DoT domain with Private DNS on Android 13 not working

[LoneWolff7]

I’ve setup AGH encryption and setup firewall rules for port 443 and 853. Both DoH and DoT work without any issues from iOS configuration profile even from outside of my network.

But on Android the tls:// domain doesn’t work even in my LAN.

The LE cert I’ve generated is for my ddns domain which points to my public IPv6 wan ip. Also confirmed that it’s signed by using ISRG Root X1

depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R11

1 s:C = US, O = Let's Encrypt, CN = R11
   i:C = US, O = Internet Security Research Group, CN = ISRG Root X1

Please help.