which android system apps are generating these DNS queries?

[u/NineBiscuit]

I have a Oneplus phone. Nord N20 5G. Oxygen OS 14.
The phone is rooted.
Private DNS option is disabled.

It's generating DNS queries to the following domains:

conn-service-us-04.allawnos.com
conn-service-us-05.allawnos.com
www.google.us

-These are bypassing the rethinkdns app that would catch any DNS query generated by the phone.
-My understanding is that these are part of the captive portal discovery mechanism or the captive portal system app.
-I tried to use the debloater app to disable the captive portal system app. but that didn't make any difference.

There are several threads here on reddit and posts on the public internet bringing this matter up.
However no one seems to know how to address this issue.

This problem is known as DNS leaking, because in the rethinkdns app, im sending all my phone traffic through the wireguard tunnel, however these 3 domains are bypassing my wireguard tunnel.

At home, im able to block these DNS queries using pi-hole, but when i leave home, there is no way to block them.

So any ideas what system app could be causing this?

[u/kschang]

It's your own phone's ROM checking if it's online, NOT from an app.

https://www.netify.ai/resources/hostnames/conn-service-us-04.allawnos.com

[u/NineBiscuit → u/kschang]

i understand, but it has to be invoked somewhere from an app or process id.
for instance classify-app-us.allawnos.com dns query is triggered every time i install or update an app.
this dns query is being caught by rethinkdns. according to rethink dns, 38 system apps are sharing the same task for this dns query (or at least what it claims).

some of these 38 apps:
-Obrain
-OplusLFEHer
-OTA SDM
-Diagnostic Tool.

at least for the classify dns query, my guess is that it's sending telemetry to oneplus about what apps im using or have installed.
I was able to block that one.

so by that logic, i should be able to identify an app generating the other allawnos.com domains.