It appears that “DNS over TLS” support is being added to Android, according to several commits added to the Android Open Source Project (AOSP). The addition in the Android repository shows that a new setting will be added under Developer Options allowing users to turn on or off DNS over TLS. Presumably, if such an option is being added to Developer Options, then that means it is in testing and may arrive in a future version of Android such as version 8.1.
這邊用的應該是 RFC 7858 的「Specification for DNS over Transport Layer Security (TLS)」，已經是 Standards Track 了。預設使用 TCP port 853：
By default, a DNS client desiring privacy from DNS over TLS from a particular server MUST establish a TCP connection to port 853 on the server, unless it has mutual agreement with its server to use a port other than port 853 for DNS over TLS.
而且建議如果另外定義的話，不要用 port 53：
This recommendation against use of port 53 for DNS over TLS is to avoid complication in selecting use or non-use of TLS and to reduce risk of downgrade attacks.
另外也說明了在 port 853 上禁用明文傳輸：
DNS clients and servers MUST NOT use port 853 to transport cleartext DNS messages.
不過即使將 DNS query 保護起來，TLS 本身還是會透漏 hostname 的部份 (因為 SNI 的關係)，所以就 privacy 面向考量的話，沒有實質的意義... 主要還是考慮被竄改的問題？但如果是這樣的話，目前 TLS 連線本身就已經有這樣的保護了？暫時沒想到可以解什麼實際的問題...