AeroDNS: choose the resolver, keep the boundary

Unless you have set Private DNS or another resolver on your Android phone, the resolver answering DNS queries is whatever the current network handed out. Changing that raises a narrow question: can you choose the resolver on purpose, and know what changed when you did?

A DNS changer, and only that

AeroDNS is a lightweight open-source DNS changer for Android from VMCSoft Digital, published on Google Play under the developer name VMCSOFT. You pick a built-in resolver profile or configure your own, over standard DNS or DNS-over-HTTPS, and connect with one tap or a Quick Settings tile. A parallel DNS latency test lets you compare resolver response times before you commit to one.

The mechanism is the part worth understanding. AeroDNS uses Android’s VPN API only to apply DNS routing. Because it holds the VPN permission, Android treats the connection as a VPN and may show its VPN indicator, but ordinary browsing, streaming and downloads stay on the underlying network and do not pass through a VMCSoft server. The indicator shows that a local VPN interface is active, not that all traffic is tunnelled. The official app has no accounts, ads or analytics SDK, and no VMCSoft backend that could log queries. Android and Google Play may still gather platform diagnostics under your own device settings, which is separate from anything the app does.

Where the queries still go

Choosing a resolver moves trust; it does not remove it. The resolver you select sees every query you send it. On standard DNS, the network in between can see them too. DNS-over-HTTPS encrypts the path to the resolver, which protects transport, not the resolver’s own view. Apps that run their own DNS can step around Android’s selected resolver. The latency test samples DNS response time and nothing else. A quicker resolver can shorten name lookups when a connection starts, but the sample does not establish lower in-game ping, higher throughput or a general connection boost. AeroDNS is not a full-tunnel VPN or an anonymity service, and it does not promise access to anything a network blocks. It changes which resolver answers DNS, and only that.

The source is on GitHub under the Apache 2.0 license, so anyone can check how the routing works against code rather than against a store description. That is inspectability, not a security certification. The main branch can also run ahead of the version your device receives, so read the repository for the current architecture and documentation rather than as a list of what is installed. Its privacy terms cover official builds; a third-party fork can behave differently.

Picking one on purpose

If the resolver on your phone has never been a decision, make it one. Read the provider’s policy, choose the protocol, run the latency test, and treat the VPN indicator as a reminder of what is routed and what is not. The privacy policy describes the data flow in full, and the Play listing is the maintained release.