dnsetter

Private DNS and a VPN cannot both win.

Android's Private DNS is a system-wide setting. A VPN that carries its own names - an office tunnel, a home network, anything with private hostnames - needs the phone to ask the tunnel's resolver. Private DNS says ask mine instead. One of them loses, and Android gives you no way to decide which, per tunnel, by hand.

dnsetter decides it. It watches for a VPN coming up, switches Private DNS while the tunnel is there, and puts back exactly what you had when it goes away.

ONE PERMISSION, GRANTED ONCE
Changing Private DNS is a system setting, and Android only lets an app touch it with a permission that no dialog can grant. You give it from a shell, once: from a computer with ADB, from the phone alone over wireless debugging, or through Shizuku. It survives reboots and app updates. Nothing here needs root and dnsetter never asks for it. Until you grant it, the app shows you what is happening and changes nothing.

WHAT IT DOES
- Watches for a VPN, and switches Private DNS when one comes up
- Puts back what you had, exactly, when the tunnel goes away
- A rule per VPN app, because not every VPN needs this: one with its own public resolver is perfectly happy alongside Private DNS, and one with its own names is not
- Keeps your list of Private DNS providers, so choosing one writes it as your setting
- A manual override, for when you want to do it yourself and have it remembered

WHAT IT DOES NOT DO
There is no account, and nothing about your DNS, your VPN, your rules or your settings ever leaves the phone. dnsetter reads the state of your connection and writes one system setting - that is the whole of the job.

The app does ask for internet access, and uses it for one thing: the report screen in the Info tab, where you can write in and read the answers. Nothing is sent in the background, and nothing at all is sent unless you type it and press send.

THE NOTIFICATION
While it is armed there is a permanent notification, because a foreground service is the only way Android lets an app hear that a VPN appeared. It is at minimum importance: silent, folded at the bottom of the shade, and with no icon in the status bar.