diff --git a/app/src/main/java/org/torproject/android/util/NetworkUtils.kt b/app/src/main/java/org/torproject/android/util/NetworkUtils.kt
index 10bf2f795..f867aaaec 100644
--- a/app/src/main/java/org/torproject/android/util/NetworkUtils.kt
+++ b/app/src/main/java/org/torproject/android/util/NetworkUtils.kt
@@ -3,6 +3,8 @@ package org.torproject.android.util
 import android.content.Context
 import android.net.ConnectivityManager
 import android.net.NetworkCapabilities
+import android.os.Build
+import android.provider.Settings
 import java.net.InetSocketAddress
 import java.net.Socket
 
@@ -21,6 +23,42 @@ object NetworkUtils {
         }
     }
 
+
+    sealed class PrivateDns {
+        object Off : PrivateDns()
+        object Opportunistic : PrivateDns()
+        data class Strict(val hostname: String) : PrivateDns()
+        companion object {
+            const val KEY_MODE = "private_dns_mode"
+            const val KEY_HOSTNAME = "private_dns_specifier"
+            const val HOSTNAME_UNKNOWN = ""
+            const val MODE_OFF = "off"
+            const val MODE_HOSTNAME = "hostname"
+            const val MODE_AUTOMATIC = "automatic"
+            fun isPrivateDnsSupported(): Boolean = Build.VERSION.SDK_INT >= Build.VERSION_CODES.P
+        }
+    }
+
+    fun getPrivateDnsConfiguration(context: Context): PrivateDns {
+        if (!PrivateDns.isPrivateDnsSupported()) return PrivateDns.Off
+        val dnsMode =
+            Settings.Secure.getString(context.contentResolver, PrivateDns.KEY_MODE)
+                ?: PrivateDns.MODE_OFF
+        when (dnsMode) {
+            PrivateDns.MODE_OFF -> return PrivateDns.Off
+            PrivateDns.MODE_AUTOMATIC -> return PrivateDns.Opportunistic
+            PrivateDns.MODE_HOSTNAME -> {
+                val hostname = Settings.Secure.getString(
+                    context.contentResolver,
+                    PrivateDns.KEY_HOSTNAME
+                )
+                    ?: PrivateDns.HOSTNAME_UNKNOWN
+                return PrivateDns.Strict(hostname)
+            }
+        }
+        return PrivateDns.Off
+    }
+
     fun checkPortOrAuto(portString: String): String {
         if (!portString.equals("auto", ignoreCase = true)) {
             var isPortUsed = true