diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/logic/CharonVpnService.java b/src/frontends/android/app/src/main/java/org/strongswan/android/logic/CharonVpnService.java
index a43094ee0..e199e2e83 100644
--- a/src/frontends/android/app/src/main/java/org/strongswan/android/logic/CharonVpnService.java
+++ b/src/frontends/android/app/src/main/java/org/strongswan/android/logic/CharonVpnService.java
@@ -157,6 +157,10 @@ public class CharonVpnService extends VpnService implements Runnable, VpnStateSe
 	private VpnProfileDataSource mDataSource;
 	/* profile lookups are SQLite queries and must not run on the main thread */
 	private final ExecutorService mProfileExecutor = Executors.newSingleThreadExecutor();
+	/* DNS/route diagnostics and private DNS lookups can block for many seconds
+	 * on a bad network: keep them off the profile executor, or a connect
+	 * queued behind them is delayed by that much */
+	private final ExecutorService mDiagExecutor = Executors.newSingleThreadExecutor();
 	private Thread mConnectionHandler;
 	/* read by the ConnectivityThread (UnderlyingNetworkTracker) too */
 	private volatile VpnProfile mCurrentProfile;
@@ -454,6 +458,7 @@ public class CharonVpnService extends VpnService implements Runnable, VpnStateSe
 			unbindService(mServiceConnection);
 			mBound = false;
 		}
+		mDiagExecutor.shutdownNow();
 		/* queued profile loads must not run against the closed database */
 		mProfileExecutor.shutdownNow();
 		try
@@ -975,7 +980,7 @@ public class CharonVpnService extends VpnService implements Runnable, VpnStateSe
 				scheduleRouteDiagnostics();
 				/* feed the userspace router for this connection (also picks
 				 * up private DNS changes since the last push) */
-				mProfileExecutor.execute(() -> {
+				mDiagExecutor.execute(() -> {
 					getPrivateDnsServers();
 					pushUserspaceRoutingData(this);
 				});
@@ -1017,7 +1022,7 @@ public class CharonVpnService extends VpnService implements Runnable, VpnStateSe
 			{
 				return;
 			}
-			mProfileExecutor.execute(() -> {
+			mDiagExecutor.execute(() -> {
 				try
 				{
 					logDnsDiagnostics();
@@ -1267,7 +1272,7 @@ public class CharonVpnService extends VpnService implements Runnable, VpnStateSe
 			{
 				return;
 			}
-			mProfileExecutor.execute(() -> {
+			mDiagExecutor.execute(() -> {
 				try
 				{
 					logRouteDiagnostics();