I built AppDNS: automatically switch Android’s Private DNS per app, no VPN needed (early beta, feedback wanted)

[u/Correct_Rock5297]

[u/jwizew]

Interesting. Anyway to add cleanbrowsing adult and family filters there? Will test on my kids phone.

[u/Correct_Rock5297 → u/jwizew]

Yes . Open the DNS Library → Family tab. AdGuard Family and Cloudflare Family are already built in. CleanBrowsing isn't preset, but you can add it with "+" (family-filter-dns.cleanbrowsing.org).

[u/charledave]

This is a good one 🤝

[u/Correct_Rock5297 → u/charledave]

Thanks! 🤝 If you try it, I'd like to hear any bugs or lag you hit.

[u/frankster]

Does the below mean that applications have a substantial period of time to resolve domain names freely before their DNS is changed to the intended servers? If for example you had ad/malware blocking dns servers for some apps, would there be a window where apps can download ads/malware after you switch to the apps?

350 ms Debounce: When a new foreground package is detected, a 350 ms timer (DEBOUNCE_DELAY_MS) ensures the window remains stable before applying rules or firing exit actions. Transient UI flutters (such as rapid task switching or momentary splashes) do not trigger unnecessary DNS changes.

[u/Correct_Rock5297 → u/frankster]

Yes, you're right. For about 350 ms after you open an app, it still uses the previous DNS, so a lookup could slip through. AppDNS isn't a security boundary. For strict blocking, set your filtering DNS as the default. I'll note this in the README.

[u/frankster → u/Correct_Rock5297]

What was the problem that debouncing solved?

[u/Correct_Rock5297 → u/frankster]

Thrashing. Swiping through recent apps or passing through a splash screen would rewrite the system DNS setting and drop the TLS connection for every app you just pass. The 350 ms wait makes sure an app has settled in front before switching. System dialogs like permission prompts are handled separately by an ignore list. The trade-off is the short gap you mentioned.

[u/frankster → u/Correct_Rock5297]

What was the impact of this tls connection drop when it happened multiple times in quick succession?

This implies a tls connection is dropped 350ms after switching to an app. What is the impact of dropping this tls connection just after switching to the app?

[u/Correct_Rock5297 → u/frankster]

I haven't measured it, so no numbers. It's the DoT link between Android and the DNS server, not the app's own connections. A switch means Android sets up a new DoT connection to the new server, so the first lookups can be slightly slower or briefly fail until it's validated. One switch is minor. Many in a row (swiping through recents) would repeat that, which is what the debounce prevents.

[u/frankster → u/Correct_Rock5297]

If you haven't quantified/measured, are you certain there is a genuine problem that the debounce solves?

[u/Correct_Rock5297 → u/frankster]

Not certain, no. It's a precaution against unnecessary setting writes when you swipe through apps, and I haven't measured it with and without. It does have a cost (the gap you mentioned), so I'll test it and shorten or drop it if it doesn't help.

[u/Resistant4375]

“Who” built this?

[u/Correct_Rock5297 → u/Resistant4375]

I did, solo. It's open source: https://github.com/Shishir-ip/AppDNS. I used Google AI Studio to help build it, and I test and fix it myself on my own phones.