dnsetter
Two settings that are each correct and cannot both be on. This one decides, automatically.
dnsetter is being built, and there is a beta you can install today. The code is private while it is written; what follows is what the app does now, not what it will do.
The beta is on the self-hosted F-Droid repository that serves every app
here. Add https://releases.android.apps.gpm.name/repo to F-Droid and dnsetter
appears in it. It is deliberately not the suggested version: F-Droid will not install it
unless you go and pick it.
Why a beta. The collision this app exists for is documented nowhere by Google. It is a first-hand observation on one phone with one tunnel — Tailscale on a Pixel 10 Pro Fold — and this build has not yet been run against any other. It does what it claims on a workstation; whether it does on your phone is exactly what the beta is for.
It needs one permission that no dialog can grant, given once from a shell. The app's first screen is that setup, and until the permission lands dnsetter shows you what is happening and changes nothing.
When it ships it will also be on Google Play — two builds, signed by different keys, so Android treats them as separate apps and moving between them means uninstalling first.
What is free, and what Pro is
The part dnsetter exists for is free and stays free: Private DNS goes off when a VPN comes up and your setting comes back exactly when it goes away, on every tunnel, with the manual override and the Quick Settings tile beside it. A utility whose one job is behind a paywall does not get installed twice.
dnsetter Pro is a rule per VPN app beyond the first, and — when they are built — a resolver other than off while the tunnel is up, and the home-screen widget. Nothing that works today moves behind it: a feature an install was already using stays with it for good.
The build in the F-Droid repository has no paywall in it at all — there is no way to buy anything in a build distributed outside a store, so nothing is withheld there. What it asks instead is a donation, once a week, on a notification you can silence in two taps; silencing it takes nothing away, because nothing was held back.
Who paid for it, and how to be on that list, is its own page.