Sugestion: More customisability for DNS like on most other devices.

AgeOfStereo

Recently I learned that Graphene OS docent improve on the custom DNS sever you can configure in the settings compared to stock android. There's still only 3 options. no custom DNS, an automatically configured one, and one manually configured one. This is pretty limited. On my windows desktop I can configure multiple DNS sever and request encryption be mandatory or optional. Same goes for my Linux based steam deck while in the KDE plasma desktop. Even apple devices allow multiple custom DNS. So why is android and therefore Graphene OS so limited? Frankly its silly that android is like this, but until its changed, can you add more options for custom DNS into Graphene?

de0u

AgeOfStereo Frankly its silly that android is like this, but until its changed, can you add more options for custom DNS into Graphene?

GrapheneOS is an AOSP fork that is focused on security and privacy. Compared to the base AOSP, many changes could be made, and indeed some AOSP forks focus on UI changes, supporting multiple system fonts, etc. But any project has limited resources, so working on something probably means not working on something else. Is it possible to make a case that specific additional DNS options would improve security and/or privacy compared to the existing situation?

One issue is that if GrapheneOS makes changes to DNS configuration options and Google later makes changes in that area then that can cause a lot of work for the GrapheneOS team. Other AOSP forks don't track AOSP as fast as GrapheneOS does, because GrapheneOS stays very up-to-date with security patches. That places a lot of pressure on the team to merge AOSP releases in quickly. Other AOSP forks often lag behind Google for weeks or months, which means there is more time to integrate upstream changes to a feature (such as DNS configuration) with local changes. As a result, many changes that could, in a general sense, be made are likely not to be invested in by the GrapheneOS project unless a clear security case can be made, or unless a clear privacy case can be made.

So... maybe the current situation is silly, and clearly changes are possible. But the project might not decide that developing and testing and maintaining those changes is currently worthwhile compared to other things.

Please note that I don't speak for the GrapheneOS project.

AgeOfStereo

Make sence. Just something that was in my mind. I kanda figured out how to do it though.

redfoxjumper

If you don't mind using a VPN slot, you can achieve the same thing with something like rethink app.

Chipper

Yeah i 2nd the vpn, I cant speak to any other than proton, but as having dns requests occur outside of the tunnel undermines the purpose of a vpn, proton addressess this when you install the app.

From Proton support

All our apps implement DNS leak protection, using firewall rules and other platform-specific techniques to ensure no internet traffic – including DNS queries – can enter or exit your device outside the VPN interface.

However, there are a limited number of circumstances where DNS queries might be routed outside the VPN tunnel.

Third-party DNS services
Manually configuring your device’s global DNS settings to use a third-party DNS service, such as Google Public DNS, Cloudflare, or OpenNIC, increases the chance of something going wrong, as it is possible the custom settings will override our DNS leak prevention measures.

Also Gos fast tracked fixing dns leaks (occuring within certain vpn clients (including protons)) discovered by A user here @ryrona (I think it was them but name was ryrona9 at the time so unsure) and whether those fixes have been implemented by aosp im not sure so there is a good chance gos actually has a more secure implementation inspite of sharing the same options as aosp for configuration.