By default, Android will use the network assigned servers, trying to upgrade to an encrypted protocol if available. The owner of the device can configure a cust

By default, Android will use the network assigned servers, trying to upgrade to an encrypted protocol if available. The owner of the device can configure a custom Private DNS server (either DoH or DoT) which bypass local networks. This has been possible for a long time on Linux, Windows, Mac, iOS and Android. Network "security" based on blocking DNS queries is really snake oil. Always has been.