Private DNS on Android-Device

[Nordlicht-13]

I set up Adguard Home, following the guide in the Adguard-Blog:
https://adguard.com/en/blog/adguard-home-on-public-server.html
Adguard is working except one last thing I can't get working.
I wanted to use encrypted DNS natively on my Pixel like this:

1. Head to Settings → Network → Advanced → Private DNS
2. Here’s one trick I’d like to focus on. Instead of just entering your domain name,
   come up with some subdomain, i.e. instead of example.org, enter
   myandroid.example.org (that’s why we obtained a wildcard certificate).
   This way AdGuard Home will be able to identify that device.

But it's not working, I get the message:
Network has no Internet access
The private DNS server cannot be accessed.

The DNS-entry for this is at cloudflare.
Did anybody get this working?

[Nordlicht-13]

Adguard is using Port 53 and not 853 like set up under the Encryption settings.

Could this be the problem?

[schzhn]

Some recommendations.

Test DoT from outside your network:

dig +tls @myagh.test example.com

If this fails, Android’s Private DNS over DoT will fail too.

To verify the TLS handshake and hostname:

openssl s_client -connect myagh.test:853

Confirm AdGuard Home is listening on port and the firewall is open

Also if you are using Cloudflare proxy. The "orange cloud" doesn't proxy port 853.

[Nordlicht-13]

Thanks for the aswer with the hints.
Can you please point me in the right direction.
What stands the myagh.test for?

I have adguard home runnig on adguard.mydomain.com
That's what I added under the Encryption settings for the server-name.

In the Cloudflare-Dashboard I added a CNAME for *.adguard pointing to adguard.mydomain.com
and a A-Record adguad pointing to <Tailnet-IP (Headscale) from TueNAS with ngnix-PM>

I can reach my Adguard-Web-UI, but

dig +tls @adguard.mydomain mydomain.com

give me the following answer:

;; Connection to 100.64.0.1#853(100.64.0.1) for mydomain.com failed: host unreachable.
;; no servers could be reached

100.64.0.1 is the Tailnet-IP from the TrueNAS.

When I change the A-Record to the Adguard-Tailnet-IP and disable the ngnix-Proxy-Host for adguard.mydomain.com,
I get for dig +tls @adguard.mydomain mydomain.com

; <<>> DiG 9.18.28-1~deb12u2-Debian <<>> +tls @adguard.mydomain.com mydomain.com
; (1 server found)
;; global options: +cmd
;; Got answer:

...

;; Query time: 52 msec
;; SERVER: 100.64.0.9#853(adguard.mydomain.com) (TLS)
;; WHEN: Wed Oct 15 12:00:50 CEST 2025
;; MSG SIZE  rcvd: 71

but than I can't reach my Adguard-UI any more and the privat DNS also not working on my android device.