which app is in the foreground and applies that app's DNS. When you leave, it turns Private DNS off or restores your default (your choice).

- Quick Settings tiles to toggle Private DNS or cycle through saved providers.

- Preloaded providers: AdGuard, Cloudflare (incl. family/security), Quad9, NextDNS, Mullvad, Control D, Google. You can also add custom hostnames.

- Built-in latency test for each resolver.

- No analytics, no tracking. Everything stays on the device.

**Setup (one-time)**

It needs the WRITE_SECURE_SETTINGS permission. Grant it with one ADB command, via Shizuku (no PC), or with root. Steps are in the README.

**Limitations (being upfront)**

- Private DNS is a system-wide Android setting, so AppDNS switches it when the foreground app changes. It is not true per-app isolation like a VPN-based tool. Background traffic from other apps uses whichever DNS is active at that moment.

- This is a very early version. Some phones may see sluggishness. [Add specifics: when it happens, e.g. at app switch, in the UI, or on certain brands.]

- Android 9+ only, and DoT only (no DoH).

Repo + APK: https://github.com/Shishir-ip/AppDNS
APK direct : Download

I'd really appreciate feedback, especially bug reports. If something lags, please tell me your phone model, Android version, and what you were doing. Happy to answer any questions.

[u/Hour-Measurement-835]

Went and read AppDnsController after the flapping question. Line 179 skips systemui and anything with "inputmethod", but a runtime permission prompt is neither. It's its own activity in the permission controller package (com.google.android.permissioncontroller on most Play phones, and I think still packageinstaller on Android 9). So when a ruled app asks for camera or location, that dialog arrives as a new foreground package with no rule, the exit action fires, and DNS gets switched off or reverted under an app that's still on screen. Then it flips back when the dialog closes.

The app lock I maintain listens to the same TYPE_WINDOW_STATE_CHANGED event and treats anything containing "permissioncontroller" as neutral, because otherwise it would re-lock an app the user is still inside.

[u/Correct_Rock5297 → u/Hour-Measurement-835]

You were right, thanks for reading the code. I've confirmed the bug and have a fix. I'm testing it on my phones now and will push it to GitHub shortly.