diff --git a/libnetdbpf/Android.bp b/libnetdbpf/Android.bp
index 64a6b66..8592e6f 100644
--- a/libnetdbpf/Android.bp
+++ b/libnetdbpf/Android.bp
@@ -43,7 +43,7 @@
 
     shared_libs: [
         "libbase",
-        "libbpf",
+        "libbpf_android",
         "libutils",
         "liblog",
         "libnetdutils",
@@ -76,7 +76,7 @@
     static_libs: ["libgmock"],
     shared_libs: [
         "libbase",
-        "libbpf",
+        "libbpf_android",
         "liblog",
         "libnetdbpf",
         "libnetdutils",
diff --git a/resolv/Android.bp b/resolv/Android.bp
index 252264d..5e88ab8 100644
--- a/resolv/Android.bp
+++ b/resolv/Android.bp
@@ -22,16 +22,17 @@
         "DnsTlsServer.cpp",
         "DnsTlsSessionCache.cpp",
         "DnsTlsSocket.cpp",
+        "PrivateDnsConfiguration.cpp",
     ],
     // Link everything statically (except for libc) to minimize our dependence
     // on system ABIs
     stl: "libc++_static",
     static_libs: [
         "libbase",
+        "libcrypto",
         "liblog",
         "libnetdutils",
         "libssl",
-        "libcrypto",
     ],
     export_include_dirs: ["include"],
     // TODO: pie in the sky: make this code clang-tidy clean
@@ -48,17 +49,28 @@
 cc_test {
     name: "libnetd_resolv_test",
     defaults: ["netd_defaults"],
+    // Add DnsTls* files since they are not visible outside libnetd_resolv library.
     srcs: [
+        "DnsTlsDispatcher.cpp",
+        "DnsTlsQueryMap.cpp",
+        "DnsTlsTransport.cpp",
+        "DnsTlsServer.cpp",
+        "DnsTlsSessionCache.cpp",
+        "DnsTlsSocket.cpp",
         "dns_tls_test.cpp",
     ],
+    // TODO: Remove the include path "system/netd/include" after Fwmark used in DnsTlsTransport is
+    // moved out.
     include_dirs: [
+        "system/netd/include",
+        "system/netd/resolv/include",
         "system/netd/server",
     ],
     shared_libs: [
         "libbase",
+        "libcrypto",
         "liblog",
         "libnetdutils",
-        "libnetd_resolv",
         "libssl",
     ],
 }
diff --git a/resolv/PrivateDnsConfiguration.cpp b/resolv/PrivateDnsConfiguration.cpp
new file mode 100644
index 0000000..b854a38
--- /dev/null
+++ b/resolv/PrivateDnsConfiguration.cpp
@@ -0,0 +1,363 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "PrivateDnsConfiguration"
+#define DBG 0
+
+#include <log/log.h>
+#include <netdb.h>
+#include <sys/socket.h>
+
+#include "netd_resolv/DnsTlsTransport.h"
+#include "netd_resolv/PrivateDnsConfiguration.h"
+#include "netdutils/BackoffSequence.h"
+
+int resolv_set_private_dns_for_net(unsigned netid, uint32_t mark, const char** servers,
+                                   const unsigned numServers, const char* tlsName,
+                                   const uint8_t** fingerprints, const unsigned numFingerprint) {
+    std::vector<std::string> tlsServers;
+    for (unsigned i = 0; i < numServers; i++) {
+        tlsServers.push_back(std::string(servers[i]));
+    }
+
+    std::set<std::vector<uint8_t>> tlsFingerprints;
+    for (unsigned i = 0; i < numFingerprint; i++) {
+        // Each fingerprint stored are 32(SHA256_SIZE) bytes long.
+        tlsFingerprints.emplace(std::vector<uint8_t>(fingerprints[i], fingerprints[i] + 32));
+    }
+
+    return android::net::gPrivateDnsConfiguration.set(netid, mark, tlsServers, std::string(tlsName),
+                                                      tlsFingerprints);
+}
+
+void resolv_delete_private_dns_for_net(unsigned netid) {
+    android::net::gPrivateDnsConfiguration.clear(netid);
+}
+
+void resolv_get_private_dns_status_for_net(unsigned netid, ExternalPrivateDnsStatus* status) {
+    android::net::gPrivateDnsConfiguration.getStatus(netid, status);
+}
+
+void resolv_register_private_dns_callback(private_dns_validated_callback callback) {
+    android::net::gPrivateDnsConfiguration.setCallback(callback);
+}
+
+namespace android {
+
+using android::netdutils::BackoffSequence;
+
+namespace net {
+
+std::string addrToString(const sockaddr_storage* addr) {
+    char out[INET6_ADDRSTRLEN] = {0};
+    getnameinfo((const sockaddr*) addr, sizeof(sockaddr_storage), out, INET6_ADDRSTRLEN, nullptr, 0,
+                NI_NUMERICHOST);
+    return std::string(out);
+}
+
+bool parseServer(const char* server, sockaddr_storage* parsed) {
+    addrinfo hints = {.ai_family = AF_UNSPEC, .ai_flags = AI_NUMERICHOST | AI_NUMERICSERV};
+    addrinfo* res;
+
+    int err = getaddrinfo(server, "853", &hints, &res);
+    if (err != 0) {
+        ALOGW("Failed to parse server address (%s): %s", server, gai_strerror(err));
+        return false;
+    }
+
+    memcpy(parsed, res->ai_addr, res->ai_addrlen);
+    freeaddrinfo(res);
+    return true;
+}
+
+void PrivateDnsConfiguration::setCallback(private_dns_validated_callback callback) {
+    if (mCallback == nullptr) {
+        mCallback = callback;
+    }
+}
+
+int PrivateDnsConfiguration::set(int32_t netId, uint32_t mark,
+                                 const std::vector<std::string>& servers, const std::string& name,
+                                 const std::set<std::vector<uint8_t>>& fingerprints) {
+    if (DBG) {
+        ALOGD("PrivateDnsConfiguration::set(%u, %zu, %s, %zu)", netId, servers.size(), name.c_str(),
+              fingerprints.size());
+    }
+
+    const bool explicitlyConfigured = !name.empty() || !fingerprints.empty();
+
+    // Parse the list of servers that has been passed in
+    std::set<DnsTlsServer> tlsServers;
+    for (size_t i = 0; i < servers.size(); ++i) {
+        sockaddr_storage parsed;
+        if (!parseServer(servers[i].c_str(), &parsed)) {
+            return -EINVAL;
+        }
+        DnsTlsServer server(parsed);
+        server.name = name;
+        server.fingerprints = fingerprints;
+        tlsServers.insert(server);
+    }
+
+    std::lock_guard guard(mPrivateDnsLock);
+    if (explicitlyConfigured) {
+        mPrivateDnsModes[netId] = PrivateDnsMode::STRICT;
+    } else if (!tlsServers.empty()) {
+        mPrivateDnsModes[netId] = PrivateDnsMode::OPPORTUNISTIC;
+    } else {
+        mPrivateDnsModes[netId] = PrivateDnsMode::OFF;
+        mPrivateDnsTransports.erase(netId);
+        return 0;
+    }
+
+    // Create the tracker if it was not present
+    auto netPair = mPrivateDnsTransports.find(netId);
+    if (netPair == mPrivateDnsTransports.end()) {
+        // No TLS tracker yet for this netId.
+        bool added;
+        std::tie(netPair, added) = mPrivateDnsTransports.emplace(netId, PrivateDnsTracker());
+        if (!added) {
+            ALOGE("Memory error while recording private DNS for netId %d", netId);
+            return -ENOMEM;
+        }
+    }
+    auto& tracker = netPair->second;
+
+    // Remove any servers from the tracker that are not in |servers| exactly.
+    for (auto it = tracker.begin(); it != tracker.end();) {
+        if (tlsServers.count(it->first) == 0) {
+            it = tracker.erase(it);
+        } else {
+            ++it;
+        }
+    }
+
+    // Add any new or changed servers to the tracker, and initiate async checks for them.
+    for (const auto& server : tlsServers) {
+        if (needsValidation(tracker, server)) {
+            validatePrivateDnsProvider(server, tracker, netId, mark);
+        }
+    }
+    return 0;
+}
+
+PrivateDnsStatus PrivateDnsConfiguration::getStatus(unsigned netId) {
+    PrivateDnsStatus status{PrivateDnsMode::OFF, {}};
+
+    // This mutex is on the critical path of every DNS lookup.
+    //
+    // If the overhead of mutex acquisition proves too high, we could reduce
+    // it by maintaining an atomic_int32_t counter of TLS-enabled netids, or
+    // by using an RWLock.
+    std::lock_guard guard(mPrivateDnsLock);
+
+    const auto mode = mPrivateDnsModes.find(netId);
+    if (mode == mPrivateDnsModes.end()) return status;
+    status.mode = mode->second;
+
+    const auto netPair = mPrivateDnsTransports.find(netId);
+    if (netPair != mPrivateDnsTransports.end()) {
+        for (const auto& serverPair : netPair->second) {
+            if (serverPair.second == Validation::success) {
+                status.validatedServers.push_back(serverPair.first);
+            }
+        }
+    }
+
+    return status;
+}
+
+void PrivateDnsConfiguration::getStatus(unsigned netId, ExternalPrivateDnsStatus* status) {
+    // This mutex is on the critical path of every DNS lookup.
+    //
+    // If the overhead of mutex acquisition proves too high, we could reduce
+    // it by maintaining an atomic_int32_t counter of TLS-enabled netids, or
+    // by using an RWLock.
+    std::lock_guard guard(mPrivateDnsLock);
+
+    const auto mode = mPrivateDnsModes.find(netId);
+    if (mode == mPrivateDnsModes.end()) return;
+    status->mode = mode->second;
+
+    const auto netPair = mPrivateDnsTransports.find(netId);
+    if (netPair != mPrivateDnsTransports.end()) {
+        status->numServers = netPair->second.size();
+        int count = 0;
+        for (const auto& serverPair : netPair->second) {
+            status->serverStatus[count].ss = serverPair.first.ss;
+            status->serverStatus[count].hostname =
+                    serverPair.first.name.empty() ? "" : serverPair.first.name.c_str();
+            status->serverStatus[count].validation = serverPair.second;
+            /*
+            unsigned numFingerprint = 0;
+            for (const auto& fp : serverPair.first.fingerprints) {
+                std::copy(
+                        fp.begin(), fp.end(),
+                        status->serverStatus[count].fingerprints.fingerprint[numFingerprint].data);
+                numFingerprint++;
+            }
+            status->serverStatus[count].fingerprints.num = numFingerprint;
+            */
+            count++;
+        }
+    }
+}
+
+void PrivateDnsConfiguration::clear(unsigned netId) {
+    if (DBG) {
+        ALOGD("PrivateDnsConfiguration::clear(%u)", netId);
+    }
+    std::lock_guard guard(mPrivateDnsLock);
+    mPrivateDnsModes.erase(netId);
+    mPrivateDnsTransports.erase(netId);
+}
+
+void PrivateDnsConfiguration::validatePrivateDnsProvider(const DnsTlsServer& server,
+                                                         PrivateDnsTracker& tracker, unsigned netId,
+                                                         uint32_t mark) REQUIRES(mPrivateDnsLock) {
+    if (DBG) {
+        ALOGD("validatePrivateDnsProvider(%s, %u)", addrToString(&(server.ss)).c_str(), netId);
+    }
+
+    tracker[server] = Validation::in_process;
+    if (DBG) {
+        ALOGD("Server %s marked as in_process.  Tracker now has size %zu",
+              addrToString(&(server.ss)).c_str(), tracker.size());
+    }
+    // Note that capturing |server| and |netId| in this lambda create copies.
+    std::thread validate_thread([this, server, netId, mark] {
+        // cat /proc/sys/net/ipv4/tcp_syn_retries yields "6".
+        //
+        // Start with a 1 minute delay and backoff to once per hour.
+        //
+        // Assumptions:
+        //     [1] Each TLS validation is ~10KB of certs+handshake+payload.
+        //     [2] Network typically provision clients with <=4 nameservers.
+        //     [3] Average month has 30 days.
+        //
+        // Each validation pass in a given hour is ~1.2MB of data. And 24
+        // such validation passes per day is about ~30MB per month, in the
+        // worst case. Otherwise, this will cost ~600 SYNs per month
+        // (6 SYNs per ip, 4 ips per validation pass, 24 passes per day).
+        auto backoff = BackoffSequence<>::Builder()
+                               .withInitialRetransmissionTime(std::chrono::seconds(60))
+                               .withMaximumRetransmissionTime(std::chrono::seconds(3600))
+                               .build();
+
+        while (true) {
+            // ::validate() is a blocking call that performs network operations.
+            // It can take milliseconds to minutes, up to the SYN retry limit.
+            const bool success = DnsTlsTransport::validate(server, netId, mark);
+            if (DBG) {
+                ALOGD("validateDnsTlsServer returned %d for %s", success,
+                      addrToString(&(server.ss)).c_str());
+            }
+
+            const bool needs_reeval = this->recordPrivateDnsValidation(server, netId, success);
+            if (!needs_reeval) {
+                break;
+            }
+
+            if (backoff.hasNextTimeout()) {
+                std::this_thread::sleep_for(backoff.getNextTimeout());
+            } else {
+                break;
+            }
+        }
+    });
+    validate_thread.detach();
+}
+
+bool PrivateDnsConfiguration::recordPrivateDnsValidation(const DnsTlsServer& server, unsigned netId,
+                                                         bool success) {
+    constexpr bool NEEDS_REEVALUATION = true;
+    constexpr bool DONT_REEVALUATE = false;
+
+    std::lock_guard guard(mPrivateDnsLock);
+
+    auto netPair = mPrivateDnsTransports.find(netId);
+    if (netPair == mPrivateDnsTransports.end()) {
+        ALOGW("netId %u was erased during private DNS validation", netId);
+        return DONT_REEVALUATE;
+    }
+
+    const auto mode = mPrivateDnsModes.find(netId);
+    if (mode == mPrivateDnsModes.end()) {
+        ALOGW("netId %u has no private DNS validation mode", netId);
+        return DONT_REEVALUATE;
+    }
+    const bool modeDoesReevaluation = (mode->second == PrivateDnsMode::STRICT);
+
+    bool reevaluationStatus =
+            (success || !modeDoesReevaluation) ? DONT_REEVALUATE : NEEDS_REEVALUATION;
+
+    auto& tracker = netPair->second;
+    auto serverPair = tracker.find(server);
+    if (serverPair == tracker.end()) {
+        ALOGW("Server %s was removed during private DNS validation",
+              addrToString(&(server.ss)).c_str());
+        success = false;
+        reevaluationStatus = DONT_REEVALUATE;
+    } else if (!(serverPair->first == server)) {
+        // TODO: It doesn't seem correct to overwrite the tracker entry for
+        // |server| down below in this circumstance... Fix this.
+        ALOGW("Server %s was changed during private DNS validation",
+              addrToString(&(server.ss)).c_str());
+        success = false;
+        reevaluationStatus = DONT_REEVALUATE;
+    }
+
+    // Invoke the callback to send a validation event to NetdEventListenerService.
+    if (mCallback != nullptr) {
+        const char* ipLiteral = addrToString(&(server.ss)).c_str();
+        const char* hostname = server.name.empty() ? "" : server.name.c_str();
+        mCallback(netId, ipLiteral, hostname, success);
+    }
+
+    if (success) {
+        tracker[server] = Validation::success;
+        if (DBG) {
+            ALOGD("Validation succeeded for %s! Tracker now has %zu entries.",
+                  addrToString(&(server.ss)).c_str(), tracker.size());
+        }
+    } else {
+        // Validation failure is expected if a user is on a captive portal.
+        // TODO: Trigger a second validation attempt after captive portal login
+        // succeeds.
+        tracker[server] = (reevaluationStatus == NEEDS_REEVALUATION) ? Validation::in_process
+                                                                     : Validation::fail;
+        if (DBG) {
+            ALOGD("Validation failed for %s!", addrToString(&(server.ss)).c_str());
+        }
+    }
+
+    return reevaluationStatus;
+}
+
+// Start validation for newly added servers as well as any servers that have
+// landed in Validation::fail state. Note that servers that have failed
+// multiple validation attempts but for which there is still a validating
+// thread running are marked as being Validation::in_process.
+bool PrivateDnsConfiguration::needsValidation(const PrivateDnsTracker& tracker,
+                                              const DnsTlsServer& server) {
+    const auto& iter = tracker.find(server);
+    return (iter == tracker.end()) || (iter->second == Validation::fail);
+}
+
+PrivateDnsConfiguration gPrivateDnsConfiguration;
+
+}  // namespace net
+}  // namespace android
diff --git a/resolv/getaddrinfo.cpp b/resolv/getaddrinfo.cpp
index 0364be4..c229588 100644
--- a/resolv/getaddrinfo.cpp
+++ b/resolv/getaddrinfo.cpp
@@ -127,24 +127,23 @@
     int e_af;
     int e_socktype;
     int e_protocol;
-    const char* e_protostr;
     int e_wild;
 #define WILD_AF(ex) ((ex)->e_wild & 0x01)
 #define WILD_SOCKTYPE(ex) ((ex)->e_wild & 0x02)
 #define WILD_PROTOCOL(ex) ((ex)->e_wild & 0x04)
 };
 
-static const struct explore explore[] = {
-        {PF_INET6, SOCK_DGRAM, IPPROTO_UDP, "udp", 0x07},
-        {PF_INET6, SOCK_STREAM, IPPROTO_TCP, "tcp", 0x07},
-        {PF_INET6, SOCK_RAW, ANY, NULL, 0x05},
-        {PF_INET, SOCK_DGRAM, IPPROTO_UDP, "udp", 0x07},
-        {PF_INET, SOCK_STREAM, IPPROTO_TCP, "tcp", 0x07},
-        {PF_INET, SOCK_RAW, ANY, NULL, 0x05},
-        {PF_UNSPEC, SOCK_DGRAM, IPPROTO_UDP, "udp", 0x07},
-        {PF_UNSPEC, SOCK_STREAM, IPPROTO_TCP, "tcp", 0x07},
-        {PF_UNSPEC, SOCK_RAW, ANY, NULL, 0x05},
-        {-1, 0, 0, NULL, 0},
+static const struct explore explore_options[] = {
+        {PF_INET6, SOCK_DGRAM, IPPROTO_UDP, 0x07},
+        {PF_INET6, SOCK_STREAM, IPPROTO_TCP, 0x07},
+        {PF_INET6, SOCK_RAW, ANY, 0x05},
+        {PF_INET, SOCK_DGRAM, IPPROTO_UDP, 0x07},
+        {PF_INET, SOCK_STREAM, IPPROTO_TCP, 0x07},
+        {PF_INET, SOCK_RAW, ANY, 0x05},
+        {PF_UNSPEC, SOCK_DGRAM, IPPROTO_UDP, 0x07},
+        {PF_UNSPEC, SOCK_STREAM, IPPROTO_TCP, 0x07},
+        {PF_UNSPEC, SOCK_RAW, ANY, 0x05},
+        {-1, 0, 0, 0},
 };
 
 #define PTON_MAX 16
@@ -230,20 +229,6 @@
         if (error != 0) goto free;                     \
     } while (0)
 
-#define GET_CANONNAME(ai, str)                              \
-    do {                                                    \
-        /* external reference: pai, error and label free */ \
-        error = get_canonname(pai, (ai), (str));            \
-        if (error != 0) goto free;                          \
-    } while (0)
-
-#define ERR(err)                                       \
-    do {                                               \
-        /* external reference: error, and label bad */ \
-        error = (err);                                 \
-        goto bad;                                      \
-    } while (0)
-
 #define MATCH_FAMILY(x, y, w) \
     ((x) == (y) || ((w) && ((x) == PF_UNSPEC || (y) == PF_UNSPEC)))
 #define MATCH(x, y, w) ((x) == (y) || ((w) && ((x) == ANY || (y) == ANY)))
@@ -334,7 +319,7 @@
                                      const struct addrinfo* hints,
                                      const struct android_net_context* netcontext,
                                      struct addrinfo** res) {
-    struct addrinfo sentinel;
+    struct addrinfo sentinel = {};
     struct addrinfo* cur;
     int error = 0;
     struct addrinfo ai;
@@ -347,7 +332,6 @@
     /* hints is allowed to be NULL */
     assert(res != NULL);
     assert(netcontext != NULL);
-    memset(&sentinel, 0, sizeof(sentinel));
     cur = &sentinel;
     pai = &ai;
     pai->ai_flags = 0;
@@ -358,137 +342,149 @@
     pai->ai_canonname = NULL;
     pai->ai_addr = NULL;
     pai->ai_next = NULL;
-
-    if (hostname == NULL && servname == NULL) return EAI_NONAME;
-    if (hints) {
-        /* error check for hints */
-        if (hints->ai_addrlen || hints->ai_canonname || hints->ai_addr || hints->ai_next)
-            ERR(EAI_BADHINTS); /* xxx */
-        if (hints->ai_flags & ~AI_MASK) ERR(EAI_BADFLAGS);
-        switch (hints->ai_family) {
-            case PF_UNSPEC:
-            case PF_INET:
-            case PF_INET6:
-                break;
-            default:
-                ERR(EAI_FAMILY);
+    do {
+        if (hostname == NULL && servname == NULL) {
+            error = EAI_NONAME;
+            break;
         }
-        memcpy(pai, hints, sizeof(*pai));
+        if (hints) {
+            /* error check for hints */
+            if (hints->ai_addrlen || hints->ai_canonname || hints->ai_addr || hints->ai_next) {
+                error = EAI_BADHINTS;
+                break;
+            }
+            if (hints->ai_flags & ~AI_MASK) {
+                error = EAI_BADFLAGS;
+                break;
+            }
 
-        /*
-         * if both socktype/protocol are specified, check if they
-         * are meaningful combination.
-         */
-        if (pai->ai_socktype != ANY && pai->ai_protocol != ANY) {
-            for (ex = explore; ex->e_af >= 0; ex++) {
-                if (pai->ai_family != ex->e_af) continue;
-                if (ex->e_socktype == ANY) continue;
-                if (ex->e_protocol == ANY) continue;
-                if (pai->ai_socktype == ex->e_socktype && pai->ai_protocol != ex->e_protocol) {
-                    ERR(EAI_BADHINTS);
+            if (!(hints->ai_family == PF_UNSPEC || hints->ai_family == PF_INET ||
+                  hints->ai_family == PF_INET6)) {
+                error = EAI_FAMILY;
+                break;
+            }
+            *pai = *hints;
+
+            /*
+             * if both socktype/protocol are specified, check if they
+             * are meaningful combination.
+             */
+            if (pai->ai_socktype != ANY && pai->ai_protocol != ANY) {
+                for (ex = explore_options; ex->e_af >= 0; ex++) {
+                    if (pai->ai_family != ex->e_af) continue;
+                    if (ex->e_socktype == ANY) continue;
+                    if (ex->e_protocol == ANY) continue;
+                    if (pai->ai_socktype == ex->e_socktype && pai->ai_protocol != ex->e_protocol) {
+                        error = EAI_BADHINTS;
+                        break;
+                    }
                 }
+                if (error) break;
             }
         }
-    }
 
-    /*
-     * check for special cases.  (1) numeric servname is disallowed if
-     * socktype/protocol are left unspecified. (2) servname is disallowed
-     * for raw and other inet{,6} sockets.
-     */
-    if (MATCH_FAMILY(pai->ai_family, PF_INET, 1)
-        || MATCH_FAMILY(pai->ai_family, PF_INET6, 1)
-    ) {
-        ai0 = *pai; /* backup *pai */
+        /*
+         * check for special cases.  (1) numeric servname is disallowed if
+         * socktype/protocol are left unspecified. (2) servname is disallowed
+         * for raw and other inet{,6} sockets.
+         */
+        if (MATCH_FAMILY(pai->ai_family, PF_INET, 1)
+            || MATCH_FAMILY(pai->ai_family, PF_INET6, 1)
+        ) {
+            ai0 = *pai; /* backup *pai */
 
-        if (pai->ai_family == PF_UNSPEC) {
-            pai->ai_family = PF_INET6;
-        }
-        error = get_portmatch(pai, servname);
-        if (error) ERR(error);
+            if (pai->ai_family == PF_UNSPEC) {
+                pai->ai_family = PF_INET6;
+            }
+            error = get_portmatch(pai, servname);
+            if (error) break;
 
-        *pai = ai0;
-    }
-
-    ai0 = *pai;
-
-    /* NULL hostname, or numeric hostname */
-    for (ex = explore; ex->e_af >= 0; ex++) {
-        *pai = ai0;
-
-        /* PF_UNSPEC entries are prepared for DNS queries only */
-        if (ex->e_af == PF_UNSPEC) continue;
-
-        if (!MATCH_FAMILY(pai->ai_family, ex->e_af, WILD_AF(ex))) continue;
-        if (!MATCH(pai->ai_socktype, ex->e_socktype, WILD_SOCKTYPE(ex))) continue;
-        if (!MATCH(pai->ai_protocol, ex->e_protocol, WILD_PROTOCOL(ex))) continue;
-
-        if (pai->ai_family == PF_UNSPEC) pai->ai_family = ex->e_af;
-        if (pai->ai_socktype == ANY && ex->e_socktype != ANY) pai->ai_socktype = ex->e_socktype;
-        if (pai->ai_protocol == ANY && ex->e_protocol != ANY) pai->ai_protocol = ex->e_protocol;
-
-        if (hostname == NULL)
-            error = explore_null(pai, servname, &cur->ai_next);
-        else
-            error = explore_numeric_scope(pai, hostname, servname, &cur->ai_next);
-
-        if (error) goto free;
-
-        while (cur->ai_next) cur = cur->ai_next;
-    }
-
-    /*
-     * XXX
-     * If numeric representation of AF1 can be interpreted as FQDN
-     * representation of AF2, we need to think again about the code below.
-     */
-    if (sentinel.ai_next) goto good;
-
-    if (hostname == NULL) ERR(EAI_NODATA);
-    if (pai->ai_flags & AI_NUMERICHOST) ERR(EAI_NONAME);
-
-    /*
-     * hostname as alphabetical name.
-     * we would like to prefer AF_INET6 than AF_INET, so we'll make a
-     * outer loop by AFs.
-     */
-    for (ex = explore; ex->e_af >= 0; ex++) {
-        *pai = ai0;
-
-        /* require exact match for family field */
-        if (pai->ai_family != ex->e_af) continue;
-
-        if (!MATCH(pai->ai_socktype, ex->e_socktype, WILD_SOCKTYPE(ex))) {
-            continue;
-        }
-        if (!MATCH(pai->ai_protocol, ex->e_protocol, WILD_PROTOCOL(ex))) {
-            continue;
+            *pai = ai0;
         }
 
-        if (pai->ai_socktype == ANY && ex->e_socktype != ANY) pai->ai_socktype = ex->e_socktype;
-        if (pai->ai_protocol == ANY && ex->e_protocol != ANY) pai->ai_protocol = ex->e_protocol;
+        ai0 = *pai;
 
-        error = explore_fqdn(pai, hostname, servname, &cur->ai_next, netcontext);
+        /* NULL hostname, or numeric hostname */
+        for (ex = explore_options; ex->e_af >= 0; ex++) {
+            *pai = ai0;
 
-        while (cur && cur->ai_next) cur = cur->ai_next;
-    }
+            /* PF_UNSPEC entries are prepared for DNS queries only */
+            if (ex->e_af == PF_UNSPEC) continue;
 
-    /* XXX */
-    if (sentinel.ai_next) error = 0;
+            if (!MATCH_FAMILY(pai->ai_family, ex->e_af, WILD_AF(ex))) continue;
+            if (!MATCH(pai->ai_socktype, ex->e_socktype, WILD_SOCKTYPE(ex))) continue;
+            if (!MATCH(pai->ai_protocol, ex->e_protocol, WILD_PROTOCOL(ex))) continue;
 
-    if (error) goto free;
-    if (error == 0) {
+            if (pai->ai_family == PF_UNSPEC) pai->ai_family = ex->e_af;
+            if (pai->ai_socktype == ANY && ex->e_socktype != ANY) pai->ai_socktype = ex->e_socktype;
+            if (pai->ai_protocol == ANY && ex->e_protocol != ANY) pai->ai_protocol = ex->e_protocol;
+
+            if (hostname == NULL)
+                error = explore_null(pai, servname, &cur->ai_next);
+            else
+                error = explore_numeric_scope(pai, hostname, servname, &cur->ai_next);
+
+            if (error) break;
+
+            while (cur->ai_next) cur = cur->ai_next;
+        }
+        if (error) break;
+
+        /*
+         * XXX
+         * If numeric representation of AF1 can be interpreted as FQDN
+         * representation of AF2, we need to think again about the code below.
+         */
+        if (sentinel.ai_next) break;
+
+        if (hostname == NULL) {
+            error = EAI_NODATA;
+            break;
+        }
+        if (pai->ai_flags & AI_NUMERICHOST) {
+            error = EAI_NONAME;
+            break;
+        }
+
+        /*
+         * hostname as alphabetical name.
+         * we would like to prefer AF_INET6 than AF_INET, so we'll make a
+         * outer loop by AFs.
+         */
+        for (ex = explore_options; ex->e_af >= 0; ex++) {
+            *pai = ai0;
+
+            /* require exact match for family field */
+            if (pai->ai_family != ex->e_af) continue;
+
+            if (!MATCH(pai->ai_socktype, ex->e_socktype, WILD_SOCKTYPE(ex))) {
+                continue;
+            }
+            if (!MATCH(pai->ai_protocol, ex->e_protocol, WILD_PROTOCOL(ex))) {
+                continue;
+            }
+
+            if (pai->ai_socktype == ANY && ex->e_socktype != ANY) pai->ai_socktype = ex->e_socktype;
+            if (pai->ai_protocol == ANY && ex->e_protocol != ANY) pai->ai_protocol = ex->e_protocol;
+
+            error = explore_fqdn(pai, hostname, servname, &cur->ai_next, netcontext);
+
+            while (cur->ai_next) cur = cur->ai_next;
+        }
+
         if (sentinel.ai_next) {
-        good:
-            *res = sentinel.ai_next;
-            return 0;
-        } else
+            error = 0;
+        } else if (error == 0) {
             error = EAI_FAIL;
+        }
+    } while (0);
+
+    if (error) {
+        freeaddrinfo(sentinel.ai_next);
+        *res = NULL;
+    } else {
+        *res = sentinel.ai_next;
     }
-free:
-bad:
-    freeaddrinfo(sentinel.ai_next);
-    *res = NULL;
     return error;
 }
 
@@ -566,15 +562,9 @@
 
     if (pai->ai_flags & AI_PASSIVE) {
         GET_AI(cur->ai_next, afd, afd->a_addrany);
-        /* xxx meaningless?
-         * GET_CANONNAME(cur->ai_next, "anyaddr");
-         */
         GET_PORT(cur->ai_next, servname);
     } else {
         GET_AI(cur->ai_next, afd, afd->a_loopback);
-        /* xxx meaningless?
-         * GET_CANONNAME(cur->ai_next, "localhost");
-         */
         GET_PORT(cur->ai_next, servname);
     }
     cur = cur->ai_next;
@@ -625,18 +615,21 @@
                  * the canonical name, based on a
                  * clarification in rfc2553bis-03.
                  */
-                GET_CANONNAME(cur->ai_next, canonname);
+                error = get_canonname(pai, cur->ai_next, canonname);
+                if (error != 0) {
+                    freeaddrinfo(sentinel.ai_next);
+                    return error;
+                }
             }
             while (cur->ai_next) cur = cur->ai_next;
         } else
-            ERR(EAI_FAMILY); /*xxx*/
+            return EAI_FAMILY;
     }
 
     *res = sentinel.ai_next;
     return 0;
 
 free:
-bad:
     freeaddrinfo(sentinel.ai_next);
     return error;
 }
@@ -886,7 +879,8 @@
 
 static struct addrinfo* getanswer(const querybuf* answer, int anslen, const char* qname, int qtype,
                                   const struct addrinfo* pai) {
-    struct addrinfo sentinel, *cur;
+    struct addrinfo sentinel = {};
+    struct addrinfo *cur;
     struct addrinfo ai;
     const struct afd* afd;
     char* canonname;
@@ -905,7 +899,6 @@
     assert(qname != NULL);
     assert(pai != NULL);
 
-    memset(&sentinel, 0, sizeof(sentinel));
     cur = &sentinel;
 
     canonname = NULL;
@@ -1439,14 +1432,13 @@
 
 static int dns_getaddrinfo(const char* name, const addrinfo* pai,
                            const android_net_context* netcontext, addrinfo** rv) {
-    struct addrinfo* ai;
-    struct addrinfo sentinel, *cur;
+    struct addrinfo *ai, *cur;
+    struct addrinfo sentinel = {};
     struct res_target q, q2;
     res_state res;
 
     memset(&q, 0, sizeof(q));
     memset(&q2, 0, sizeof(q2));
-    memset(&sentinel, 0, sizeof(sentinel));
     cur = &sentinel;
 
     querybuf* buf = (querybuf*) malloc(sizeof(*buf));
@@ -1526,7 +1518,6 @@
      */
     res_setnetcontext(res, netcontext);
     if (res_searchN(name, &q, res) < 0) {
-        res_put_state(res);
         free(buf);
         free(buf2);
         return EAI_NODATA;  // TODO: Decode error from h_errno like we do below
@@ -1543,7 +1534,6 @@
     free(buf);
     free(buf2);
     if (sentinel.ai_next == NULL) {
-        res_put_state(res);
         switch (h_errno) {
             case HOST_NOT_FOUND:
                 return EAI_NODATA;
@@ -1556,8 +1546,6 @@
 
     _rfc6724_sort(&sentinel, netcontext->app_mark, netcontext->uid);
 
-    res_put_state(res);
-
     *rv = sentinel.ai_next;
     return 0;
 }
@@ -1629,11 +1617,10 @@
 }
 
 static bool files_getaddrinfo(const char* name, const addrinfo* pai, addrinfo** res) {
-    struct addrinfo sentinel, *cur;
-    struct addrinfo* p;
+    struct addrinfo sentinel = {};
+    struct addrinfo *p, *cur;
     FILE* hostf = NULL;
 
-    memset(&sentinel, 0, sizeof(sentinel));
     cur = &sentinel;
 
     _sethtent(&hostf);
diff --git a/resolv/gethnamaddr.cpp b/resolv/gethnamaddr.cpp
index 834a962..b36f5c8 100644
--- a/resolv/gethnamaddr.cpp
+++ b/resolv/gethnamaddr.cpp
@@ -137,10 +137,13 @@
 
 static bool _dns_gethtbyaddr(const unsigned char* uaddr, int len, int af,
                              const android_net_context* netcontext, getnamaddr* info);
-static bool _dns_gethtbyname(const char* name, int af, getnamaddr* info);
+static int _dns_gethtbyname(const char* name, int af, getnamaddr* info);
 
-static struct hostent* gethostbyname_internal(const char*, int, res_state, struct hostent*, char*,
-                                              size_t, int*, const struct android_net_context*);
+static int gethostbyname_internal(const char* name, int af, res_state res, hostent* hp, char* hbuf,
+                                  size_t hbuflen, int* errorp,
+                                  const android_net_context* netcontext);
+static int gethostbyname_internal_real(const char* name, int af, res_state res, hostent* hp,
+                                       char* buf, size_t buflen, int* he);
 static struct hostent* android_gethostbyaddrfornetcontext_proxy_internal(
         const void*, socklen_t, int, struct hostent*, char*, size_t, int*,
         const struct android_net_context*);
@@ -466,10 +469,9 @@
     return NULL;
 }
 
-static struct hostent* gethostbyname_internal_real(const char* name, int af, res_state res,
-                                                   struct hostent* hp, char* buf, size_t buflen,
-                                                   int* he) {
-    struct getnamaddr info;
+static int gethostbyname_internal_real(const char* name, int af, res_state res, hostent* hp,
+                                       char* buf, size_t buflen, int* he) {
+    getnamaddr info;
     size_t size;
 
     _DIAGASSERT(name != NULL);
@@ -484,7 +486,7 @@
         default:
             *he = NETDB_INTERNAL;
             errno = EAFNOSUPPORT;
-            return NULL;
+            return EAI_FAMILY;
     }
     if (buflen < size) goto nospc;
 
@@ -530,16 +532,18 @@
     info.buflen = buflen;
     info.he = he;
     if (!_hf_gethtbyname2(name, af, &info)) {
-        if (!_dns_gethtbyname(name, af, &info)) {
-            return NULL;
+        int error = _dns_gethtbyname(name, af, &info);
+        if (error != 0) {
+            return error;
         }
     }
     *he = NETDB_SUCCESS;
-    return hp;
+    return 0;
 nospc:
     *he = NETDB_INTERNAL;
     errno = ENOSPC;
-    return NULL;
+    // Bad arguments
+    return EAI_FAIL;
 fake:
     HENT_ARRAY(hp->h_addr_list, 1, buf, buflen);
     HENT_ARRAY(hp->h_aliases, 0, buf, buflen);
@@ -549,7 +553,7 @@
 
     if (inet_pton(af, name, buf) <= 0) {
         *he = HOST_NOT_FOUND;
-        return NULL;
+        return EAI_NODATA;
     }
     hp->h_addr_list[0] = buf;
     hp->h_addr_list[1] = NULL;
@@ -558,14 +562,13 @@
     HENT_SCOPY(hp->h_name, name, buf, buflen);
     if (res->options & RES_USE_INET6) map_v4v6_hostent(hp, &buf, buf + buflen);
     *he = NETDB_SUCCESS;
-    return hp;
+    return 0;
 }
 
 // very similar in proxy-ness to android_getaddrinfo_proxy
-static struct hostent* gethostbyname_internal(const char* name, int af, res_state res,
-                                              struct hostent* hp, char* hbuf, size_t hbuflen,
-                                              int* errorp,
-                                              const struct android_net_context* netcontext) {
+static int gethostbyname_internal(const char* name, int af, res_state res, hostent* hp, char* hbuf,
+                                  size_t hbuflen, int* errorp,
+                                  const android_net_context* netcontext) {
     res_setnetcontext(res, netcontext);
     return gethostbyname_internal_real(name, af, res, hp, hbuf, hbuflen, errorp);
 }
@@ -691,7 +694,6 @@
                 af = AF_INET;
                 len = NS_INADDRSZ;
             }
-            res_put_state(res);
         }
 
         /* if this is not something we're looking for, skip it. */
@@ -841,7 +843,7 @@
     }
 }
 
-static bool _dns_gethtbyname(const char* name, int addr_type, getnamaddr* info) {
+static int _dns_gethtbyname(const char* name, int addr_type, getnamaddr* info) {
     int n, type;
     struct hostent* hp;
     res_state res;
@@ -858,32 +860,37 @@
             type = T_AAAA;
             break;
         default:
-            return false;
+            return EAI_FAMILY;
     }
     querybuf* buf = (querybuf*) malloc(sizeof(querybuf));
     if (buf == NULL) {
         *info->he = NETDB_INTERNAL;
-        return false;
+        return EAI_MEMORY;
     }
     res = res_get_state();
     if (res == NULL) {
         free(buf);
-        return false;
+        return EAI_MEMORY;
     }
     n = res_nsearch(res, name, C_IN, type, buf->buf, (int) sizeof(buf->buf));
     if (n < 0) {
         free(buf);
         debugprintf("res_nsearch failed (%d)\n", res, n);
-        res_put_state(res);
-        return false;
+        return EAI_NODATA;
     }
     hp = getanswer(buf, n, name, type, res, info->hp, info->buf, info->buflen, info->he);
     free(buf);
-    res_put_state(res);
     if (hp == NULL) {
-        return false;
+        switch (h_errno) {
+            case HOST_NOT_FOUND:
+                return EAI_NODATA;
+            case TRY_AGAIN:
+                return EAI_AGAIN;
+            default:
+                return EAI_FAIL;
+        }
     }
-    return true;
+    return 0;
 }
 
 static bool _dns_gethtbyaddr(const unsigned char* uaddr, int len, int af,
@@ -940,13 +947,11 @@
     if (n < 0) {
         free(buf);
         debugprintf("res_nquery failed (%d)\n", res, n);
-        res_put_state(res);
         return false;
     }
     hp = getanswer(buf, n, qbuf, T_PTR, res, info->hp, info->buf, info->buflen, info->he);
     free(buf);
     if (hp == NULL) {
-        res_put_state(res);
         return false;
     }
 
@@ -970,7 +975,6 @@
         memcpy(bf + NS_INADDRSZ, NAT64_PAD, sizeof(NAT64_PAD));
     }
 
-    res_put_state(res);
     *info->he = NETDB_SUCCESS;
     return true;
 
@@ -984,16 +988,18 @@
  * Non-reentrant versions.
  */
 
-struct hostent* android_gethostbynamefornetcontext(const char* name, int af,
-                                                   const struct android_net_context* netcontext) {
-    struct hostent* hp;
+int android_gethostbynamefornetcontext(const char* name, int af,
+                                       const struct android_net_context* netcontext, hostent** hp) {
+    int error;
     res_state res = res_get_state();
-    if (res == NULL) return NULL;
-    struct res_static* rs = res_get_static();  // For thread-safety.
-    hp = gethostbyname_internal(name, af, res, &rs->host, rs->hostbuf, sizeof(rs->hostbuf),
-                                &h_errno, netcontext);
-    res_put_state(res);
-    return hp;
+    if (res == NULL) return EAI_MEMORY;
+    res_static* rs = res_get_static();  // For thread-safety.
+    error = gethostbyname_internal(name, af, res, &rs->host, rs->hostbuf, sizeof(rs->hostbuf),
+                                   &h_errno, netcontext);
+    if (error == 0) {
+        *hp = &rs->host;
+    }
+    return error;
 }
 
 struct hostent* android_gethostbyaddrfornetcontext(const void* addr, socklen_t len, int af,
diff --git a/resolv/include/netd_resolv/DnsTlsDispatcher.h b/resolv/include/netd_resolv/DnsTlsDispatcher.h
index 0bb19f2..45142b8 100644
--- a/resolv/include/netd_resolv/DnsTlsDispatcher.h
+++ b/resolv/include/netd_resolv/DnsTlsDispatcher.h
@@ -38,8 +38,8 @@
 
 // This is a singleton class that manages the collection of active DnsTlsTransports.
 // Queries made here are dispatched to an existing or newly constructed DnsTlsTransport.
-class LIBNETD_RESOLV_TLS_EXPORT DnsTlsDispatcher {
-public:
+class DnsTlsDispatcher {
+  public:
     // Default constructor.
     DnsTlsDispatcher();
 
diff --git a/resolv/include/netd_resolv/DnsTlsQueryMap.h b/resolv/include/netd_resolv/DnsTlsQueryMap.h
index 4c8010c..f013e01 100644
--- a/resolv/include/netd_resolv/DnsTlsQueryMap.h
+++ b/resolv/include/netd_resolv/DnsTlsQueryMap.h
@@ -35,8 +35,8 @@
 
 // Keeps track of queries and responses.  This class matches responses with queries.
 // All methods are thread-safe and non-blocking.
-class LIBNETD_RESOLV_TLS_EXPORT DnsTlsQueryMap {
-public:
+class DnsTlsQueryMap {
+  public:
     struct Query {
         // The new ID number assigned to this query.
         uint16_t newId;
diff --git a/resolv/include/netd_resolv/DnsTlsServer.h b/resolv/include/netd_resolv/DnsTlsServer.h
index 752dc5f..bb161f2 100644
--- a/resolv/include/netd_resolv/DnsTlsServer.h
+++ b/resolv/include/netd_resolv/DnsTlsServer.h
@@ -30,7 +30,7 @@
 
 // DnsTlsServer represents a recursive resolver that supports, or may support, a
 // secure protocol.
-struct LIBNETD_RESOLV_TLS_EXPORT DnsTlsServer {
+struct DnsTlsServer {
     // Default constructor.
     DnsTlsServer() {}
 
@@ -68,7 +68,7 @@
 };
 
 // This comparison only checks the IP address.  It ignores ports, names, and fingerprints.
-struct LIBNETD_RESOLV_TLS_EXPORT AddressComparator {
+struct AddressComparator {
     bool operator() (const DnsTlsServer& x, const DnsTlsServer& y) const;
 };
 
diff --git a/resolv/include/netd_resolv/DnsTlsSocket.h b/resolv/include/netd_resolv/DnsTlsSocket.h
index 7190dd2..195705b 100644
--- a/resolv/include/netd_resolv/DnsTlsSocket.h
+++ b/resolv/include/netd_resolv/DnsTlsSocket.h
@@ -46,8 +46,8 @@
 // or the destructor in a callback.  Doing so will result in deadlocks.
 // This class may call the observer at any time after initialize(), until the destructor
 // returns (but not after).
-class LIBNETD_RESOLV_TLS_EXPORT DnsTlsSocket : public IDnsTlsSocket {
-public:
+class DnsTlsSocket : public IDnsTlsSocket {
+  public:
     DnsTlsSocket(const DnsTlsServer& server, unsigned mark,
                  IDnsTlsSocketObserver* _Nonnull observer,
                  DnsTlsSessionCache* _Nonnull cache) :
diff --git a/resolv/include/netd_resolv/DnsTlsTransport.h b/resolv/include/netd_resolv/DnsTlsTransport.h
index 011be61..4590868 100644
--- a/resolv/include/netd_resolv/DnsTlsTransport.h
+++ b/resolv/include/netd_resolv/DnsTlsTransport.h
@@ -41,8 +41,8 @@
 
 // Manages at most one DnsTlsSocket at a time.  This class handles socket lifetime issues,
 // such as reopening the socket and reissuing pending queries.
-class LIBNETD_RESOLV_TLS_EXPORT DnsTlsTransport : public IDnsTlsSocketObserver {
-public:
+class DnsTlsTransport : public IDnsTlsSocketObserver {
+  public:
     DnsTlsTransport(const DnsTlsServer& server, unsigned mark,
                     IDnsTlsSocketFactory* _Nonnull factory) :
             mMark(mark), mServer(server), mFactory(factory) {}
diff --git a/resolv/include/netd_resolv/PrivateDnsConfiguration.h b/resolv/include/netd_resolv/PrivateDnsConfiguration.h
new file mode 100644
index 0000000..cee0205
--- /dev/null
+++ b/resolv/include/netd_resolv/PrivateDnsConfiguration.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef NETD_RESOLV_PRIVATEDNSCONFIGURATION_H
+#define NETD_RESOLV_PRIVATEDNSCONFIGURATION_H
+
+#include <list>
+#include <map>
+#include <vector>
+
+#include <android-base/thread_annotations.h>
+
+#include "DnsTlsServer.h"
+#include "resolv.h"
+
+namespace android {
+namespace net {
+
+struct PrivateDnsStatus {
+    PrivateDnsMode mode;
+    std::list<DnsTlsServer> validatedServers;
+};
+
+class PrivateDnsConfiguration {
+  public:
+    int set(int32_t netId, uint32_t mark, const std::vector<std::string>& servers,
+            const std::string& name, const std::set<std::vector<uint8_t>>& fingerprints);
+
+    PrivateDnsStatus getStatus(unsigned netId);
+
+    // Externally used for netd.
+    void getStatus(unsigned netId, ExternalPrivateDnsStatus* status);
+
+    int getPrivateDnsModeAndStatus(unsigned netId);
+    void clear(unsigned netId);
+    void setCallback(private_dns_validated_callback callback);
+
+  private:
+    typedef std::map<DnsTlsServer, Validation, AddressComparator> PrivateDnsTracker;
+
+    void validatePrivateDnsProvider(const DnsTlsServer& server, PrivateDnsTracker& tracker,
+                                    unsigned netId, uint32_t mark) REQUIRES(mPrivateDnsLock);
+
+    bool recordPrivateDnsValidation(const DnsTlsServer& server, unsigned netId, bool success);
+
+    // Start validation for newly added servers as well as any servers that have
+    // landed in Validation::fail state. Note that servers that have failed
+    // multiple validation attempts but for which there is still a validating
+    // thread running are marked as being Validation::in_process.
+    bool needsValidation(const PrivateDnsTracker& tracker, const DnsTlsServer& server);
+
+    std::mutex mPrivateDnsLock;
+    std::map<unsigned, PrivateDnsMode> mPrivateDnsModes GUARDED_BY(mPrivateDnsLock);
+    // Structure for tracking the validation status of servers on a specific netId.
+    // Using the AddressComparator ensures at most one entry per IP address.
+    std::map<unsigned, PrivateDnsTracker> mPrivateDnsTransports GUARDED_BY(mPrivateDnsLock);
+    private_dns_validated_callback mCallback = nullptr;
+};
+
+extern PrivateDnsConfiguration gPrivateDnsConfiguration;
+
+}  // namespace net
+}  // namespace android
+
+#endif /* NETD_RESOLV_PRIVATEDNSCONFIGURATION_H */
diff --git a/resolv/include/netd_resolv/params.h b/resolv/include/netd_resolv/params.h
index c3f3363..939bfc4 100644
--- a/resolv/include/netd_resolv/params.h
+++ b/resolv/include/netd_resolv/params.h
@@ -36,17 +36,12 @@
     int base_timeout_msec;      // base query retry timeout (if 0, use RES_TIMEOUT)
 };
 
-typedef enum { res_goahead, res_nextns, res_modified, res_done, res_error } res_sendhookact;
+// The DNS over TLS mode on a specific netId.
+enum class PrivateDnsMode : uint8_t { OFF, OPPORTUNISTIC, STRICT };
 
-typedef res_sendhookact (*res_send_qhook)(struct sockaddr* const*, const uint8_t**, int*, uint8_t*,
-                                          int, int*);
-
-typedef res_sendhookact (*res_send_rhook)(const struct sockaddr*, const uint8_t*, int, uint8_t*,
-                                          int, int*);
+// Validation status of a DNS over TLS server (on a specific netId).
+enum class Validation : uint8_t { in_process, success, fail, unknown_server, unknown_netid };
 
 #define LIBNETD_RESOLV_PUBLIC extern "C" [[gnu::visibility("default")]]
 
-// TODO: Remove it after we move PrivateDnsConfiguration and qhook() into libnetd_resolv.
-#define LIBNETD_RESOLV_TLS_EXPORT [[gnu::visibility("default")]]
-
 #endif  // NETD_RESOLV_PARAMS_H
diff --git a/resolv/include/netd_resolv/resolv.h b/resolv/include/netd_resolv/resolv.h
index 96133e5..9176996 100644
--- a/resolv/include/netd_resolv/resolv.h
+++ b/resolv/include/netd_resolv/resolv.h
@@ -75,7 +75,6 @@
     unsigned dns_mark;
     uid_t uid;
     unsigned flags;
-    res_send_qhook qhook;
 };
 
 #define NET_CONTEXT_INVALID_UID ((uid_t) -1)
@@ -83,10 +82,23 @@
 #define NET_CONTEXT_FLAG_USE_LOCAL_NAMESERVERS 0x00000001
 #define NET_CONTEXT_FLAG_USE_EDNS 0x00000002
 
+struct ExternalPrivateDnsStatus {
+    PrivateDnsMode mode;
+    unsigned numServers;
+    struct PrivateDnsInfo {
+        sockaddr_storage ss;
+        const char* hostname;
+        Validation validation;
+    } serverStatus[MAXNS];
+};
+
+typedef void (*private_dns_validated_callback)(unsigned netid, const char* server,
+                                               const char* hostname, bool success);
+
 LIBNETD_RESOLV_PUBLIC hostent* android_gethostbyaddrfornetcontext(const void*, socklen_t, int,
                                                                   const android_net_context*);
-LIBNETD_RESOLV_PUBLIC hostent* android_gethostbynamefornetcontext(const char*, int,
-                                                                  const android_net_context*);
+LIBNETD_RESOLV_PUBLIC int android_gethostbynamefornetcontext(const char*, int,
+                                                             const android_net_context*, hostent**);
 LIBNETD_RESOLV_PUBLIC int android_getaddrinfofornetcontext(const char*, const char*,
                                                            const addrinfo*,
                                                            const android_net_context*, addrinfo**);
@@ -96,6 +108,22 @@
                                                          unsigned numservers, const char* domains,
                                                          const __res_params* params);
 
+LIBNETD_RESOLV_PUBLIC int resolv_set_private_dns_for_net(unsigned netid, uint32_t mark,
+                                                         const char** servers,
+                                                         const unsigned numServers,
+                                                         const char* tlsName,
+                                                         const uint8_t** fingerprints,
+                                                         const unsigned numFingerprints);
+
+LIBNETD_RESOLV_PUBLIC void resolv_delete_private_dns_for_net(unsigned netid);
+
+LIBNETD_RESOLV_PUBLIC void resolv_get_private_dns_status_for_net(unsigned netid,
+                                                                 ExternalPrivateDnsStatus* status);
+
+// Register callback to listen whether private DNS validated
+LIBNETD_RESOLV_PUBLIC void resolv_register_private_dns_callback(
+        private_dns_validated_callback callback);
+
 // Flush the cache associated with a certain network
 LIBNETD_RESOLV_PUBLIC void resolv_flush_cache_for_net(unsigned netid);
 
diff --git a/resolv/libnetd_resolv.map.txt b/resolv/libnetd_resolv.map.txt
index bb1e408..e139ab7 100644
--- a/resolv/libnetd_resolv.map.txt
+++ b/resolv/libnetd_resolv.map.txt
@@ -28,53 +28,10 @@
     android_net_res_stats_get_usable_servers;
     resolv_delete_cache_for_net;
     resolv_set_nameservers_for_net;
-
-    # These symbol names are generated by 'nm -D libnetd_resolv.so' with reverting the commit
-    # (aosp/801454). They are temporarily necessary for netd to access DnsTls* classes before
-    # we move qhook() and PrivateDnsConfiguration to libnetd_resolv library.
-    # TODO: Remove them after we hide DnsTls* stuff thus netd no longer needs to access them.
-    _ZN7android3net12DnsTlsSocket10initializeEv;
-    _ZN7android3net12DnsTlsSocket10sslConnectEi;
-    _ZN7android3net12DnsTlsSocket10tcpConnectEv;
-    _ZN7android3net12DnsTlsSocket12readResponseEv;
-    _ZN7android3net12DnsTlsSocket13sslDisconnectEv;
-    _ZN7android3net12DnsTlsSocket4loopEv;
-    _ZN7android3net12DnsTlsSocket5queryEtNS_9netdutils5SliceE;
-    _ZN7android3net12DnsTlsSocket7sslReadENS_9netdutils5SliceEb;
-    _ZN7android3net12DnsTlsSocket8sslWriteENS_9netdutils5SliceE;
-    _ZN7android3net12DnsTlsSocket9sendQueryERKNS1_5QueryE;
-    _ZN7android3net12DnsTlsSocketD0Ev;
-    _ZN7android3net12DnsTlsSocketD1Ev;
-    _ZN7android3net12DnsTlsSocketD2Ev;
-    _ZN7android3net14DnsTlsQueryMap10onResponseENSt3__16vectorIhNS2_9allocatorIhEEEE;
-    _ZN7android3net14DnsTlsQueryMap11recordQueryENS_9netdutils5SliceE;
-    _ZN7android3net14DnsTlsQueryMap5clearEv;
-    _ZN7android3net14DnsTlsQueryMap5emptyEv;
-    _ZN7android3net14DnsTlsQueryMap6expireEPNS1_12QueryPromiseE;
-    _ZN7android3net14DnsTlsQueryMap6getAllEv;
-    _ZN7android3net14DnsTlsQueryMap7cleanupEv;
-    _ZN7android3net14DnsTlsQueryMap9getFreeIdEv;
-    _ZN7android3net14DnsTlsQueryMap9markTriedEt;
-    _ZN7android3net15DnsTlsTransport10onResponseENSt3__16vectorIhNS2_9allocatorIhEEEE;
-    _ZN7android3net15DnsTlsTransport11doReconnectEv;
-    _ZN7android3net15DnsTlsTransport5queryENS_9netdutils5SliceE;
-    _ZN7android3net15DnsTlsTransport8onClosedEv;
-    _ZN7android3net15DnsTlsTransport8validateERKNS0_12DnsTlsServerEjj;
-    _ZN7android3net15DnsTlsTransport9doConnectEv;
-    _ZN7android3net15DnsTlsTransport9sendQueryENS0_14DnsTlsQueryMap5QueryE;
-    _ZN7android3net15DnsTlsTransportD0Ev;
-    _ZN7android3net15DnsTlsTransportD1Ev;
-    _ZN7android3net15DnsTlsTransportD2Ev;
-    _ZN7android3net16DnsTlsDispatcher5queryERKNS0_12DnsTlsServerEjNS_9netdutils5SliceES6_Pi;
-    _ZN7android3net16DnsTlsDispatcher5queryERKNSt3__14listINS0_12DnsTlsServerENS2_9allocatorIS4_EEEEjNS_9netdutils5SliceESB_Pi;
-    _ZN7android3net16DnsTlsDispatcherC1Ev;
-    _ZN7android3net16DnsTlsDispatcherC2Ev;
-    _ZNK7android3net12DnsTlsServer23wasExplicitlyConfiguredEv;
-    _ZNK7android3net12DnsTlsServereqERKS1_;
-    _ZNK7android3net12DnsTlsServerltERKS1_;
-    _ZNK7android3net16DnsTlsDispatcher20getOrderedServerListERKNSt3__14listINS0_12DnsTlsServerENS2_9allocatorIS4_EEEEj;
-    _ZNK7android3net17AddressComparatorclERKNS0_12DnsTlsServerES4_;
-    _ZTVN7android3net15DnsTlsTransportE;
+    resolv_set_private_dns_for_net;
+    resolv_delete_private_dns_for_net;
+    resolv_get_private_dns_status_for_net;
+    resolv_register_private_dns_callback;
   local:
     *;
 };
diff --git a/resolv/res_init.cpp b/resolv/res_init.cpp
index cfb6f08..06d4452 100644
--- a/resolv/res_init.cpp
+++ b/resolv/res_init.cpp
@@ -158,10 +158,9 @@
     statp->pfcode = 0;
     statp->_vcsock = -1;
     statp->_flags = 0;
-    statp->qhook = NULL;
-    statp->rhook = NULL;
     statp->_u._ext.nscount = 0;
     statp->_u._ext.ext = (res_state_ext*) malloc(sizeof(*statp->_u._ext.ext));
+    statp->use_local_nameserver = false;
     if (statp->_u._ext.ext != NULL) {
         memset(statp->_u._ext.ext, 0, sizeof(*statp->_u._ext.ext));
         statp->_u._ext.ext->nsaddrs[0].sin = statp->nsaddr;
@@ -419,9 +418,11 @@
     if (statp != NULL) {
         statp->netid = netcontext->dns_netid;
         statp->_mark = netcontext->dns_mark;
-        statp->qhook = netcontext->qhook;
         if (netcontext->flags & NET_CONTEXT_FLAG_USE_EDNS) {
             statp->options |= RES_USE_EDNS0 | RES_USE_DNSSEC;
         }
+        if (netcontext->flags & NET_CONTEXT_FLAG_USE_LOCAL_NAMESERVERS) {
+            statp->use_local_nameserver = true;
+        }
     }
 }
diff --git a/resolv/res_send.cpp b/resolv/res_send.cpp
index 5a79f28..4c0ca1a 100644
--- a/resolv/res_send.cpp
+++ b/resolv/res_send.cpp
@@ -100,6 +100,10 @@
 
 #include <android-base/logging.h>
 
+#include <netdutils/Slice.h>
+#include "netd_resolv/DnsTlsDispatcher.h"
+#include "netd_resolv/DnsTlsTransport.h"
+#include "netd_resolv/PrivateDnsConfiguration.h"
 #include "netd_resolv/resolv.h"
 #include "netd_resolv/stats.h"
 #include "private/android_filesystem_config.h"
@@ -107,6 +111,8 @@
 #include "resolv_cache.h"
 #include "resolv_private.h"
 
+// TODO: use the namespace something like android::netd_resolv for libnetd_resolv
+using namespace android::net;
 
 #define VLOG if (!kVerboseLogging) {} else LOG(INFO)
 
@@ -134,6 +140,10 @@
     }
 #endif  // DEBUG
 
+typedef enum { res_goahead, res_nextns, res_modified, res_done, res_error } res_sendhookact;
+
+static DnsTlsDispatcher sDnsTlsDispatcher;
+
 static int get_salen(const struct sockaddr*);
 static struct sockaddr* get_nsaddr(res_state, size_t);
 static int send_vc(res_state, struct __res_params* params, const u_char*, int, u_char*, int, int*,
@@ -146,6 +156,7 @@
 static int connect_with_timeout(int sock, const struct sockaddr* nsap, socklen_t salen,
                                 const struct timespec timeout);
 static int retrying_poll(const int sock, short events, const struct timespec* finish);
+static res_sendhookact res_tls_send(res_state, const Slice query, const Slice answer, int* resplen);
 
 /* BIONIC-BEGIN: implement source port randomization */
 
@@ -514,37 +525,40 @@
             statp->_flags |= (ns << RES_F_LASTSHIFT);
 
         same_ns:
-            if (statp->qhook) {
-                int done = 0, loops = 0;
+            int done = 0, loops = 0;
 
-                do {
-                    res_sendhookact act;
+            do {
+                res_sendhookact act;
 
-                    act = (*statp->qhook)(&nsap, &buf, &buflen, ans, anssiz, &resplen);
-                    switch (act) {
-                        case res_goahead:
-                            done = 1;
+                // TODO: This function tries to query on all of private DNS servers. Putting
+                // it here is strange since we should expect there is only one DNS server
+                // being queried. Consider moving it to other reasonable place. In addition,
+                // enum res_sendhookact can be removed.
+                act = res_tls_send(statp, Slice(const_cast<u_char*>(buf), buflen),
+                                   Slice(ans, anssiz), &resplen);
+                switch (act) {
+                    case res_goahead:
+                        done = 1;
+                        break;
+                    case res_nextns:
+                        res_nclose(statp);
+                        goto next_ns;
+                    case res_done:
+                        if (cache_status == RESOLV_CACHE_NOTFOUND) {
+                            _resolv_cache_add(statp->netid, buf, buflen, ans, resplen);
+                        }
+                        return (resplen);
+                    case res_modified:
+                        /* give the hook another try */
+                        if (++loops < 42) /*doug adams*/
                             break;
-                        case res_nextns:
-                            res_nclose(statp);
-                            goto next_ns;
-                        case res_done:
-                            if (cache_status == RESOLV_CACHE_NOTFOUND) {
-                                _resolv_cache_add(statp->netid, buf, buflen, ans, resplen);
-                            }
-                            return (resplen);
-                        case res_modified:
-                            /* give the hook another try */
-                            if (++loops < 42) /*doug adams*/
-                                break;
-                            [[fallthrough]];
-                        case res_error:
-                            [[fallthrough]];
-                        default:
-                            goto fail;
-                    }
-                } while (!done);
-            }
+                        [[fallthrough]];
+                    case res_error:
+                        [[fallthrough]];
+                    default:
+                        goto fail;
+                }
+            } while (!done);
 
             [[maybe_unused]] static const int niflags = NI_NUMERICHOST | NI_NUMERICSERV;
             [[maybe_unused]] char abuf[NI_MAXHOST];
@@ -620,33 +634,6 @@
                 (statp->options & RES_STAYOPEN) == 0U) {
                 res_nclose(statp);
             }
-            if (statp->rhook) {
-                int done = 0, loops = 0;
-
-                do {
-                    res_sendhookact act;
-
-                    act = (*statp->rhook)(nsap, buf, buflen, ans, anssiz, &resplen);
-                    switch (act) {
-                        case res_goahead:
-                        case res_done:
-                            done = 1;
-                            break;
-                        case res_nextns:
-                            res_nclose(statp);
-                            goto next_ns;
-                        case res_modified:
-                            /* give the hook another try */
-                            if (++loops < 42) /*doug adams*/
-                                break;
-                            [[fallthrough]];
-                        case res_error:
-                            [[fallthrough]];
-                        default:
-                            goto fail;
-                    }
-                } while (!done);
-            }
             return (resplen);
         next_ns:;
         }  // for each ns
@@ -1249,3 +1236,59 @@
             return 0;
     }
 }
+
+res_sendhookact res_tls_send(res_state statp, const Slice query, const Slice answer, int* resplen) {
+    const unsigned netId = statp->netid;
+    const unsigned mark = statp->_mark;
+
+    // TLS bypass
+    if (statp->use_local_nameserver) {
+        return res_goahead;
+    }
+
+    const auto privateDnsStatus = gPrivateDnsConfiguration.getStatus(netId);
+
+    if (privateDnsStatus.mode == PrivateDnsMode::OFF) return res_goahead;
+
+    if (privateDnsStatus.validatedServers.empty()) {
+        if (privateDnsStatus.mode == PrivateDnsMode::OPPORTUNISTIC) {
+            return res_goahead;
+        } else {
+            // Sleep and iterate some small number of times checking for the
+            // arrival of resolved and validated server IP addresses, instead
+            // of returning an immediate error.
+            using namespace std::chrono_literals;
+            std::this_thread::sleep_for(100ms);
+            return res_modified;
+        }
+    }
+
+    VLOG << __func__ << ": performing query over TLS";
+
+    const auto response = sDnsTlsDispatcher.query(privateDnsStatus.validatedServers, mark, query,
+                                                  answer, resplen);
+    if (response == DnsTlsTransport::Response::success) {
+        VLOG << __func__ << ": success";
+        return res_done;
+    }
+
+    VLOG << __func__ << ": abort: TLS query failed: " << static_cast<int>(response);
+
+    if (privateDnsStatus.mode == PrivateDnsMode::OPPORTUNISTIC) {
+        // In opportunistic mode, handle falling back to cleartext in some
+        // cases (DNS shouldn't fail if a validated opportunistic mode server
+        // becomes unreachable for some reason).
+        switch (response) {
+            case DnsTlsTransport::Response::network_error:
+            case DnsTlsTransport::Response::internal_error:
+                // Note: this will cause cleartext queries to be emitted, with
+                // all of the EDNS0 goodness enabled. Fingers crossed.  :-/
+                return res_goahead;
+            default:
+                break;
+        }
+    }
+
+    // There was an internal error.  Fail hard.
+    return res_error;
+}
diff --git a/resolv/res_state.cpp b/resolv/res_state.cpp
index 900c56a..325bb6e 100644
--- a/resolv/res_state.cpp
+++ b/resolv/res_state.cpp
@@ -132,10 +132,6 @@
     return rt ? rt->_nres : NULL;
 }
 
-void res_put_state(res_state /*res*/) {
-    /* nothing to do */
-}
-
 res_static* res_get_static(void) {
     _res_thread* rt = res_thread_get();
 
diff --git a/resolv/resolv_private.h b/resolv/resolv_private.h
index d4ee044..879eec7 100644
--- a/resolv/resolv_private.h
+++ b/resolv/resolv_private.h
@@ -126,8 +126,6 @@
         struct in_addr addr;
         uint32_t mask;
     } sort_list[MAXRESOLVSORT];
-    res_send_qhook qhook; /* query hook */
-    res_send_rhook rhook; /* response hook */
     int res_h_errno;      /* last one set for this context */
     unsigned _mark;       /* If non-0 SET_MARK to _mark on all request sockets */
     int _vcsock;          /* PRIVATE: for res_send VC i/o */
@@ -144,6 +142,7 @@
         } _ext;
     } _u;
     struct res_static rstatic[1];
+    bool use_local_nameserver; /* DNS-over-TLS bypass */
 };
 
 typedef struct __res_state* res_state;
@@ -236,7 +235,6 @@
 
 /* Things involving an internal (static) resolver context. */
 struct __res_state* res_get_state(void);
-void res_put_state(struct __res_state*);
 
 void res_close(void);
 int res_init(void);
diff --git a/server/Android.bp b/server/Android.bp
index 49ecba3..99164d8 100644
--- a/server/Android.bp
+++ b/server/Android.bp
@@ -98,7 +98,7 @@
         ":netd_metrics_aidl",
     ],
     shared_libs: [
-        "libbpf",
+        "libbpf_android",
         "libnetd_resolv",
         "libnetdaidl",
         "libbase",
@@ -130,7 +130,7 @@
         "android.system.net.netd@1.1",
         "libbase",
         "libbinder",
-        "libbpf",
+        "libbpf_android",
         "libcrypto",
         "libcutils",
         "libdl",
@@ -222,7 +222,7 @@
     shared_libs: [
         "libbase",
         "libbinder",
-        "libbpf",
+        "libbpf_android",
         "libcrypto",
         "libcutils",
         "liblog",
diff --git a/server/DnsProxyListener.cpp b/server/DnsProxyListener.cpp
index 8f8c38a..c205a4c 100644
--- a/server/DnsProxyListener.cpp
+++ b/server/DnsProxyListener.cpp
@@ -55,8 +55,6 @@
 #include "ResponseCode.h"
 #include "Stopwatch.h"
 #include "android/net/metrics/INetdEventListener.h"
-#include "netd_resolv/DnsTlsDispatcher.h"
-#include "netd_resolv/DnsTlsTransport.h"
 #include "thread_util.h"
 
 using android::String16;
@@ -110,90 +108,16 @@
     return true;
 }
 
-thread_local android_net_context thread_netcontext = {};
-
-DnsTlsDispatcher dnsTlsDispatcher;
-
-void catnap() {
-    using namespace std::chrono_literals;
-    std::this_thread::sleep_for(100ms);
-}
-
-res_sendhookact qhook(sockaddr* const * /*ns*/, const u_char** buf, int* buflen,
-                      u_char* ans, int anssiz, int* resplen) {
-    if (!thread_netcontext.qhook) {
-        ALOGE("qhook abort: thread qhook is null");
-        return res_goahead;
-    }
-    if (thread_netcontext.flags & NET_CONTEXT_FLAG_USE_LOCAL_NAMESERVERS) {
-        return res_goahead;
-    }
-    if (!net::gCtls) {
-        ALOGE("qhook abort: gCtls is null");
-        return res_goahead;
-    }
-
-    const auto privateDnsStatus =
-            net::gCtls->resolverCtrl.getPrivateDnsStatus(thread_netcontext.dns_netid);
-
-    if (privateDnsStatus.mode == PrivateDnsMode::OFF) return res_goahead;
-
-    if (privateDnsStatus.validatedServers.empty()) {
-        if (privateDnsStatus.mode == PrivateDnsMode::OPPORTUNISTIC) {
-            return res_goahead;
-        } else {
-            // Sleep and iterate some small number of times checking for the
-            // arrival of resolved and validated server IP addresses, instead
-            // of returning an immediate error.
-            catnap();
-            return res_modified;
-        }
-    }
-
-    if (DBG) ALOGD("Performing query over TLS");
-
-    Slice query = netdutils::Slice(const_cast<u_char*>(*buf), *buflen);
-    Slice answer = netdutils::Slice(const_cast<u_char*>(ans), anssiz);
-    const auto response = dnsTlsDispatcher.query(
-            privateDnsStatus.validatedServers, thread_netcontext.dns_mark,
-            query, answer, resplen);
-    if (response == DnsTlsTransport::Response::success) {
-        if (DBG) ALOGD("qhook success");
-        return res_done;
-    }
-
-    if (DBG) {
-        ALOGW("qhook abort: TLS query failed: %d", (int)response);
-    }
-
-    if (privateDnsStatus.mode == PrivateDnsMode::OPPORTUNISTIC) {
-        // In opportunistic mode, handle falling back to cleartext in some
-        // cases (DNS shouldn't fail if a validated opportunistic mode server
-        // becomes unreachable for some reason).
-        switch (response) {
-            case DnsTlsTransport::Response::network_error:
-            case DnsTlsTransport::Response::internal_error:
-                // Note: this will cause cleartext queries to be emitted, with
-                // all of the EDNS0 goodness enabled. Fingers crossed.  :-/
-                return res_goahead;
-            default:
-                break;
-        }
-    }
-
-    // There was an internal error.  Fail hard.
-    return res_error;
-}
-
 constexpr bool requestingUseLocalNameservers(unsigned flags) {
     return (flags & NET_CONTEXT_FLAG_USE_LOCAL_NAMESERVERS) != 0;
 }
 
 inline bool queryingViaTls(unsigned dns_netid) {
-    const auto privateDnsStatus = net::gCtls->resolverCtrl.getPrivateDnsStatus(dns_netid);
-    switch (privateDnsStatus.mode) {
+    ExternalPrivateDnsStatus privateDnsStatus = {PrivateDnsMode::OFF, 0, {}};
+    resolv_get_private_dns_status_for_net(dns_netid, &privateDnsStatus);
+    switch (static_cast<PrivateDnsMode>(privateDnsStatus.mode)) {
         case PrivateDnsMode::OPPORTUNISTIC:
-           return !privateDnsStatus.validatedServers.empty();
+            return privateDnsStatus.numServers != 0;
         case PrivateDnsMode::STRICT:
             return true;
         default:
@@ -230,16 +154,6 @@
             ctx->flags |= NET_CONTEXT_FLAG_USE_EDNS;
         }
     }
-
-    // Always set the qhook. An opportunistic mode server might have finished
-    // validating by the time the qhook runs. Note that this races with the
-    // queryingViaTls() check above, resulting in possibly sending queries over
-    // TLS without taking advantage of features like EDNS; c'est la guerre.
-    ctx->qhook = &qhook;
-
-    // Store the android_net_context instance in a thread_local variable
-    // so that the static qhook can access other fields of the struct.
-    thread_netcontext = *ctx;
 }
 
 }  // namespace
@@ -357,7 +271,7 @@
     Stopwatch s;
     maybeFixupNetContext(&mNetContext);
     const uid_t uid = mClient->getUid();
-    uint32_t rv = 0;
+    int32_t rv = 0;
     if (queryLimiter.start(uid)) {
         rv = android_getaddrinfofornetcontext(mHost, mService, mHints, &mNetContext, &result);
         queryLimiter.finish(uid);
@@ -408,13 +322,13 @@
             case INetdEventListener::REPORTING_LEVEL_METRICS:
                 // Metrics reporting is on. Send metrics.
                 mNetdEventListener->onDnsEvent(mNetContext.dns_netid,
-                                               INetdEventListener::EVENT_GETADDRINFO, (int32_t) rv,
+                                               INetdEventListener::EVENT_GETADDRINFO, rv,
                                                latencyMs, String16(""), {}, -1, -1);
                 break;
             case INetdEventListener::REPORTING_LEVEL_FULL:
                 // Full event info reporting is on. Send full info.
                 mNetdEventListener->onDnsEvent(mNetContext.dns_netid,
-                                               INetdEventListener::EVENT_GETADDRINFO, (int32_t) rv,
+                                               INetdEventListener::EVENT_GETADDRINFO, rv,
                                                latencyMs, String16(mHost), ip_addrs,
                                                total_ip_addr_count, mNetContext.uid);
                 break;
@@ -583,10 +497,12 @@
     maybeFixupNetContext(&mNetContext);
     const uid_t uid = mClient->getUid();
     struct hostent* hp = nullptr;
+    int32_t rv = 0;
     if (queryLimiter.start(uid)) {
-        hp = android_gethostbynamefornetcontext(mName, mAf, &mNetContext);
+        rv = android_gethostbynamefornetcontext(mName, mAf, &mNetContext, &hp);
         queryLimiter.finish(uid);
     } else {
+        rv = EAI_MEMORY;
         ALOGE("gethostbyname: from UID %d, max concurrent queries reached", uid);
     }
     const int latencyMs = lround(s.timeTaken());
@@ -600,6 +516,7 @@
 
     bool success = true;
     if (hp) {
+        // hp is not nullptr iff. rv is 0.
         success = mClient->sendCode(ResponseCode::DnsProxyQueryResult) == 0;
         success &= sendhostent(mClient, hp);
     } else {
@@ -638,13 +555,13 @@
                 // Metrics reporting is on. Send metrics.
                 mNetdEventListener->onDnsEvent(mNetContext.dns_netid,
                                                INetdEventListener::EVENT_GETHOSTBYNAME,
-                                               h_errno, latencyMs, String16(""), {}, -1, -1);
+                                               rv, latencyMs, String16(""), {}, -1, -1);
                 break;
             case INetdEventListener::REPORTING_LEVEL_FULL:
                 // Full event info reporting is on. Send full info.
                 mNetdEventListener->onDnsEvent(mNetContext.dns_netid,
                                                INetdEventListener::EVENT_GETHOSTBYNAME,
-                                               h_errno, latencyMs, String16(mName), ip_addrs,
+                                               rv, latencyMs, String16(mName), ip_addrs,
                                                total_ip_addr_count, uid);
                 break;
         }
diff --git a/server/ResolverController.cpp b/server/ResolverController.cpp
index a299120..0b326b0 100644
--- a/server/ResolverController.cpp
+++ b/server/ResolverController.cpp
@@ -38,6 +38,7 @@
 #include <android/net/INetd.h>
 #include <android/net/metrics/INetdEventListener.h>
 
+#include "Controllers.h"
 #include "DumpWriter.h"
 #include "EventReporter.h"
 #include "Fwmark.h"
@@ -45,18 +46,13 @@
 #include "Permission.h"
 #include "ResolverController.h"
 #include "ResolverStats.h"
-#include "netd_resolv/DnsTlsServer.h"
-#include "netd_resolv/DnsTlsTransport.h"
 #include "netd_resolv/params.h"
 #include "netd_resolv/resolv.h"
 #include "netd_resolv/stats.h"
-#include "netdutils/BackoffSequence.h"
 
 namespace android {
-
-using netdutils::BackoffSequence;
-
 namespace net {
+
 namespace {
 
 std::string addrToString(const sockaddr_storage* addr) {
@@ -66,324 +62,50 @@
     return std::string(out);
 }
 
-bool parseServer(const char* server, sockaddr_storage* parsed) {
-    addrinfo hints = {
-        .ai_family = AF_UNSPEC,
-        .ai_flags = AI_NUMERICHOST | AI_NUMERICSERV
-    };
-    addrinfo* res;
-
-    int err = getaddrinfo(server, "853", &hints, &res);
-    if (err != 0) {
-        ALOGW("Failed to parse server address (%s): %s", server, gai_strerror(err));
-        return false;
-    }
-
-    memcpy(parsed, res->ai_addr, res->ai_addrlen);
-    freeaddrinfo(res);
-    return true;
-}
-
 const char* getPrivateDnsModeString(PrivateDnsMode mode) {
     switch (mode) {
-        case PrivateDnsMode::OFF: return "OFF";
-        case PrivateDnsMode::OPPORTUNISTIC: return "OPPORTUNISTIC";
-        case PrivateDnsMode::STRICT: return "STRICT";
+        case PrivateDnsMode::OFF:
+            return "OFF";
+        case PrivateDnsMode::OPPORTUNISTIC:
+            return "OPPORTUNISTIC";
+        case PrivateDnsMode::STRICT:
+            return "STRICT";
     }
 }
 
-constexpr const char* validationStatusToString(ResolverController::Validation value) {
+constexpr const char* validationStatusToString(Validation value) {
     switch (value) {
-        case ResolverController::Validation::in_process:     return "in_process";
-        case ResolverController::Validation::success:        return "success";
-        case ResolverController::Validation::fail:           return "fail";
-        case ResolverController::Validation::unknown_server: return "unknown_server";
-        case ResolverController::Validation::unknown_netid:  return "unknown_netid";
-        default: return "unknown_status";
+        case Validation::in_process:
+            return "in_process";
+        case Validation::success:
+            return "success";
+        case Validation::fail:
+            return "fail";
+        case Validation::unknown_server:
+            return "unknown_server";
+        case Validation::unknown_netid:
+            return "unknown_netid";
+        default:
+            return "unknown_status";
     }
 }
 
-
-class PrivateDnsConfiguration {
-  public:
-    typedef ResolverController::PrivateDnsStatus PrivateDnsStatus;
-    typedef ResolverController::Validation Validation;
-    typedef std::map<DnsTlsServer, Validation, AddressComparator> PrivateDnsTracker;
-
-    int set(uint32_t netId, uint32_t mark, const std::vector<std::string>& servers,
-            const std::string& name, const std::set<std::vector<uint8_t>>& fingerprints) {
+void onPrivateDnsValidation(unsigned netId, const char* server, const char* hostname,
+                            bool success) {
+    // Send a validation event to NetdEventListenerService.
+    const auto netdEventListener = net::gCtls->eventReporter.getNetdEventListener();
+    if (netdEventListener != nullptr) {
+        netdEventListener->onPrivateDnsValidationEvent(netId, android::String16(server),
+                                                       android::String16(hostname), success);
         if (DBG) {
-            ALOGD("PrivateDnsConfiguration::set(%u, 0x%x, %zu, %s, %zu)", netId, mark,
-                  servers.size(), name.c_str(), fingerprints.size());
+            ALOGD("Sending validation %s event on netId %u for %s with hostname %s",
+                  success ? "success" : "failure", netId, server, hostname);
         }
 
-        const bool explicitlyConfigured = !name.empty() || !fingerprints.empty();
-
-        // Parse the list of servers that has been passed in
-        std::set<DnsTlsServer> tlsServers;
-        for (size_t i = 0; i < servers.size(); ++i) {
-            sockaddr_storage parsed;
-            if (!parseServer(servers[i].c_str(), &parsed)) {
-                return -EINVAL;
-            }
-            DnsTlsServer server(parsed);
-            server.name = name;
-            server.fingerprints = fingerprints;
-            tlsServers.insert(server);
-        }
-
-        std::lock_guard guard(mPrivateDnsLock);
-        if (explicitlyConfigured) {
-            mPrivateDnsModes[netId] = PrivateDnsMode::STRICT;
-        } else if (!tlsServers.empty()) {
-            mPrivateDnsModes[netId] = PrivateDnsMode::OPPORTUNISTIC;
-        } else {
-            mPrivateDnsModes[netId] = PrivateDnsMode::OFF;
-            mPrivateDnsTransports.erase(netId);
-            return 0;
-        }
-
-        // Create the tracker if it was not present
-        auto netPair = mPrivateDnsTransports.find(netId);
-        if (netPair == mPrivateDnsTransports.end()) {
-            // No TLS tracker yet for this netId.
-            bool added;
-            std::tie(netPair, added) = mPrivateDnsTransports.emplace(netId, PrivateDnsTracker());
-            if (!added) {
-                ALOGE("Memory error while recording private DNS for netId %d", netId);
-                return -ENOMEM;
-            }
-        }
-        auto& tracker = netPair->second;
-
-        // Remove any servers from the tracker that are not in |servers| exactly.
-        for (auto it = tracker.begin(); it != tracker.end();) {
-            if (tlsServers.count(it->first) == 0) {
-                it = tracker.erase(it);
-            } else {
-                ++it;
-            }
-        }
-
-        // Add any new or changed servers to the tracker, and initiate async checks for them.
-        for (const auto& server : tlsServers) {
-            if (needsValidation(tracker, server)) {
-                validatePrivateDnsProvider(server, tracker, netId, mark);
-            }
-        }
-        return 0;
+    } else {
+        ALOGE("Validation event not sent since NetdEventListenerService is unavailable.");
     }
-
-    PrivateDnsStatus getStatus(unsigned netId) {
-        PrivateDnsStatus status{PrivateDnsMode::OFF, {}};
-
-        // This mutex is on the critical path of every DNS lookup.
-        //
-        // If the overhead of mutex acquisition proves too high, we could reduce
-        // it by maintaining an atomic_int32_t counter of TLS-enabled netids, or
-        // by using an RWLock.
-        std::lock_guard guard(mPrivateDnsLock);
-
-        const auto mode = mPrivateDnsModes.find(netId);
-        if (mode == mPrivateDnsModes.end()) return status;
-        status.mode = mode->second;
-
-        const auto netPair = mPrivateDnsTransports.find(netId);
-        if (netPair != mPrivateDnsTransports.end()) {
-            for (const auto& serverPair : netPair->second) {
-                if (serverPair.second == Validation::success) {
-                    status.validatedServers.push_back(serverPair.first);
-                }
-            }
-        }
-
-        return status;
-    }
-
-    void clear(unsigned netId) {
-        if (DBG) {
-            ALOGD("PrivateDnsConfiguration::clear(%u)", netId);
-        }
-        std::lock_guard guard(mPrivateDnsLock);
-        mPrivateDnsModes.erase(netId);
-        mPrivateDnsTransports.erase(netId);
-    }
-
-    void dump(DumpWriter& dw, unsigned netId) {
-        std::lock_guard guard(mPrivateDnsLock);
-
-        const auto& mode = mPrivateDnsModes.find(netId);
-        dw.println("Private DNS mode: %s", getPrivateDnsModeString(
-                (mode != mPrivateDnsModes.end()) ? mode->second : PrivateDnsMode::OFF));
-        const auto& netPair = mPrivateDnsTransports.find(netId);
-        if (netPair == mPrivateDnsTransports.end()) {
-            dw.println("No Private DNS servers configured");
-        } else {
-            const auto& tracker = netPair->second;
-            dw.println("Private DNS configuration (%zu entries)", tracker.size());
-            dw.incIndent();
-            for (const auto& kv : tracker) {
-                const auto& server = kv.first;
-                const auto status = kv.second;
-                dw.println("%s name{%s} status{%s}",
-                        addrToString(&(server.ss)).c_str(),
-                        server.name.c_str(),
-                        validationStatusToString(status));
-            }
-            dw.decIndent();
-        }
-    }
-
-  private:
-    void validatePrivateDnsProvider(const DnsTlsServer& server, PrivateDnsTracker& tracker,
-                                    unsigned netId, uint32_t mark) REQUIRES(mPrivateDnsLock) {
-        if (DBG) {
-            ALOGD("validatePrivateDnsProvider(%s, %u)", addrToString(&(server.ss)).c_str(), netId);
-        }
-
-        tracker[server] = Validation::in_process;
-        if (DBG) {
-            ALOGD("Server %s marked as in_process.  Tracker now has size %zu",
-                    addrToString(&(server.ss)).c_str(), tracker.size());
-        }
-        // Note that capturing |server| and |netId| in this lambda create copies.
-        std::thread validate_thread([this, server, netId, mark] {
-            // cat /proc/sys/net/ipv4/tcp_syn_retries yields "6".
-            //
-            // Start with a 1 minute delay and backoff to once per hour.
-            //
-            // Assumptions:
-            //     [1] Each TLS validation is ~10KB of certs+handshake+payload.
-            //     [2] Network typically provision clients with <=4 nameservers.
-            //     [3] Average month has 30 days.
-            //
-            // Each validation pass in a given hour is ~1.2MB of data. And 24
-            // such validation passes per day is about ~30MB per month, in the
-            // worst case. Otherwise, this will cost ~600 SYNs per month
-            // (6 SYNs per ip, 4 ips per validation pass, 24 passes per day).
-            auto backoff = BackoffSequence<>::Builder()
-                    .withInitialRetransmissionTime(std::chrono::seconds(60))
-                    .withMaximumRetransmissionTime(std::chrono::seconds(3600))
-                    .build();
-
-            while (true) {
-                // ::validate() is a blocking call that performs network operations.
-                // It can take milliseconds to minutes, up to the SYN retry limit.
-                const bool success = DnsTlsTransport::validate(server, netId, mark);
-                if (DBG) {
-                    ALOGD("validateDnsTlsServer returned %d for %s", success,
-                            addrToString(&(server.ss)).c_str());
-                }
-
-                const bool needs_reeval = this->recordPrivateDnsValidation(server, netId, success);
-                if (!needs_reeval) {
-                    break;
-                }
-
-                if (backoff.hasNextTimeout()) {
-                    std::this_thread::sleep_for(backoff.getNextTimeout());
-                } else {
-                    break;
-                }
-            }
-        });
-        validate_thread.detach();
-    }
-
-    bool recordPrivateDnsValidation(const DnsTlsServer& server, unsigned netId, bool success) {
-        constexpr bool NEEDS_REEVALUATION = true;
-        constexpr bool DONT_REEVALUATE = false;
-
-        std::lock_guard guard(mPrivateDnsLock);
-
-        auto netPair = mPrivateDnsTransports.find(netId);
-        if (netPair == mPrivateDnsTransports.end()) {
-            ALOGW("netId %u was erased during private DNS validation", netId);
-            return DONT_REEVALUATE;
-        }
-
-        const auto mode = mPrivateDnsModes.find(netId);
-        if (mode == mPrivateDnsModes.end()) {
-            ALOGW("netId %u has no private DNS validation mode", netId);
-            return DONT_REEVALUATE;
-        }
-        const bool modeDoesReevaluation = (mode->second == PrivateDnsMode::STRICT);
-
-        bool reevaluationStatus =
-                (success || !modeDoesReevaluation) ? DONT_REEVALUATE : NEEDS_REEVALUATION;
-
-        auto& tracker = netPair->second;
-        auto serverPair = tracker.find(server);
-        if (serverPair == tracker.end()) {
-            ALOGW("Server %s was removed during private DNS validation",
-                    addrToString(&(server.ss)).c_str());
-            success = false;
-            reevaluationStatus = DONT_REEVALUATE;
-        } else if (!(serverPair->first == server)) {
-            // TODO: It doesn't seem correct to overwrite the tracker entry for
-            // |server| down below in this circumstance... Fix this.
-            ALOGW("Server %s was changed during private DNS validation",
-                    addrToString(&(server.ss)).c_str());
-            success = false;
-            reevaluationStatus = DONT_REEVALUATE;
-        }
-
-        // Send a validation event to NetdEventListenerService.
-        if (mNetdEventListener == nullptr) {
-            mNetdEventListener = mEventReporter.getNetdEventListener();
-        }
-        if (mNetdEventListener != nullptr) {
-            const String16 ipLiteral(addrToString(&(server.ss)).c_str());
-            const String16 hostname(server.name.empty() ? "" : server.name.c_str());
-            mNetdEventListener->onPrivateDnsValidationEvent(netId, ipLiteral, hostname, success);
-            if (DBG) {
-                ALOGD("Sending validation %s event on netId %u for %s with hostname %s",
-                        success ? "success" : "failure", netId,
-                        addrToString(&(server.ss)).c_str(), server.name.c_str());
-            }
-        } else {
-            ALOGE("Validation event not sent since NetdEventListenerService is unavailable.");
-        }
-
-        if (success) {
-            tracker[server] = Validation::success;
-            if (DBG) {
-                ALOGD("Validation succeeded for %s! Tracker now has %zu entries.",
-                        addrToString(&(server.ss)).c_str(), tracker.size());
-            }
-        } else {
-            // Validation failure is expected if a user is on a captive portal.
-            // TODO: Trigger a second validation attempt after captive portal login
-            // succeeds.
-            tracker[server] = (reevaluationStatus == NEEDS_REEVALUATION) ? Validation::in_process
-                                                                         : Validation::fail;
-            if (DBG) {
-                ALOGD("Validation failed for %s!", addrToString(&(server.ss)).c_str());
-            }
-        }
-
-        return reevaluationStatus;
-    }
-
-    // Start validation for newly added servers as well as any servers that have
-    // landed in Validation::fail state. Note that servers that have failed
-    // multiple validation attempts but for which there is still a validating
-    // thread running are marked as being Validation::in_process.
-    static bool needsValidation(const PrivateDnsTracker& tracker, const DnsTlsServer& server) {
-        const auto& iter = tracker.find(server);
-        return (iter == tracker.end()) || (iter->second == Validation::fail);
-    }
-
-    EventReporter mEventReporter;
-
-    std::mutex mPrivateDnsLock;
-    std::map<unsigned, PrivateDnsMode> mPrivateDnsModes GUARDED_BY(mPrivateDnsLock);
-    // Structure for tracking the validation status of servers on a specific netId.
-    // Using the AddressComparator ensures at most one entry per IP address.
-    std::map<unsigned, PrivateDnsTracker> mPrivateDnsTransports GUARDED_BY(mPrivateDnsLock);
-    android::sp<android::net::metrics::INetdEventListener>
-            mNetdEventListener GUARDED_BY(mPrivateDnsLock);
-} sPrivateDnsConfiguration;
+}
 
 bool allIPv6Only(const std::vector<std::string>& servers) {
     for (const auto& server : servers) {
@@ -402,18 +124,13 @@
     return -resolv_set_nameservers_for_net(netId, servers, numservers, searchDomains, params);
 }
 
-ResolverController::PrivateDnsStatus
-ResolverController::getPrivateDnsStatus(unsigned netId) const {
-    return sPrivateDnsConfiguration.getStatus(netId);
-}
-
 int ResolverController::clearDnsServers(unsigned netId) {
     resolv_set_nameservers_for_net(netId, nullptr, 0, "", nullptr);
     if (DBG) {
         ALOGD("clearDnsServers netId = %u\n", netId);
     }
     mDns64Configuration.stopPrefixDiscovery(netId);
-    sPrivateDnsConfiguration.clear(netId);
+    resolv_delete_private_dns_for_net(netId);
     return 0;
 }
 
@@ -512,6 +229,20 @@
         return -EINVAL;
     }
 
+    std::vector<const char*> server_ptrs;
+    size_t count = std::min<size_t>(MAXNS, tlsServers.size());
+    server_ptrs.reserve(count);
+    for (size_t i = 0; i < count; i++) {
+        server_ptrs.push_back(tlsServers[i].data());
+    }
+
+    std::vector<const uint8_t*> fingerprint_ptrs;
+    count = tlsFingerprints.size();
+    fingerprint_ptrs.reserve(count);
+    for (const auto& fp : tlsFingerprints) {
+        fingerprint_ptrs.push_back(fp.data());
+    }
+
     // At private DNS validation time, we only know the netId, so we have to guess/compute the
     // corresponding socket mark.
     Fwmark fwmark;
@@ -520,16 +251,19 @@
     fwmark.protectedFromVpn = true;
     fwmark.permission = PERMISSION_SYSTEM;
 
-    const int err = sPrivateDnsConfiguration.set(netId, fwmark.intValue, tlsServers, tlsName,
-                                                 tlsFingerprints);
+    const int err = resolv_set_private_dns_for_net(
+            netId, fwmark.intValue, server_ptrs.data(), server_ptrs.size(), tlsName.c_str(),
+            fingerprint_ptrs.data(), fingerprint_ptrs.size());
     if (err != 0) {
         return err;
     }
+    resolv_register_private_dns_callback(&onPrivateDnsValidation);
 
     // Convert network-assigned server list to bionic's format.
-    auto server_count = std::min<size_t>(MAXNS, servers.size());
-    std::vector<const char*> server_ptrs;
-    for (size_t i = 0 ; i < server_count ; ++i) {
+    server_ptrs.clear();
+    count = std::min<size_t>(MAXNS, servers.size());
+    server_ptrs.reserve(count);
+    for (size_t i = 0; i < count; ++i) {
         server_ptrs.push_back(servers[i].c_str());
     }
 
@@ -653,7 +387,24 @@
         }
 
         mDns64Configuration.dump(dw, netId);
-        sPrivateDnsConfiguration.dump(dw, netId);
+        ExternalPrivateDnsStatus privateDnsStatus = {PrivateDnsMode::OFF, 0, {}};
+        resolv_get_private_dns_status_for_net(netId, &privateDnsStatus);
+        dw.println("Private DNS mode: %s",
+                   getPrivateDnsModeString(static_cast<PrivateDnsMode>(privateDnsStatus.mode)));
+        if (!privateDnsStatus.numServers) {
+            dw.println("No Private DNS servers configured");
+        } else {
+            dw.println("Private DNS configuration (%u entries)", privateDnsStatus.numServers);
+            dw.incIndent();
+            for (int i = 0; i < privateDnsStatus.numServers; i++) {
+                dw.println("%s name{%s} status{%s}",
+                           addrToString(&(privateDnsStatus.serverStatus[i].ss)).c_str(),
+                           privateDnsStatus.serverStatus[i].hostname,
+                           validationStatusToString(static_cast<Validation>(
+                                   privateDnsStatus.serverStatus[i].validation)));
+            }
+            dw.decIndent();
+        }
     }
     dw.decIndent();
 }
diff --git a/server/ResolverController.h b/server/ResolverController.h
index a99bbee..ea95ee4 100644
--- a/server/ResolverController.h
+++ b/server/ResolverController.h
@@ -27,17 +27,9 @@
 namespace android {
 namespace net {
 
-struct DnsTlsServer;
 class DumpWriter;
 struct ResolverStats;
 
-enum class PrivateDnsMode {
-    OFF,
-    OPPORTUNISTIC,
-    STRICT,
-};
-
-
 class ResolverController {
   public:
     ResolverController(const NetworkController& netCtrl) : mDns64Configuration(netCtrl) {}
@@ -48,20 +40,6 @@
     int setDnsServers(unsigned netId, const char* searchDomains, const char** servers,
             int numservers, const __res_params* params);
 
-    // Validation status of a DNS over TLS server (on a specific netId).
-    enum class Validation : uint8_t { in_process, success, fail, unknown_server, unknown_netid };
-
-    struct PrivateDnsStatus {
-        PrivateDnsMode mode;
-        std::list<DnsTlsServer> validatedServers;
-    };
-
-    // Retrieve the Private DNS status for the given |netid|.
-    //
-    // If the requested |netid| is not known, the PrivateDnsStatus's mode has a
-    // default value of PrivateDnsMode::OFF, and validatedServers is empty.
-    PrivateDnsStatus getPrivateDnsStatus(unsigned netid) const;
-
     int clearDnsServers(unsigned netid);
 
     int flushDnsCache(unsigned netid);
diff --git a/tests/Android.bp b/tests/Android.bp
index a757e32..5b35fdc 100644
--- a/tests/Android.bp
+++ b/tests/Android.bp
@@ -62,7 +62,7 @@
         "libcap",
         "libnetd_test_dnsresponder",
         "libnetd_test_tun_interface",
-        "libbpf",
+        "libbpf_android",
         "liblogwrap",
         "libnetdaidl",
         "libnetdbpf",
diff --git a/tests/benchmarks/Android.bp b/tests/benchmarks/Android.bp
index 08a75e0..d2079c1 100644
--- a/tests/benchmarks/Android.bp
+++ b/tests/benchmarks/Android.bp
@@ -39,7 +39,7 @@
     defaults: ["netd_defaults"],
     shared_libs: [
         "libbase",
-        "libbpf",
+        "libbpf_android",
         "libnetdutils",
     ],
     static_libs: [