What is Android's Private DNS (DNS-over-TLS) feature and how does it differ from using a VPN for DNS privacy?

• A.A) Private DNS (Settings > Network > Private DNS) configures the device to use DoT (DNS over TLS, port 853) for all network interfaces; unlike a VPN, it only encrypts DNS queries and does not tunnel other traffic, meaning app data flows without VPN overhead while DNS is protected from on-path eavesdropping.
• B.B) Private DNS encrypts all mobile traffic including app data using TLS; it functions identically to a VPN but is built into the OS.
• C.C) Private DNS is iOS-only; Android uses a different feature called "Secure DNS" that only applies to the Chrome browser.
• D.D) Private DNS forces all traffic through Google's DNS servers, which logs queries for advertising purposes, reducing privacy compared to a standard VPN.