Android users running custom DNS configurations experienced connectivity failures when Let's Encrypt's legacy root certificate expired. Devices using Private DNS with services like AdGuard or Pi-hole encountered validation errors after the certificate transition, according to the Infinum Android Sweets newsletter. While the change was documented, the incident reveals how certificate infrastructure updates create uneven consequences across different DNS setups.
What happened
Let's Encrypt retired its DST Root CA X3 certificate, replacing it with ISRG Root X1 as the primary trust anchor. Most systems processed this transition without incident. However, Private DNS on Android—which encrypts queries between device and resolver using TLS—exposed a vulnerability in how some custom resolvers validated the new certificate chain.
Services handling DNS filtering, including AdGuard and Pi-hole, sat in the middle of this change. Their upstream TLS connections to certificate authorities required updates to properly authenticate the new trust chain. When those updates lagged, users lost DNS resolution entirely.
Who was affected
Hardest hit:
- Pi-hole installations with TLS upstream forwarding
- AdGuard DNS configurations on Android
- Custom DNS apps relying on system-level Private DNS
- Users of older DNS appliance firmware
Generally unaffected:
- Standard Private DNS with Google (8.8.8.8) or Cloudflare (1.1.1.1)
- Configurations using DNS-over-HTTPS instead of DNS-over-TLS
- Basic resolver setups without TLS requirements
Solutions and workarounds
For most users:
Updating DNS resolver software resolves certificate validation issues. Pi-hole, AdGuard, and similar tools released patches addressing the trust chain change. Checking for firmware updates on DNS appliances ensures the latest certificate bundles are present.
As a temporary measure:
Switching to a resolver that already handles the new Let's Encrypt chain or temporarily using a non-TLS upstream can restore connectivity while waiting for updates.
Why this matters
Certificate infrastructure changes rarely receive mainstream attention, yet they expose a fundamental trade-off in network architecture: custom configurations offer control but introduce fragility that defaults avoid.
Users running custom DNS chose granular filtering, privacy logging, or network-wide blocking. That flexibility came with maintenance responsibility. When standard configurations auto-updated, custom setups required deliberate attention—which not everyone realized they needed to provide.
The practical loser here is the advanced user who invested in custom infrastructure. The winner is the casual user who stuck with defaults. This asymmetry deserves acknowledgment: "just use defaults" is easy advice to give until you need what only custom configurations provide.
Practical guidance
- Maintain awareness of certificate changes affecting your resolvers by subscribing to update notifications from DNS software providers.
- Test custom DNS configurations periodically, not just at setup. Problems surface long after initial configuration.
- Document your setup thoroughly. Certificate issues can manifest months later, and clear records accelerate diagnosis.
What to watch
DNS-over-TLS and DNS-over-HTTPS adoption continues growing. More devices now depend on TLS certificate validation for DNS—meaning certificate infrastructure changes will affect a broader user base going forward. The next similar event may create wider disruption as custom DNS usage expands.
Monitor your DNS software for updates and verify configurations after major certificate transitions. Build this into your maintenance routine rather than treating it as exceptional.
Key takeaways
- Let's Encrypt's certificate transition disrupted Android Private DNS for users with custom resolvers
- Pi-hole and AdGuard users with TLS forwarding were particularly affected
- Updating resolver software resolves most validation problems
- Standard Public DNS services avoid custom configuration complexity and maintenance burden
- Custom DNS users must actively monitor certificate infrastructure changes
Frequently asked questions
How do I check if my Android device uses Private DNS?
Navigate to Settings > Network & Internet > DNS settings and look for the Private DNS provider field. If it shows a hostname rather than "Off," your device is using encrypted DNS.
Should I use a custom DNS resolver or stick with defaults?
Defaults (Google, Cloudflare) offer reliability and automatic maintenance. Custom resolvers provide filtering and logging control but require active upkeep. Choose based on whether you need advanced features badly enough to handle troubleshooting.
What is DNS-over-TLS?
DNS-over-TLS (DoT) encrypts DNS queries using the TLS protocol, preventing network observers from seeing which domains you request.
How can I prevent this from happening again?
Enable automatic updates for your DNS software, check for firmware updates on DNS appliances periodically, and maintain documentation of your configuration for faster troubleshooting when issues arise.