Android Private DNS Works on Mobile Data but Fails on Public Wi-Fi

A phone can browse on cellular data but shows no internet on public Wi-Fi while Private DNS is strict. The aim is to find the first failing boundary, compare it with a working case, and correct only what is necessary. Begin with a harmless reproduction before any reinstall, account reset or deletion.

Start with the actual failure

Write down the exact result and where the process stops. Check whether the public network requires a portal and compare DNS behavior before and after login. Keep the affected network and a working control as comparable as possible: same time, same connection or account when relevant, and the same small sample of content.

When a feature works in one context but not another, that contrast is stronger evidence than a generic error message. For this case, note the current version, the selected mode or account, and whether the problem started after a driver, app, game or system change. Do not change several settings simultaneously; otherwise a later success cannot be linked to one correction.

Three explanations to separate

Treat these as hypotheses rather than proof. Captive portal cannot be reached before authentication. This may create the visible symptom without indicating permanent damage. Network blocks encrypted DNS endpoint. A mismatch here can make otherwise healthy features appear unavailable. DNS provider temporarily unavailable. The third possibility is worth investigating only after the easier controlled tests are complete.

Safe checks in the right order

1. Preserve the working state: Record the original setting, version and account or device combination. Protect network passwords and router configuration before testing. Do not erase the existing data or configuration.
2. Reproduce with a minimal example: Check whether the public network requires a portal and compare DNS behavior before and after login.
3. Confirm the boundary: Test the same action where it is known to work, and document what changes. A control that fails identically points to a shared service or hardware dependency.
4. Check the first cause: Captive portal cannot be reached before authentication. Use the product UI to confirm this condition instead of relying on an assumption.
5. Check the second cause: Network blocks encrypted DNS endpoint. Look for the specific mismatch between failing and working runs.
6. Look for the third cause: DNS provider temporarily unavailable. Evaluate it only if initial controlled fixes have not restored function.
7. Apply the smallest correction: Complete the legitimate captive portal using the network's documented access flow; restore the preferred DNS mode afterwards.
8. Repeat without additional changes: Internet works after permitted portal login with intended Private DNS privacy restored.

First repair: restore the intended configuration

Complete the legitimate captive portal using the network's documented access flow; restore the preferred DNS mode afterwards. This is the preferred starting point because it tests a concrete explanation. After the change, completely exit and reopen the affected app or reconnect only the affected device if the product requires it. Leave unrelated settings, account details and systemwide security policy unchanged.

Observe the outcome under the same conditions used at the start. If behavior improves only once or only in an easier test case, the issue may be intermittent or partially repaired. Record that finding before declaring success. If there is no measurable improvement, return the modified setting to its earlier value and try the next documented route.

Fix path B: isolate the remaining component

Inspect whether the DNS-over-TLS server is reachable on that Wi-Fi without assuming a general internet outage. Use the result to decide whether the owner of the problem is the application, the operating system, an account entitlement, a peripheral, or an external service. Examine only logs or diagnostic screens you are authorized to access, and remove tokens, addresses and private identifiers before sending a report.

A helpful comparison changes one variable at a time: the same content on another device, another account with permission, a supported mode instead of a custom setting, or another network that you control. Choose the comparison relevant to the actual symptom; switching all of these simultaneously makes diagnosis weaker.

What counts as fixed?

Passing result: Internet works after permitted portal login with intended Private DNS privacy restored. Repeat the successful scenario once after a normal close/reopen or reconnect. Check a second unaffected feature, so the solution does not merely relocate the problem elsewhere. If the feature has an eligibility or hardware limit, correctly identifying that limit is a valid diagnostic outcome, not a defect that must be bypassed.

If the issue persists

Return to the original comparison: Check whether the public network requires a portal and compare DNS behavior before and after login. Then collect the current software and device versions, the exact error text if present, what worked in the control run and whether the change helped. Inspect whether the DNS-over-TLS server is reachable on that Wi-Fi without assuming a general internet outage. With these details, an official support team can reproduce the problem more reliably than from a request to “fix everything.”

Prevent a repeat and protect your data

Never enter credentials into a fake captive portal or disable device safeguards permanently. Retain a minimal record of the working version and setting, avoid unnecessary simultaneous updates, and retest the exact workflow after major supported upgrades. For managed equipment, ask the administrator before changing policy; for subscriptions or purchases, verify ownership through official account pages.