To enforce a system-wide DNS on an AOSP-based ROM like crDroid:

1. Modify `DnsResolver.cpp`: Hardcode your preferred DNS (e.g., CleanBrowsing) in `system/netd/resolv/DnsResolver.cpp`.

2. Disable Private DNS: Patch the Settings and framework to hide or disable Private DNS UI and functionality (`PrivateDnsConfiguration` in `frameworks/base` and related classes).