diff --git a/server/NetlinkHandler.cpp b/server/NetlinkHandler.cpp
index 9b033ff..2bc9c27 100644
--- a/server/NetlinkHandler.cpp
+++ b/server/NetlinkHandler.cpp
@@ -55,6 +55,18 @@
     return this->stopListener();
 }
 
+static long parseIfIndex(const char* ifIndex) {
+    if (ifIndex == nullptr) {
+        return 0;
+    }
+    long ifaceIndex = strtol(ifIndex, NULL, 10);
+    // strtol returns 0 on error, which is fine because 0 is not a valid ifindex.
+    if (errno == ERANGE && (ifaceIndex == LONG_MAX || ifaceIndex == LONG_MIN)) {
+        return 0;
+    }
+    return ifaceIndex;
+}
+
 void NetlinkHandler::onEvent(NetlinkEvent *evt) {
     const char *subsys = evt->getSubsystem();
     if (!subsys) {
@@ -69,15 +81,11 @@
             (action == NetlinkEvent::Action::kLinkUp) ||
             (action == NetlinkEvent::Action::kLinkDown)) {
             const char *ifIndex = evt->findParam("IFINDEX");
-            if (ifIndex) {
-                // strtol returns 0 on error, which is fine because 0 is not a valid ifindex.
-                long ifaceIndex = strtol(ifIndex, NULL, 10);
-                if (ifaceIndex == 0 ||
-                    (errno == ERANGE && (ifaceIndex == LONG_MAX || ifaceIndex == LONG_MIN))) {
-                    ALOGE("invalid interface index: %s(%s)", iface, ifIndex);
-                } else {
-                    gCtls->trafficCtrl.addInterface(iface, ifaceIndex);
-                }
+            long ifaceIndex = parseIfIndex(ifIndex);
+            if (ifaceIndex) {
+                gCtls->trafficCtrl.addInterface(iface, ifaceIndex);
+            } else {
+                ALOGE("invalid interface index: %s(%s)", iface, ifIndex);
             }
         }
 
@@ -97,25 +105,35 @@
             const char *address = evt->findParam("ADDRESS");
             const char *flags = evt->findParam("FLAGS");
             const char *scope = evt->findParam("SCOPE");
-            if (action == NetlinkEvent::Action::kAddressRemoved && iface && address) {
-                // Note: if this interface was deleted, iface is "" and we don't notify.
-                SockDiag sd;
-                if (sd.open()) {
-                    char addrstr[INET6_ADDRSTRLEN];
-                    strncpy(addrstr, address, sizeof(addrstr));
-                    char *slash = strchr(addrstr, '/');
-                    if (slash) {
-                        *slash = '\0';
-                    }
+            const char *ifIndex = evt->findParam("IFINDEX");
+            char addrstr[INET6_ADDRSTRLEN + strlen("/128")];
+            strlcpy(addrstr, address, sizeof(addrstr));
+            char *slash = strchr(addrstr, '/');
+            if (slash) {
+                *slash = '\0';
+            }
 
-                    int ret = sd.destroySockets(addrstr);
-                    if (ret < 0) {
-                        ALOGE("Error destroying sockets: %s", strerror(ret));
+            long ifaceIndex = parseIfIndex(ifIndex);
+            if (!ifaceIndex) {
+                ALOGE("invalid interface index: %s(%s)", iface, ifIndex);
+            }
+            if (action == NetlinkEvent::Action::kAddressUpdated) {
+                gCtls->netCtrl.addInterfaceAddress(ifaceIndex, address);
+            } else {  // action == NetlinkEvent::Action::kAddressRemoved
+                bool shouldDestroy = gCtls->netCtrl.removeInterfaceAddress(ifaceIndex, address);
+                if (shouldDestroy) {
+                    SockDiag sd;
+                    if (sd.open()) {
+                        int ret = sd.destroySockets(addrstr);
+                        if (ret < 0) {
+                            ALOGE("Error destroying sockets: %s", strerror(-ret));
+                        }
+                    } else {
+                        ALOGE("Error opening NETLINK_SOCK_DIAG socket: %s", strerror(errno));
                     }
-                } else {
-                    ALOGE("Error opening NETLINK_SOCK_DIAG socket: %s", strerror(errno));
                 }
             }
+            // Note: if this interface was deleted, iface is "" and we don't notify.
             if (iface && iface[0] && address && flags && scope) {
                 notifyAddressChanged(action, address, iface, flags, scope);
             }
diff --git a/server/NetworkController.cpp b/server/NetworkController.cpp
index 5b2cd89..5bbfe3f 100644
--- a/server/NetworkController.cpp
+++ b/server/NetworkController.cpp
@@ -28,6 +28,8 @@
 #define LOG_TAG "Netd"
 #include "log/log.h"
 
+#include <android-base/strings.h>
+
 #include "cutils/misc.h"
 #include "resolv_netid.h"
 
@@ -192,6 +194,19 @@
     Fwmark fwmark;
     fwmark.protectedFromVpn = true;
     fwmark.permission = PERMISSION_SYSTEM;
+
+    // Common case: there is no VPN that applies to the user, and the query did not specify a netId.
+    // Therefore, it is safe to set the explicit bit on this query and skip all the complex logic
+    // below. While this looks like a special case, it is actually the one that handles the vast
+    // majority of DNS queries.
+    // TODO: untangle this code.
+    if (*netId == NETID_UNSET && getVirtualNetworkForUserLocked(uid) == nullptr) {
+        *netId = mDefaultNetId;
+        fwmark.netId = *netId;
+        fwmark.explicitlySelected = true;
+        return fwmark.intValue;
+    }
+
     if (checkUserNetworkAccessLocked(uid, *netId) == 0) {
         // If a non-zero NetId was explicitly specified, and the user has permission for that
         // network, use that network's DNS servers. Do not fall through to the default network even
@@ -210,7 +225,8 @@
     } else {
         // If the user is subject to a VPN and the VPN provides DNS servers, use those servers
         // (possibly falling through to the default network if the VPN doesn't provide a route to
-        // them). Otherwise, use the default network's DNS servers.
+        // them). Otherwise, use the default network's DNS servers. We cannot set the explicit bit
+        // because we need to be able to fall through a split tunnel to the default network.
         VirtualNetwork* virtualNetwork = getVirtualNetworkForUserLocked(uid);
         if (virtualNetwork && virtualNetwork->getHasDns()) {
             *netId = virtualNetwork->getNetId();
@@ -331,6 +347,10 @@
 
 bool NetworkController::isVirtualNetwork(unsigned netId) const {
     android::RWLock::AutoRLock lock(mRWLock);
+    return isVirtualNetworkLocked(netId);
+}
+
+bool NetworkController::isVirtualNetworkLocked(unsigned netId) const {
     Network* network = getNetworkLocked(netId);
     return network && network->getType() == Network::VIRTUAL;
 }
@@ -452,6 +472,14 @@
     delete network;
     _resolv_delete_cache_for_net(netId);
 
+    for (auto iter = mIfindexToLastNetId.begin(); iter != mIfindexToLastNetId.end();) {
+        if (iter->second == netId) {
+            iter = mIfindexToLastNetId.erase(iter);
+        } else {
+            ++iter;
+        }
+    }
+
     updateTcpSocketMonitorPolling();
 
     return ret;
@@ -470,8 +498,18 @@
         ALOGE("interface %s already assigned to netId %u", interface, existingNetId);
         return -EBUSY;
     }
+    if (int ret = getNetworkLocked(netId)->addInterface(interface)) {
+        return ret;
+    }
 
-    return getNetworkLocked(netId)->addInterface(interface);
+    int ifIndex = RouteController::getIfIndex(interface);
+    if (ifIndex) {
+        mIfindexToLastNetId[ifIndex] = netId;
+    } else {
+        // Cannot happen, since addInterface() above will have failed.
+        ALOGE("inconceivable! added interface %s with no index", interface);
+    }
+    return 0;
 }
 
 int NetworkController::removeInterfaceFromNetwork(unsigned netId, const char* interface) {
@@ -569,6 +607,53 @@
     return modifyRoute(netId, interface, destination, nexthop, false, legacy, uid);
 }
 
+void NetworkController::addInterfaceAddress(unsigned ifIndex, const char* address) {
+    android::RWLock::AutoWLock lock(mRWLock);
+
+    if (ifIndex == 0) {
+        ALOGE("Attempting to add address %s without ifindex", address);
+        return;
+    }
+    mAddressToIfindices[address].insert(ifIndex);
+}
+
+// Returns whether we should call SOCK_DESTROY on the removed address.
+bool NetworkController::removeInterfaceAddress(unsigned ifindex, const char* address) {
+    android::RWLock::AutoWLock lock(mRWLock);
+    // First, update mAddressToIfindices map
+    auto ifindicesIter = mAddressToIfindices.find(address);
+    if (ifindicesIter == mAddressToIfindices.end()) {
+        ALOGE("Removing unknown address %s from ifindex %u", address, ifindex);
+        return true;
+    }
+    std::unordered_set<unsigned>& ifindices = ifindicesIter->second;
+    if (ifindices.erase(ifindex) > 0) {
+        if (ifindices.size() == 0) {
+            mAddressToIfindices.erase(ifindicesIter);
+        }
+    } else {
+        ALOGE("No record of address %s on interface %u", address, ifindex);
+        return true;
+    }
+    // Then, check for VPN handover condition
+    if (mIfindexToLastNetId.find(ifindex) == mIfindexToLastNetId.end()) {
+        ALOGE("Interface index %u was never in a currently-connected netId", ifindex);
+        return true;
+    }
+    unsigned lastNetId = mIfindexToLastNetId[ifindex];
+    for (unsigned idx : ifindices) {
+        unsigned activeNetId = mIfindexToLastNetId[idx];
+        // If this IP address is still assigned to another interface in the same network,
+        // then we don't need to destroy sockets on it because they are likely still valid.
+        // For now we do this only on VPNs.
+        // TODO: evaluate extending this to all network types.
+        if (lastNetId == activeNetId && isVirtualNetworkLocked(activeNetId)) {
+            return false;
+        }
+    }
+    return true;
+}
+
 bool NetworkController::canProtectLocked(uid_t uid) const {
     return ((getPermissionForUserLocked(uid) & PERMISSION_SYSTEM) == PERMISSION_SYSTEM) ||
            mProtectableUsers.find(uid) != mProtectableUsers.end();
@@ -617,6 +702,23 @@
     }
     dw.decIndent();
 
+    dw.blankline();
+    dw.println("Interface <-> last network map:");
+    dw.incIndent();
+    for (const auto& i : mIfindexToLastNetId) {
+        dw.println("Ifindex: %u NetId: %u", i.first, i.second);
+    }
+    dw.decIndent();
+
+    dw.blankline();
+    dw.println("Interface addresses:");
+    dw.incIndent();
+    for (const auto& i : mAddressToIfindices) {
+        dw.println("address: %s ifindices: [%s]", i.first.c_str(),
+                android::base::Join(i.second, ", ").c_str());
+    }
+    dw.decIndent();
+
     dw.decIndent();
 
     dw.decIndent();
diff --git a/server/NetworkController.h b/server/NetworkController.h
index 627e44d..5e7af80 100644
--- a/server/NetworkController.h
+++ b/server/NetworkController.h
@@ -27,6 +27,8 @@
 #include <map>
 #include <set>
 #include <sys/types.h>
+#include <unordered_map>
+#include <unordered_set>
 #include <vector>
 
 struct android_net_context;
@@ -123,6 +125,12 @@
     int removeRoute(unsigned netId, const char* interface, const char* destination,
                     const char* nexthop, bool legacy, uid_t uid) WARN_UNUSED_RESULT;
 
+    // Notes that the specified address has appeared on the specified interface.
+    void addInterfaceAddress(unsigned ifIndex, const char* address);
+    // Notes that the specified address has been removed from the specified interface.
+    // Returns true if we should destroy sockets on this address.
+    bool removeInterfaceAddress(unsigned ifIndex, const char* address);
+
     bool canProtect(uid_t uid) const;
     void allowProtect(const std::vector<uid_t>& uids);
     void denyProtect(const std::vector<uid_t>& uids);
@@ -137,6 +145,7 @@
     unsigned getNetworkForConnectLocked(uid_t uid) const;
     unsigned getNetworkForInterfaceLocked(const char* interface) const;
     bool canProtectLocked(uid_t uid) const;
+    bool isVirtualNetworkLocked(unsigned netId) const;
 
     VirtualNetwork* getVirtualNetworkForUserLocked(uid_t uid) const;
     Permission getPermissionForUserLocked(uid_t uid) const;
@@ -151,12 +160,27 @@
     class DelegateImpl;
     DelegateImpl* const mDelegateImpl;
 
-    // mRWLock guards all accesses to mDefaultNetId, mNetworks, mUsers and mProtectableUsers.
+    // mRWLock guards all accesses to mDefaultNetId, mNetworks, mUsers, mProtectableUsers,
+    // mIfindexToLastNetId and mAddressToIfindices.
     mutable android::RWLock mRWLock;
     unsigned mDefaultNetId;
     std::map<unsigned, Network*> mNetworks;  // Map keys are NetIds.
     std::map<uid_t, Permission> mUsers;
     std::set<uid_t> mProtectableUsers;
+    // Map interface (ifIndex) to its current NetId, or the last NetId if the interface was removed
+    // from the network and not added to another network. This state facilitates the interface to
+    // NetId lookup during RTM_DELADDR (NetworkController::removeInterfaceAddress), when the
+    // interface in question might already have been removed from the network.
+    // An interface is added to this map when it is added to a network and removed from this map
+    // when its network is destroyed.
+    std::unordered_map<unsigned, unsigned> mIfindexToLastNetId;
+    // Map IP address to the list of active interfaces (ifIndex) that have that address.
+    // Also contains IP addresses configured on interfaces that have not been added to any network.
+    // TODO: Does not track IP addresses present when netd is started or restarts after a crash.
+    // This is not a problem for its intended use (tracking IP addresses on VPN interfaces), but
+    // we should fix it.
+    std::unordered_map<std::string, std::unordered_set<unsigned>> mAddressToIfindices;
+
 };
 
 }  // namespace net
diff --git a/server/RouteController.cpp b/server/RouteController.cpp
index b1aa5ac..c78854d 100644
--- a/server/RouteController.cpp
+++ b/server/RouteController.cpp
@@ -154,6 +154,18 @@
     return iter->second;
 }
 
+uint32_t RouteController::getIfIndex(const char* interface) {
+    android::RWLock::AutoRLock lock(sInterfaceToTableLock);
+
+    auto iter = sInterfaceToTable.find(interface);
+    if (iter == sInterfaceToTable.end()) {
+        ALOGE("getIfIndex: cannot find interface %s", interface);
+        return 0;
+    }
+
+    return iter->second - ROUTE_TABLE_OFFSET_FROM_INDEX;
+}
+
 uint32_t RouteController::getRouteTableForInterface(const char* interface) {
     android::RWLock::AutoRLock lock(sInterfaceToTableLock);
     return getRouteTableForInterfaceLocked(interface);
diff --git a/server/RouteController.h b/server/RouteController.h
index de79b61..6e10cce 100644
--- a/server/RouteController.h
+++ b/server/RouteController.h
@@ -45,6 +45,15 @@
 
     static int Init(unsigned localNetId) WARN_UNUSED_RESULT;
 
+    // Returns an ifindex given the interface name, by looking up in sInterfaceToTable.
+    // This is currently only used by NetworkController::addInterfaceToNetwork
+    // and should probabaly be changed to passing the ifindex into RouteController instead.
+    // We do this instead of calling if_nametoindex because the same interface name can
+    // correspond to different interface indices over time. This way, even if the interface
+    // index has changed, we can still free any map entries indexed by the ifindex that was
+    // used to add them.
+    static uint32_t getIfIndex(const char* interface);
+
     static int addInterfaceToLocalNetwork(unsigned netId, const char* interface) WARN_UNUSED_RESULT;
     static int removeInterfaceFromLocalNetwork(unsigned netId,
                                                const char* interface) WARN_UNUSED_RESULT;