[WarOnPrivacy]

> you can't override a DoH DNS server when connecting to a VPN which offers internal DNS on Android, for instance.

True. I set my VPN server to force DNS thru the tunnel to an intercepting DNS server - and it replies as if it were the intended DNS server.

DNS server is setup this way in response to LAN devices that have their own DNS configured, but it handles Android's private DNS too.