How to Inspect DNS Resolvers and Private DNS over TLS on Android Using ADB dumpsys dnsresolver

In modern Android architecture (Android 10 and newer), DNS resolution is decoupled from the monolithic netd daemon and managed as an updatable Project Mainline APEX module: com.android.resolv. This architecture governs system-wide name lookups, DNS over TLS (Private DNS / DoT), server reachability probes, caching tables, and per-network fallback logic. For network engineers, mobile security analysts, and developers diagnosing application connectivity issues or encrypted DNS leaks, Android Debug Bridge (ADB) provides deep operational visibility into the resolver engine through dumpsys dnsresolver.

Architecture of the Android DNS Resolver Module

The DNS Resolver module functions at the boundary between application socket calls (e.g., getaddrinfo, res_nquery) and remote name servers:

• Private DNS Controller: Implements RFC 7858 (DNS over TLS) on port 853. It maintains TLS sessions, performs server certificate validation, tracks TLS handshake metrics, and negotiates fallback when in Opportunistic mode.
• Resolver Cache Engine: Stores positive and negative DNS query results with Time-to-Live (TTL) enforcement per network interface (e.g., wlan0, rmnet_data0).
• Server Health Monitor: Tracks round-trip query latencies, timeout frequencies, and transport error rates across all configured upstream name servers.

Querying the DNS Resolver via ADB

Connect your Android device with USB or Wi-Fi debugging enabled and authorize the connection via adb devices. To dump the complete state of the resolver subsystem, run:

adb shell dumpsys dnsresolver

The output returns structured sections detailing active networks, private DNS status, configured resolvers, cache capacity, and cumulative lookup metrics.

Analysing Key Sections of the dnsresolver Dump

1. Private DNS Configuration and TLS State

Inspect the Private DNS block to verify whether encrypted DNS over TLS is actively protecting host lookups:

Private DNS configuration:
  Mode: STRICT (hostname: dns.google)
  Server validation:
    100 (wlan0):
      dns.google: TLS connected, validation: SUCCESS, rtt: 18ms
    101 (rmnet0):
      dns.google: TLS connected, validation: SUCCESS, rtt: 34ms

The Mode line confirms the system setting:

• OFF: Lookups use plain unencrypted UDP/TCP port 53 assigned by DHCP or cellular network.
• OPPORTUNISTIC: Android attempts DoT on port 853 if the local server supports it, falling back to plaintext if unreachable.
• STRICT: All DNS queries are strictly forwarded over encrypted TLS to the user-specified provider hostname (e.g., one.one.one.one). Queries fail if TLS cannot be established.

2. Active Network Resolver Parameters

The dump details server addresses, search domains, and parameters per network ID (NetId):

NetId: 100
  DnsServer: [8.8.8.8, 8.8.4.4]
  SearchDomains: [lan]
  Params:
    sample_validity: 1800s
    success_threshold: 80%
    min_samples: 8
    max_samples: 64

These sampling parameters dictate when Android considers a DNS server unresponsive and switches to an alternate secondary server.

3. Resolver Cache Performance

The cache statistics reveal whether name resolution bottlenecks stem from frequent external queries or cache evictions:

Cache stats for NetId 100:
  Capacity: 500
  Active entries: 62
  Queries handled: 1420
  Cache hits: 980 (69.0%)
  Cache misses: 440

Filtering and Monitoring Resolver Telemetry

To extract specific operational parameters during testing, use pipe filters with grep:

# Check Private DNS TLS handshake status
adb shell dumpsys dnsresolver | grep -A 5 -i "private dns"

# Verify active server addresses and NetIds
adb shell dumpsys dnsresolver | grep -E "NetId|DnsServer"

# Review resolver cache hit rates
adb shell dumpsys dnsresolver | grep -A 4 -i "cache stats"

Flushing the DNS Cache via ADB

During mobile application testing or API staging migrations, cached DNS records can prevent immediate connection to newly updated IP addresses. You can flush the resolver cache on Android using cmd:

adb shell cmd dnsresolver flush 

Example: To flush cache on active network ID 100: adb shell cmd dnsresolver flush 100.

Utilising dumpsys dnsresolver gives technical teams definitive, low-level insight into Android DNS queries, enabling rapid identification of DNS leaks, TLS handshake failures, and transport latency issues across Wi-Fi and mobile networks.