An Android Police Pixel case study explains why Private DNS providers can behave differently on the same public Wi-Fi. Ordinary custom hostnames use DNS-over-TLS on TCP 853, while certain designated Google and Cloudflare hostnames have an HTTP/3 path on UDP 443. Strict mode does not fall back to plain DNS after failure; Automatic mode’s plaintext fallback trades off privacy and filtering. Apps with their own encrypted DNS are an alternative but occupy Android’s VPN slot, and networks blocking UDP 443 impose further limits. This is an analysis of existing behavior, not a newly announced feature.