My Android VPN Was Connected, but Nothing Loaded—Private DNS Was the Missing Clue

Three minutes before a client call, my Android phone displayed every reassuring symbol: full hotel Wi-Fi, the small VPN key, and a green “connected” label inside the app. Gmail kept spinning. Slack said I was offline. The meeting link opened to a blank page. I assumed the hotel network had collapsed, disconnected from Wi-Fi, joined again, and changed the VPN location. Nothing improved except my understanding of how quickly three minutes can disappear.

The VPN seemed like the obvious culprit. That suspicion was not unreasonable: recent Android 16 reports have described VPN connections failing after an app updates in the background, sometimes requiring a restart or reinstall. (Google) I had updated several apps that morning, so I restarted the phone.

The VPN reconnected. The internet did not.

I turned the VPN off, expecting the hotel Wi-Fi to remain equally useless. Instead, the hotel sign-in page appeared immediately. News sites loaded. Gmail refreshed. The connection underneath was working; something changed only when the VPN tunnel came back.

That narrowed the problem considerably.

A VPN does more than send traffic through another network. It also usually tells Android which DNS resolver should translate names such as meet.google.com into numerical addresses. Android, however, has its own system-wide Private DNS setting. When that setting is fixed to a custom provider hostname, the phone may continue trying to reach that resolver even after a VPN connects. (Google)

Usually, that arrangement works quietly. Mine had worked for months at home. I had entered a filtering DNS provider to reduce advertising and tracking, then forgotten the setting existed.

The hotel network changed the equation. Android’s named Private DNS mode uses an encrypted DNS connection, normally over a dedicated network path. (IETF) If the hotel, carrier, firewall, or VPN route cannot reach that resolver correctly, the phone can appear connected while ordinary apps fail to find their destinations.

The result looks like a dead VPN, but it is often a disagreement over who controls DNS.

That explains the most confusing symptom: the VPN icon remains visible, yet websites and apps do not open. The tunnel may exist. The phone simply cannot convert the service names you type or tap into reachable addresses.

Public Android reports describe the same practical pattern. In one Tailscale issue, devices remained reachable by IP address after the VPN connected, but normal browsing stopped until Private DNS was returned to Automatic. Another Android user described receiving a Private DNS warning whenever joining public Wi-Fi. (GitHub) These reports did not prove what was happening on my phone, but they gave me a better test than cycling through another dozen VPN locations.

I opened Android Settings and searched for “Private DNS.” The screen offered three choices:

Off. Automatic. Private DNS provider hostname.

Mine was fixed to the third option.

I copied the hostname into a note so I could restore it later, selected Automatic, disconnected the VPN, and connected again. I did not permanently disable encrypted DNS. Android recommends leaving Private DNS enabled, and Automatic allowed the phone to use an available resolver instead of insisting on the custom one that this network could not reach. (Google)

Gmail refreshed immediately. The meeting page rendered. Slack delivered six messages at once.

The original “nothing loads” problem was solved, but the connection was not yet dependable enough for the call. The hotel Wi-Fi weakened every few minutes, and my established VPN provider struggled whenever the signal changed. The meeting opened, froze, and dropped back to reconnecting.

I still trusted that provider. It had a long public history, a large support operation, and more server locations than I could ever need. Under normal conditions, those are meaningful strengths.

They did not solve the problem in front of me.

I selected the closest server, then the automatic location, then another protocol. Each change required disconnecting, waiting, and testing the meeting page again. One route loaded quickly but lost the call. Another remained stuck on “connecting.” The long country list had become a collection of decisions I did not have time to make.

By then, my comparison standard had changed. I no longer needed the VPN with the most locations. I needed one route that could establish itself on an awkward hotel network and recover when Android moved between weak Wi-Fi and mobile data.

That was when I opened OnlydogVPN.

Instead of starting with a map, I chose a situation-based preset for an unstable or restrictive connection. There was no need to guess whether Germany, Singapore, Japan, or “fastest” would behave better from this particular hotel.

The connection established. I tapped the meeting link.

The waiting screen appeared, followed by the client’s camera and the document I was supposed to present. I joined late, but I joined. When I shared the file, the upload completed rather than restarting halfway through.

Only after the immediate problem was over did the technology become relevant. The service uses HTTP/3-based transport, which is built on QUIC. Unlike older connections that can be tightly bound to one network path, QUIC is designed to continue across certain address and path changes. (IETF) That made it well suited to the next thing my phone did.

Halfway through the presentation, the hotel Wi-Fi signal fell away and Android switched to mobile data. The client’s voice clipped for a moment. The meeting remained connected.

That transition mattered more to me than a laboratory speed score. The network was not fast or clean; it was inconsistent. The useful quality was recovery.

I could observe the connection results, page loads, upload, and network handoff, but I could not inspect the provider’s internal filtering or traffic-classification rules. What I could verify was simpler: on the network in front of me, the meeting remained usable after the larger service had repeatedly lost it.

The smaller app does have a real limitation. It offers fewer server locations than a major provider. Someone who needs a particular exit country for a specific service may prefer the larger list.

But that was not the task I had opened the phone to complete. I needed to join one call from one unstable network within a few minutes. More flags in a server menu did not improve that outcome.

After the meeting, I restored the custom Private DNS hostname to confirm that I had not mistaken coincidence for a diagnosis. Browsing failed again when the VPN connected. I returned Private DNS to Automatic, reconnected, and the phone worked normally.

That final check separated two different problems.

The Android setting had caused the “VPN connected, but nothing loads” failure. Changing Private DNS to Automatic restored name resolution. The second problem was connection stability, and the smaller service handled that part more effectively by reducing the setup decisions and surviving the switch away from hotel Wi-Fi.

This is why repeatedly changing VPN servers can waste time during a Private DNS conflict. If Android is still forcing queries toward an unreachable custom resolver, the country selected inside the VPN app may not matter. The first useful test is outside the VPN app:

Open Settings, search for Private DNS, save the existing provider hostname, and temporarily change the setting to Automatic. Then reconnect the VPN and test the page again.

On a work-managed phone, the setting may be controlled by an administrator. In that case, changing corporate DNS policies yourself is not the answer. But on a personal Android device, this small check can quickly reveal whether the VPN is truly failing or merely being blamed for a resolver conflict.

The established provider remained the larger and more familiar service. It also demanded more trial and error once the hotel connection began fluctuating. The smaller app had fewer locations, but its task-based setup reached the meeting faster and its connection survived the network change.

For this Android problem, a coherent DNS path came first. After that, recovery mattered more than server count—because a VPN is not useful merely when its icon says connected, but when the call on the other side stays connected too.