[rom1v]

> Private DNS on Android refers to 'DNS over HTTPS'

Yes, sorry, I did not mention it.

So if you want to use DNS over HTTPS on Android, it is not possible to provide a fallback.

[ignoramous]

> So if you want to use DNS over HTTPS on Android, it is not possible to provide a fallback.

Not true. If the (DoH) host has multiple A/AAAA records (multiple IPs), any decent DoH client would retry its requests over multiple or all of those IPs.

[lxgr]

Does Cloudflare offer any hostname that also resolves to a different organization’s resolver (which must also have a TLS certificate for the Cloudflare hostname or DoH clients won’t be able to connect)?

[ignoramous]

Usually, for plain old DNS, primary and secondary resolvers are from the same provider, serving from distinct IPs.

[lxgr]

Yes, but you were talking about DoH. I don’t know how that could plausibly work.

[ignoramous]

> but you were talking about DoH

DoH hosts can resolve to multiple IPs (and even different IPs for different clients)?

Also see TFA

  It's worth noting that DoH (DNS-over-HTTPS) traffic remained relatively stable as most DoH users use the domain cloudflare-dns.com, configured manually or through their browser, to access the public DNS resolver, rather than by IP address. DoH remained available and traffic was mostly unaffected as cloudflare-dns.com uses a different set of IP addresses.

[lxgr]

> DoH hosts can resolve to multiple IPs (and even different IPs for different clients)?

Yes, but not from a different organization. That was GPs point with

> So if you want to use DNS over HTTPS on Android, it is not possible to provide a fallback.

A cross-organizational fallback is not possible with DoH in many clients, but it is with plain old DNS.

> It's worth noting that DoH (DNS-over-HTTPS) traffic remained relatively stable as most DoH users use the domain cloudflare-dns.com

Yes, but that has nothing to do with failovers to an infrastructurally/operationally separate secondary server.