I’m glad ProtonVPN iOS now supports custom DNS (as mentioned in the original post), but the fact it currently only supports plaintext UDP DNS introduces several real risks. Below are what I see as the drawbacks, followed by clear feature-requests that I hope Proton will prioritize.

Negative Consequences of Not Supporting Encrypted DNS (DoH / DoQ)

Exit-node exposure
DNS queries from Proton’s VPN server to the resolver remain unencrypted. That means the VPN host’s ISP or any network between Proton’s server and the DNS resolver can see which domains users are querying.

Vulnerability to DNS manipulation or hijacking
Plaintext DNS is susceptible to MitM attacks: bad actors could intercept or modify DNS responses on that hop, redirecting users to malicious sites or injecting tracking.

Metadata leakage & profiling
Even when content is encrypted and tunneled, unencrypted DNS reveals browsing patterns. Observers could see which domains you visited (or at least requested), undermining user privacy.

Susceptibility to DNS-based attacks
Without integrity checks or encryption, DNS cache poisoning or spoofed responses become easier for adversaries on that plaintext path.

Trust gap
Users choosing Proton expect “privacy by default.” The absence of end-to-end encrypted DNS for custom resolvers creates a discrepancy between Proton’s privacy marketing and its technical exposure.

Clear & Specific Asks (in response to “Add DoH and DNS-over-QUIC Support for Custom DNS on iOS”)

Support DNS-over-HTTPS (DoH, RFC 8484)
Allow users to enter a DoH endpoint (URL or IP + path) as their custom DNS, with DNS-over-HTTPS traffic tunneled securely.

Support DNS-over-QUIC (DoQ, RFC 9250)
As a next-generation encrypted DNS protocol optimized for performance, DoQ support ensures minimal latency and full confidentiality.

Allow mixed IPv4 / IPv6
Accept both IPv4 and IPv6 custom DNS addresses (or DoH/DoQ endpoints), without forcing users to pick IPv4 only.

Tunneled + end-to-end encrypted DNS
Ensure that when DoH/DoQ is selected, DNS queries are sent through the VPN tunnel and remain encrypted all the way to the resolver.

Backward compatibility / fallback
If a custom encrypted resolver fails, Proton should fall back to its default DNS (or prompt the user), while warning that plaintext DNS is less secure.

Expose diagnostics / logs
In debug mode (or with opt-in), show whether DNS is currently encrypted, which resolver is being used, and whether any fallback to plaintext occurred.

By listing these pain points and concrete asks, I hope more Proton users will find this thread, vote it up, and help push this feature up the roadmap. If Proton implements this, it makes the “custom DNS” feature genuinely privacy-first.

Fortunately, local DNS entries for custom DNS are possible in the Linux client. Why isn’t this possible in the Android client? In addition to the ability to add local DNS, support for DoT and DoH DNS addresses would be welcome as a feature.

For the love of God, can this be implemented please?

It seems odd that Proton VPN would only be limited to ipv4-based DNS resolvers when a lot of other lesser VPNs support proper Custom DNS.

It's critical without a doubt. Not only does it limit us to primarily public DNS resolvers, it also limits us to only have unencrypted traffic, unless we use netshield. You can either implement DoT and DoH, or let us use system DNS (I refer to windows custom DNS, android custom dns config, iPhone .mobileconfig file, etc. ) I have to tear myself between using proton VPN and AdGuard DNS that supports DOH and DOT, but instead I have to use their public DNS, which is not bad, but I miss out on all logging for my DNS and precise ad blockers that I select myself, instead of AdGuard.) That is just an example of it being used with your vpn, but instead we have to rely on public ipv4 that doesn't provide the authentication that we need to truly stay anonymous online. Using your netshield shouldn't be the only option to secure our DNS traffic. Make it compatible with AdGuard-dns.io, as it covers all basis of possible connections to their server. But paying for reserving an ip shouldn't be the only option.

I whole heartedly agree!

I agree. In the name of privacy, it just make sense to extend custom DNS support to support encrypted DNS (DoH, DoT, etc) entries too rather than just IPv4 addresses that only support unencrypted DNS queries.

This would be a great feature for Proton.