diff --git a/components/esp_netif/Kconfig b/components/esp_netif/Kconfig
index c4117e0e6e..6d4681ce17 100644
--- a/components/esp_netif/Kconfig
+++ b/components/esp_netif/Kconfig
@@ -9,7 +9,7 @@ menu "ESP NETIF Adapter"
 
             The IP address may be lost because of some reasons, e.g. when the station disconnects
             from soft-AP, or when DHCP IP renew fails etc. If the IP lost timer is enabled, it will
-            be started everytime the IP is lost. Event SYSTEM_EVENT_STA_LOST_IP will be raised if
+            be started every time the IP is lost. Event SYSTEM_EVENT_STA_LOST_IP will be raised if
             the timer expires. The IP lost timer is stopped if the station get the IP again before
             the timer expires.
 
@@ -76,5 +76,16 @@ menu "ESP NETIF Adapter"
         default n
         help
             Enable LwIP IEEE 802.1D bridge support in ESP-NETIF. Note that "Number of clients store data in netif"
-            (LWIP_NUM_NETIF_CLIENT_DATA) option needs to be properly configured to be LwIP bridge avaiable!
+            (LWIP_NUM_NETIF_CLIENT_DATA) option needs to be properly configured to be LwIP bridge available!
+
+    config ESP_NETIF_SET_DNS_PER_DEFAULT_NETIF
+        bool "Enable DNS server per interface"
+        default n
+        select LWIP_DNS_SETSERVER_WITH_NETIF
+        help
+            Enable this option to use the DNS server which belongs to the selected default network interface.
+            This feature collects DNS server and netif information from LWIP core modules.
+            Whenever a new default netif is selected, global DNS servers in LWIP are updated with the netif
+            related servers.
+
 endmenu
diff --git a/components/esp_netif/include/esp_netif.h b/components/esp_netif/include/esp_netif.h
index 6dd6601509..e44c5ba168 100644
--- a/components/esp_netif/include/esp_netif.h
+++ b/components/esp_netif/include/esp_netif.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2019-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2019-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -112,7 +112,7 @@ esp_err_t esp_netif_attach(esp_netif_t *esp_netif, esp_netif_iodriver_handle dri
  * to TCP/IP stack. Similarly esp_netif_transmit is called from the TCP/IP stack whenever
  * a packet ought to output to the communication media.
  *
- * @note These IO functions are registerd (installed) automatically for default interfaces
+ * @note These IO functions are registered (installed) automatically for default interfaces
  * (interfaces with the keys such as WIFI_STA_DEF, WIFI_AP_DEF, ETH_DEF). Custom interface
  * has to register these IO functions when creating interface using @ref esp_netif_new
  *
@@ -715,6 +715,11 @@ esp_err_t esp_netif_dhcps_get_clients_by_mac(esp_netif_t *esp_netif, int num, es
  *   and is designed to be set via this API.
  *   If DHCP client is disabled, all DNS server types can be set via this API only.
  *
+ *   Note that LWIP stores DNS server information globally, not per interface, so the first parameter is unused
+ *   in the default LWIP configuration.
+ *   If CONFIG_ESP_NETIF_SET_DNS_PER_DEFAULT_NETIF=1 this API sets internal DNS server information per
+ *   netif. It's also possible to set the global DNS server info by supplying esp_netif=NULL
+ *
  *   If DHCP server is enabled, the Main DNS Server setting is used by the DHCP server to provide a DNS Server option
  *   to DHCP clients (Wi-Fi stations).
  *   - The default Main DNS server is typically the IP of the DHCP server itself.
@@ -740,6 +745,11 @@ esp_err_t esp_netif_set_dns_info(esp_netif_t *esp_netif, esp_netif_dns_type_t ty
  * This may be result of a previous call to esp_netif_set_dns_info(). If the interface's DHCP client is enabled,
  * the Main or Backup DNS Server may be set by the current DHCP lease.
  *
+ * Note that LWIP stores DNS server information globally, not per interface, so the first parameter is unused
+ * in the default LWIP configuration.
+ * If CONFIG_ESP_NETIF_SET_DNS_PER_DEFAULT_NETIF=1 this API returns internally saved DNS server information per
+ * netif. It's also possible to ask for the global DNS server info by supplying esp_netif=NULL
+ *
  * @param[in]  esp_netif Handle to esp-netif instance
  * @param[in]  type Type of DNS Server to get: ESP_NETIF_DNS_MAIN, ESP_NETIF_DNS_BACKUP, ESP_NETIF_DNS_FALLBACK
  * @param[out] dns  DNS Server result is written here on success
@@ -898,7 +908,7 @@ esp_err_t esp_netif_str_to_ip4(const char *src, esp_ip4_addr_t *dst);
 
 /**
  * @brief Converts Ascii internet IPv6 address into esp_ip4_addr_t
- * Zeros in the IP address can be stripped or completely ommited: "2001:db8:85a3:0:0:0:2:1" or "2001:db8::2:1")
+ * Zeros in the IP address can be stripped or completely omitted: "2001:db8:85a3:0:0:0:2:1" or "2001:db8::2:1")
  *
  * @param[in] src IPv6 address in ascii representation (e.g. ""2001:0db8:85a3:0000:0000:0000:0002:0001")
  * @param[out] dst Address of the target esp_ip6_addr_t structure to receive converted address
@@ -972,7 +982,7 @@ const char *esp_netif_get_desc(esp_netif_t *esp_netif);
  *
  * @param[in]  esp_netif Handle to esp-netif instance
  *
- * @return Integer representing the instance's route-prio, or -1 if invalid paramters
+ * @return Integer representing the instance's route-prio, or -1 if invalid parameters
  */
 int esp_netif_get_route_prio(esp_netif_t *esp_netif);
 
diff --git a/components/esp_netif/lwip/esp_netif_lwip.c b/components/esp_netif/lwip/esp_netif_lwip.c
index bf5560f496..cedd7807c9 100644
--- a/components/esp_netif/lwip/esp_netif_lwip.c
+++ b/components/esp_netif/lwip/esp_netif_lwip.c
@@ -113,16 +113,6 @@ do {
     action;                                                                                     \
 } while(0)
 
-//
-//  Internal types
-//
-typedef enum esp_netif_action {
-    ESP_NETIF_UNDEF,
-    ESP_NETIF_STARTED,
-    ESP_NETIF_STOPPED,
-    ESP_NETIF_SET_DEFAULT,
-} esp_netif_action_t;
-
 //
 //  Internal variables for this module
 //
@@ -306,6 +296,11 @@ static void esp_netif_set_default_netif_internal(esp_netif_t *esp_netif)
     } else {
         netif_set_default(esp_netif->lwip_netif);
     }
+#ifdef CONFIG_ESP_NETIF_SET_DNS_PER_DEFAULT_NETIF
+    for (int i = 0; i < DNS_MAX_SERVERS; ++i) {
+        dns_setserver(i, &esp_netif->dns[i]);
+    }
+#endif
 }
 
 /**
@@ -316,7 +311,7 @@ static void esp_netif_set_default_netif_internal(esp_netif_t *esp_netif)
 static esp_err_t esp_netif_update_default_netif_lwip(esp_netif_api_msg_t *msg)
 {
     esp_netif_t *esp_netif = msg->esp_netif;
-    esp_netif_action_t action = (esp_netif_action_t)msg->data;
+    esp_netif_route_prio_action_t action = (esp_netif_route_prio_action_t)msg->data;
 
     ESP_LOGD(TAG, "%s %p", __func__, esp_netif);
 
@@ -336,6 +331,7 @@ static esp_err_t esp_netif_update_default_netif_lwip(esp_netif_api_msg_t *msg)
             esp_netif_set_default_netif_internal(s_last_default_esp_netif);
         break;
         case ESP_NETIF_STARTED:
+        case ESP_NETIF_GOT_IP:
         {
             // check if previously default interface hasn't been destroyed in the meantime
             s_last_default_esp_netif = esp_netif_is_active(s_last_default_esp_netif);
@@ -351,6 +347,7 @@ static esp_err_t esp_netif_update_default_netif_lwip(esp_netif_api_msg_t *msg)
 
         default:
         case ESP_NETIF_STOPPED:
+        case ESP_NETIF_LOST_IP:
         {
             s_last_default_esp_netif = NULL;
             esp_netif_t *netif = esp_netif_next_unsafe(NULL);
@@ -382,7 +379,7 @@ static esp_err_t esp_netif_update_default_netif_lwip(esp_netif_api_msg_t *msg)
  * @param esp_netif current interface which just updated state
  * @param action updating action (on-off)
  */
-static esp_err_t esp_netif_update_default_netif(esp_netif_t *esp_netif, esp_netif_action_t action)
+esp_err_t esp_netif_update_default_netif(esp_netif_t *esp_netif, esp_netif_route_prio_action_t action)
 {
     return esp_netif_lwip_ipc_call(esp_netif_update_default_netif_lwip, esp_netif, (void*)action);
 }
@@ -502,6 +499,24 @@ void* esp_netif_get_netif_impl(esp_netif_t *esp_netif)
     return NULL;
 }
 
+#if CONFIG_ESP_NETIF_SET_DNS_PER_DEFAULT_NETIF
+static void store_dnsserver_info(struct netif* netif, u8_t numdns, const ip_addr_t *dnsserver)
+{
+    if (netif == NULL) {
+        return;
+    }
+    esp_netif_t *esp_netif = lwip_get_esp_netif(netif);
+    if (esp_netif == NULL || !esp_netif_is_netif_listed(esp_netif)) {
+        return;
+    }
+    if (!ip_addr_isany(dnsserver)) {
+        ip_addr_copy(esp_netif->dns[numdns], *dnsserver);
+    } else {
+        ip_addr_copy(esp_netif->dns[numdns], *IP_ADDR_ANY);
+    }
+}
+#endif
+
 static void tcpip_init_done(void *arg)
 {
     sys_sem_t *init_sem = arg;
@@ -545,6 +560,12 @@ esp_err_t esp_netif_init(void)
         sys_sem_wait(&init_sem);
         sys_sem_free(&init_sem);
         ESP_LOGD(TAG, "LwIP stack has been initialized");
+#if CONFIG_ESP_NETIF_SET_DNS_PER_DEFAULT_NETIF
+        if (dns_setserver_callback(store_dnsserver_info) != ERR_OK) {
+            ESP_LOGE(TAG, "Feiled to configure DNS set server callback");
+            return ESP_FAIL;
+        }
+#endif
     }
 
 #if !LWIP_TCPIP_CORE_LOCKING
@@ -1071,11 +1092,7 @@ static esp_err_t esp_netif_start_api(esp_netif_api_msg_t *msg)
     ESP_LOGD(TAG, "%s %p", __func__, esp_netif);
     if (ESP_NETIF_IS_POINT2POINT_TYPE(esp_netif, PPP_LWIP_NETIF)) {
 #if CONFIG_PPP_SUPPORT
-        esp_err_t ret = esp_netif_start_ppp(esp_netif);
-        if (ret == ESP_OK) {
-            esp_netif_update_default_netif(esp_netif, ESP_NETIF_STARTED);
-        }
-        return ret;
+        return esp_netif_start_ppp(esp_netif);
 #endif
     }
 
@@ -1152,8 +1169,10 @@ static esp_err_t esp_netif_start_api(esp_netif_api_msg_t *msg)
         LOG_NETIF_DISABLED_AND_DO("IPv4's DHCP Client", return ESP_ERR_NOT_SUPPORTED);
 #endif
     }
-
-    esp_netif_update_default_netif(esp_netif, ESP_NETIF_STARTED);
+    // For netifs with (active) DHCP client: we update the default netif after getting a valid IP
+    if (!((esp_netif->flags & ESP_NETIF_DHCP_CLIENT) && esp_netif->dhcpc_status != ESP_NETIF_DHCP_STOPPED)) {
+        esp_netif_update_default_netif(esp_netif, ESP_NETIF_STARTED);
+    }
 
     return ESP_OK;
 }
@@ -1302,7 +1321,7 @@ static void esp_netif_internal_dhcpc_cb(struct netif *netif)
             if (memcmp(ip_info, ip_info_old, sizeof(esp_netif_ip_info_t))) {
                 evt.ip_changed = true;
             }
-
+            esp_netif_update_default_netif(esp_netif, ESP_NETIF_GOT_IP);
             memcpy(&evt.ip_info, ip_info, sizeof(esp_netif_ip_info_t));
             memcpy(ip_info_old, ip_info, sizeof(esp_netif_ip_info_t));
             ESP_LOGD(TAG, "if%p ip changed=%d", esp_netif, evt.ip_changed);
@@ -1343,7 +1362,7 @@ static void esp_netif_ip_lost_timer(void *arg)
                 .esp_netif = esp_netif,
         };
         int ret;
-
+        esp_netif_update_default_netif(esp_netif, ESP_NETIF_LOST_IP);
         ESP_LOGD(TAG, "if%p ip lost tmr: raise ip lost event", esp_netif);
         memset(esp_netif->ip_info_old, 0, sizeof(esp_netif_ip_info_t));
         if (esp_netif->lost_ip_event) {
@@ -1662,7 +1681,10 @@ static esp_err_t esp_netif_up_api(esp_netif_api_msg_t *msg)
     netif_set_up(lwip_netif);
     netif_set_link_up(lwip_netif);
 
-    esp_netif_update_default_netif(esp_netif, ESP_NETIF_STARTED);
+    // For netifs with (active) DHCP client: we update the default netif after getting a valid IP
+    if (!((esp_netif->flags & ESP_NETIF_DHCP_CLIENT) && esp_netif->dhcpc_status != ESP_NETIF_DHCP_STOPPED)) {
+        esp_netif_update_default_netif(esp_netif, ESP_NETIF_STARTED);
+    }
 
     return ESP_OK;
 }
@@ -1841,7 +1863,7 @@ static esp_err_t esp_netif_set_ip_info_api(esp_netif_api_msg_t *msg)
                 if (memcmp(ip_info, esp_netif->ip_info_old, sizeof(esp_netif_ip_info_t))) {
                     evt.ip_changed = true;
                 }
-
+                esp_netif_update_default_netif(esp_netif, ESP_NETIF_GOT_IP);
                 memcpy(&evt.ip_info, ip_info, sizeof(esp_netif_ip_info_t));
                 memcpy(esp_netif->ip_info_old, ip_info, sizeof(esp_netif_ip_info_t));
                 ret = esp_event_post(IP_EVENT, evt_id, &evt, sizeof(evt), 0);
@@ -1902,7 +1924,7 @@ static esp_err_t esp_netif_set_dns_info_api(esp_netif_api_msg_t *msg)
 
     ip_addr_t lwip_ip = {};
     ESPIP_TO_IP(&dns->ip, &lwip_ip);
-    if (esp_netif->flags & ESP_NETIF_DHCP_SERVER) {
+    if (esp_netif && esp_netif->flags & ESP_NETIF_DHCP_SERVER) {
 #if ESP_DHCPS
         // if DHCP server configured to set DNS in dhcps API
         if (type != ESP_NETIF_DNS_MAIN) {
@@ -1915,7 +1937,17 @@ static esp_err_t esp_netif_set_dns_info_api(esp_netif_api_msg_t *msg)
         LOG_NETIF_DISABLED_AND_DO("DHCP Server", return ESP_ERR_NOT_SUPPORTED);
 #endif
     } else {
+#ifdef CONFIG_ESP_NETIF_SET_DNS_PER_DEFAULT_NETIF
+        if (esp_netif) {
+            store_dnsserver_info(esp_netif->lwip_netif, type, &lwip_ip);
+        }
+        if (esp_netif == s_last_default_esp_netif ||    // if this is the default one -> need to update global DNS servers
+            esp_netif == NULL) {                        // if the netif ptr is set to NULL -> we explicitly require the update
+            dns_setserver(type, &lwip_ip);
+        }
+#else
         dns_setserver(type, &lwip_ip);
+#endif
     }
 
     return ESP_OK;
@@ -1923,9 +1955,11 @@ static esp_err_t esp_netif_set_dns_info_api(esp_netif_api_msg_t *msg)
 
 esp_err_t esp_netif_set_dns_info(esp_netif_t *esp_netif, esp_netif_dns_type_t type, esp_netif_dns_info_t *dns)
 {
+#ifndef CONFIG_ESP_NETIF_SET_DNS_PER_DEFAULT_NETIF
     if (esp_netif == NULL) {
         return ESP_ERR_ESP_NETIF_INVALID_PARAMS;
     }
+#endif
 
     if (dns == NULL) {
         ESP_LOGD(TAG, "set dns null dns");
@@ -1953,7 +1987,7 @@ static esp_err_t esp_netif_get_dns_info_api(esp_netif_api_msg_t *msg)
 
     ESP_LOGD(TAG, "esp_netif_get_dns_info: esp_netif=%p type=%d", esp_netif, type);
 
-    if (esp_netif->flags & ESP_NETIF_DHCP_SERVER) {
+    if (esp_netif && esp_netif->flags & ESP_NETIF_DHCP_SERVER) {
 #if ESP_DHCPS
         ip4_addr_t dns_ip;
         dhcps_dns_getserver(esp_netif->dhcps, &dns_ip);
@@ -1964,7 +1998,15 @@ static esp_err_t esp_netif_get_dns_info_api(esp_netif_api_msg_t *msg)
 #endif
     } else {
         const ip_addr_t*  dns_ip = NULL;
+#ifdef CONFIG_ESP_NETIF_SET_DNS_PER_DEFAULT_NETIF
+        if (esp_netif == NULL) {    // by setting esp_netif to NULL we require the global DNS server entry
+            dns_ip = dns_getserver(type);
+        } else {
+            dns_ip = &esp_netif->dns[type];
+        }
+#else
         dns_ip = dns_getserver(type);
+#endif
         if(dns_ip != NULL) {
             IP_TO_ESPIP(dns_ip, &dns->ip);
         }
@@ -1975,9 +2017,11 @@ static esp_err_t esp_netif_get_dns_info_api(esp_netif_api_msg_t *msg)
 
 esp_err_t esp_netif_get_dns_info(esp_netif_t *esp_netif, esp_netif_dns_type_t type, esp_netif_dns_info_t *dns)
 {
+#ifndef CONFIG_ESP_NETIF_SET_DNS_PER_DEFAULT_NETIF
     if (esp_netif == NULL) {
         return ESP_ERR_ESP_NETIF_INVALID_PARAMS;
     }
+#endif
 
     if (dns == NULL) {
         ESP_LOGE(TAG, "%s: dns_info cannot be NULL", __func__);
@@ -2073,7 +2117,7 @@ static void esp_netif_internal_nd6_cb(struct netif *netif, uint8_t ip_index)
         ESP_LOGW(TAG,"CONFIG_LWIP_ESP_MLDV6_REPORT not enabled, but esp-netif configured with ESP_NETIF_FLAG_MLDV6_REPORT");
 #endif
     }
-
+    esp_netif_update_default_netif(esp_netif, ESP_NETIF_GOT_IP);
     memcpy(&evt.ip6_info, &ip6_info, sizeof(esp_netif_ip6_info_t));
     int ret = esp_event_post(IP_EVENT, IP_EVENT_GOT_IP6, &evt, sizeof(evt), 0);
     if (ESP_OK != ret) {
@@ -2515,15 +2559,6 @@ esp_err_t esp_netif_ppp_set_auth(esp_netif_t *esp_netif, esp_netif_auth_type_t a
 {
     set_auth_msg_t msg = { .authtype = authtype, .user = user, .passwd = passwd };
     return esp_netif_lwip_ipc_call(esp_netif_ppp_set_auth_api, esp_netif, &msg);
-#if PPP_AUTH_SUPPORT
-        lwip_peer2peer_ctx_t *ppp_ctx = (lwip_peer2peer_ctx_t *)netif->related_data;
-    assert(ppp_ctx->base.netif_type == PPP_LWIP_NETIF);
-    pppapi_set_auth(ppp_ctx->ppp, authtype, user, passwd);
-    return ESP_OK;
-#else
-    ESP_LOGE(TAG, "%s failed: No authorisation enabled in menuconfig", __func__);
-    return ESP_ERR_ESP_NETIF_IF_NOT_READY;
-#endif
 }
 
 esp_err_t esp_netif_napt_disable(esp_netif_t *esp_netif)
@@ -2612,7 +2647,7 @@ static esp_err_t esp_netif_add_ip6_address_api(esp_netif_api_msg_t *msg)
     err_t err = netif_add_ip6_address(msg->esp_netif->lwip_netif, &ip6addr, &index);
     ESP_RETURN_ON_FALSE(err == ERR_OK && index >= 0, ESP_ERR_ESP_NETIF_IP6_ADDR_FAILED, TAG,
                         "Failed to add ip6 address");
-
+    esp_netif_update_default_netif(msg->esp_netif, ESP_NETIF_GOT_IP);
     netif_ip6_addr_set_state(msg->esp_netif->lwip_netif, index,
                              addr->preferred ? IP6_ADDR_PREFERRED : IP6_ADDR_DEPRECATED);
     ip_event_got_ip6_t evt = {.esp_netif = msg->esp_netif, .ip_index = index};
diff --git a/components/esp_netif/lwip/esp_netif_lwip_internal.h b/components/esp_netif/lwip/esp_netif_lwip_internal.h
index 842fc81735..4d5130379f 100644
--- a/components/esp_netif/lwip/esp_netif_lwip_internal.h
+++ b/components/esp_netif/lwip/esp_netif_lwip_internal.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -114,4 +114,19 @@ struct esp_netif_obj {
 #endif // CONFIG_ESP_NETIF_BRIDGE_EN
     // mldv6 timer
     bool mldv6_report_timer_started;
+
+#ifdef CONFIG_ESP_NETIF_SET_DNS_PER_DEFAULT_NETIF
+    ip_addr_t dns[DNS_MAX_SERVERS];
+#endif
 };
+
+typedef enum esp_netif_set_default_state {
+    ESP_NETIF_UNDEF,
+    ESP_NETIF_STARTED,
+    ESP_NETIF_GOT_IP,
+    ESP_NETIF_STOPPED,
+    ESP_NETIF_LOST_IP,
+    ESP_NETIF_SET_DEFAULT,
+} esp_netif_route_prio_action_t;
+
+esp_err_t esp_netif_update_default_netif(esp_netif_t *esp_netif, esp_netif_route_prio_action_t action);
diff --git a/components/esp_netif/lwip/esp_netif_lwip_ppp.c b/components/esp_netif/lwip/esp_netif_lwip_ppp.c
index 7e4a61a17f..03a11bafe3 100644
--- a/components/esp_netif/lwip/esp_netif_lwip_ppp.c
+++ b/components/esp_netif/lwip/esp_netif_lwip_ppp.c
@@ -75,6 +75,7 @@ static void on_ppp_status_changed(ppp_pcb *pcb, int err_code, void *ctx)
             break;
         case PPPERR_CONNECT: /* Connection lost */
             ESP_LOGI(TAG, "Connection lost");
+            esp_netif_update_default_netif(netif, ESP_NETIF_LOST_IP);
             err = esp_event_post(IP_EVENT, netif->lost_ip_event, &evt, sizeof(evt), 0);
 
             if (ESP_OK != err) {
diff --git a/components/esp_netif/test_apps/test_app_esp_netif/main/esp_netif_test.c b/components/esp_netif/test_apps/test_app_esp_netif/main/esp_netif_test.c
index 84705bc784..080f565ec5 100644
--- a/components/esp_netif/test_apps/test_app_esp_netif/main/esp_netif_test.c
+++ b/components/esp_netif/test_apps/test_app_esp_netif/main/esp_netif_test.c
@@ -502,6 +502,81 @@ TEST(esp_netif, route_priority)
     }
 }
 
+// to probe DNS server info directly in LWIP
+const ip_addr_t * dns_getserver(u8_t numdns);
+
+TEST(esp_netif, set_get_dnsserver)
+{
+    // create a couple of netifs
+    test_case_uses_tcpip();
+    const char *if_keys[] = {"if0", "if1", "if2", "if3", "if4", "if5", "if6", "if7", "if8", "if9"};
+    const int nr_of_netifs = sizeof(if_keys) / sizeof(char *);
+    esp_netif_t *netifs[nr_of_netifs];
+    esp_netif_driver_ifconfig_t driver_config = { .handle =  (void*)1, .transmit = dummy_transmit };
+    // create 10 netifs with different route prio
+    for (int i = 0; i < nr_of_netifs; ++i) {
+        esp_netif_inherent_config_t base_netif_config = { .if_key = if_keys[i], .route_prio = i };
+        esp_netif_config_t cfg = {  .base = &base_netif_config,
+                .stack = ESP_NETIF_NETSTACK_DEFAULT_WIFI_STA,
+                .driver = &driver_config };
+        netifs[i] = esp_netif_new(&cfg);
+        TEST_ASSERT_NOT_NULL(netifs[i]);
+        // set the interface up and connected -- to enable the default netif based on route_prio
+        esp_netif_action_start(netifs[i], 0, 0, 0);
+        esp_netif_action_connected(netifs[i], 0, 0, 0);
+    }
+
+    esp_netif_dns_info_t dns[2];
+    esp_netif_dns_info_t get_dns;
+    TEST_ASSERT_EQUAL(ESP_OK, esp_netif_str_to_ip4("1.2.3.4", &dns[0].ip.u_addr.ip4));
+    TEST_ASSERT_EQUAL(ESP_OK, esp_netif_str_to_ip4("5.6.7.8", &dns[1].ip.u_addr.ip4));
+
+    // set DNS info to one netif
+    TEST_ASSERT_EQUAL(ESP_OK, esp_netif_set_dns_info(netifs[3], ESP_NETIF_DNS_MAIN, &dns[0]));
+    TEST_ASSERT_EQUAL(ESP_OK, esp_netif_set_dns_info(netifs[3], ESP_NETIF_DNS_BACKUP, &dns[1]));
+#ifndef CONFIG_ESP_NETIF_SET_DNS_PER_DEFAULT_NETIF
+    // check that calling setters/getters with 'esp_netif==NULL' is invalid
+    TEST_ASSERT_NOT_EQUAL(ESP_OK, esp_netif_set_dns_info(NULL, ESP_NETIF_DNS_BACKUP, &dns[1]));
+    TEST_ASSERT_NOT_EQUAL(ESP_OK, esp_netif_get_dns_info(NULL, ESP_NETIF_DNS_BACKUP, &get_dns));
+
+    // check that the global DNS is configured the same way
+    const ip_addr_t *ip = dns_getserver(0);
+    TEST_ASSERT_EQUAL(ip->u_addr.ip4.addr, dns[0].ip.u_addr.ip4.addr);
+    ip = dns_getserver(1);
+    TEST_ASSERT_EQUAL(ip->u_addr.ip4.addr, dns[1].ip.u_addr.ip4.addr);
+
+    // check that we get the same DNS information for all netifs
+    for (int i=0; i < nr_of_netifs; ++i) {
+        TEST_ASSERT_EQUAL(ESP_OK, esp_netif_get_dns_info(netifs[i], ESP_NETIF_DNS_MAIN, &get_dns));
+        TEST_ASSERT_EQUAL(get_dns.ip.u_addr.ip4.addr, dns[0].ip.u_addr.ip4.addr);
+        TEST_ASSERT_EQUAL(ESP_OK, esp_netif_get_dns_info(netifs[i], ESP_NETIF_DNS_BACKUP, &get_dns));
+        TEST_ASSERT_EQUAL(get_dns.ip.u_addr.ip4.addr, dns[1].ip.u_addr.ip4.addr);
+    }
+#else
+    // check that calling setters/getters with 'esp_netif==NULL' is valid, they set/get global DNS servers
+    TEST_ASSERT_EQUAL(ESP_OK, esp_netif_set_dns_info(NULL, ESP_NETIF_DNS_MAIN, &dns[0]));
+    TEST_ASSERT_EQUAL(ESP_OK, esp_netif_get_dns_info(NULL, ESP_NETIF_DNS_BACKUP, &get_dns));
+    const ip_addr_t *ip = dns_getserver(0);
+    TEST_ASSERT_EQUAL(ip->u_addr.ip4.addr, dns[0].ip.u_addr.ip4.addr);
+    ip = dns_getserver(1);
+    TEST_ASSERT_EQUAL(ip->u_addr.ip4.addr, get_dns.ip.u_addr.ip4.addr);     // same as what we got at the esp-netif layer
+    TEST_ASSERT_NOT_EQUAL(ip->u_addr.ip4.addr, dns[1].ip.u_addr.ip4.addr);  // but different from what we set earlier per netif
+
+    // now we set the netif[3] as default one and check again
+    esp_netif_set_default_netif(netifs[3]);
+    ip = dns_getserver(1);
+    TEST_ASSERT_EQUAL(ip->u_addr.ip4.addr, dns[1].ip.u_addr.ip4.addr);  // now the ESP_NETIF_DNS_BACKUP[3[ should be set globally
+
+    // check that we get a different DNS server with another netif
+    TEST_ASSERT_EQUAL(ESP_OK, esp_netif_get_dns_info(netifs[5], ESP_NETIF_DNS_MAIN, &get_dns));
+    TEST_ASSERT_NOT_EQUAL(dns[0].ip.u_addr.ip4.addr, get_dns.ip.u_addr.ip4.addr);
+#endif
+
+    for (int i=0; i < nr_of_netifs; ++i) {
+        esp_netif_destroy(netifs[i]);
+        TEST_ASSERT_FALSE(esp_netif_is_netif_listed(netifs[i]));
+    }
+}
 
 TEST_GROUP_RUNNER(esp_netif)
 {
@@ -531,6 +606,7 @@ TEST_GROUP_RUNNER(esp_netif)
     RUN_TEST_CASE(esp_netif, dhcp_server_state_transitions_mesh)
 #endif
     RUN_TEST_CASE(esp_netif, route_priority)
+    RUN_TEST_CASE(esp_netif, set_get_dnsserver)
 }
 
 void app_main(void)
diff --git a/components/esp_netif/test_apps/test_app_esp_netif/pytest_esp_netif.py b/components/esp_netif/test_apps/test_app_esp_netif/pytest_esp_netif.py
index 841d825360..43c0125637 100644
--- a/components/esp_netif/test_apps/test_app_esp_netif/pytest_esp_netif.py
+++ b/components/esp_netif/test_apps/test_app_esp_netif/pytest_esp_netif.py
@@ -1,6 +1,5 @@
-# SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
+# SPDX-FileCopyrightText: 2022-2024 Espressif Systems (Shanghai) CO LTD
 # SPDX-License-Identifier: CC0-1.0
-
 import pytest
 from pytest_embedded import Dut
 
@@ -8,5 +7,9 @@ from pytest_embedded import Dut
 @pytest.mark.esp32s2
 @pytest.mark.esp32c3
 @pytest.mark.generic
+@pytest.mark.parametrize('config', [
+    'global_dns',
+    'dns_per_netif',
+], indirect=True)
 def test_esp_netif(dut: Dut) -> None:
     dut.expect_unity_test_output()
diff --git a/components/esp_netif/test_apps/test_app_esp_netif/sdkconfig.ci.dns_per_netif b/components/esp_netif/test_apps/test_app_esp_netif/sdkconfig.ci.dns_per_netif
new file mode 100644
index 0000000000..3abbf3a3bc
--- /dev/null
+++ b/components/esp_netif/test_apps/test_app_esp_netif/sdkconfig.ci.dns_per_netif
@@ -0,0 +1 @@
+CONFIG_ESP_NETIF_SET_DNS_PER_DEFAULT_NETIF=y
diff --git a/components/esp_netif/test_apps/test_app_esp_netif/sdkconfig.ci.global_dns b/components/esp_netif/test_apps/test_app_esp_netif/sdkconfig.ci.global_dns
new file mode 100644
index 0000000000..ba627cbf81
--- /dev/null
+++ b/components/esp_netif/test_apps/test_app_esp_netif/sdkconfig.ci.global_dns
@@ -0,0 +1 @@
+CONFIG_ESP_NETIF_SET_DNS_PER_DEFAULT_NETIF=n
diff --git a/components/lwip/CMakeLists.txt b/components/lwip/CMakeLists.txt
index 4485886153..3f7d520de8 100644
--- a/components/lwip/CMakeLists.txt
+++ b/components/lwip/CMakeLists.txt
@@ -132,12 +132,7 @@ if(CONFIG_LWIP_ENABLE)
             "lwip/src/netif/ppp/pppos.c"
             "lwip/src/netif/ppp/upap.c"
             "lwip/src/netif/ppp/utils.c"
-            "lwip/src/netif/ppp/vj.c"
-            "lwip/src/netif/ppp/polarssl/arc4.c"
-            "lwip/src/netif/ppp/polarssl/des.c"
-            "lwip/src/netif/ppp/polarssl/md4.c"
-            "lwip/src/netif/ppp/polarssl/md5.c"
-            "lwip/src/netif/ppp/polarssl/sha1.c")
+            "lwip/src/netif/ppp/vj.c")
     endif()
 
     if(NOT ${target} STREQUAL "linux")
@@ -160,6 +155,15 @@ if(CONFIG_LWIP_ENABLE)
             "apps/ping/ping_sock.c")
     endif()
 
+    if(NOT CONFIG_LWIP_USE_EXTERNAL_MBEDTLS)
+        list(APPEND srcs
+                "lwip/src/netif/ppp/polarssl/arc4.c"
+                "lwip/src/netif/ppp/polarssl/des.c"
+                "lwip/src/netif/ppp/polarssl/md4.c"
+                "lwip/src/netif/ppp/polarssl/md5.c"
+                "lwip/src/netif/ppp/polarssl/sha1.c")
+    endif()
+
     if(CONFIG_LWIP_DHCPS)
         list(APPEND srcs "apps/dhcpserver/dhcpserver.c")
     endif()
@@ -215,6 +219,10 @@ if(CONFIG_LWIP_ENABLE)
         idf_component_optional_requires(PRIVATE nvs_flash)
     endif()
 
+    if(CONFIG_LWIP_USE_EXTERNAL_MBEDTLS)
+        idf_component_optional_requires(PRIVATE mbedtls)
+    endif()
+
     if(${target} STREQUAL "linux")
         set(THREADS_PREFER_PTHREAD_FLAG ON)
         find_package(Threads REQUIRED)
diff --git a/components/lwip/Kconfig b/components/lwip/Kconfig
index 1904ba5b70..5f2bb733e8 100644
--- a/components/lwip/Kconfig
+++ b/components/lwip/Kconfig
@@ -669,7 +669,7 @@ menu "LWIP"
                 LWIP_TCP_RECCVMBOX_SIZE packets for each TCP socket, so the maximum possible cached TCP packets
                 for all TCP sockets is LWIP_TCP_RECCVMBOX_SIZE multiples the maximum TCP socket number. In other
                 words, the bigger LWIP_TCP_RECVMBOX_SIZE means more memory.
-                On the other hand, if the receiv mail box is too small, the mail box may be full. If the
+                On the other hand, if the receive mail box is too small, the mail box may be full. If the
                 mail box is full, the LWIP drops the packets. So generally we need to make sure the TCP
                 receive mail box is big enough to avoid packet drop between LWIP core and application.
 
@@ -813,7 +813,7 @@ menu "LWIP"
                 UDP_RECCVMBOX_SIZE packets for each UDP socket, so the maximum possible cached UDP packets
                 for all UDP sockets is UDP_RECCVMBOX_SIZE multiples the maximum UDP socket number. In other
                 words, the bigger UDP_RECVMBOX_SIZE means more memory.
-                On the other hand, if the receiv mail box is too small, the mail box may be full. If the
+                On the other hand, if the receive mail box is too small, the mail box may be full. If the
                 mail box is full, the LWIP drops the packets. So generally we need to make sure the UDP
                 receive mail box is big enough to avoid packet drop between LWIP core and application.
 
@@ -992,6 +992,17 @@ menu "LWIP"
         help
             Enable PPP debug log output
 
+    config LWIP_USE_EXTERNAL_MBEDTLS
+        bool "Use mbedTLS instead of internal polarSSL"
+        depends on LWIP_PPP_SUPPORT
+        depends on !LWIP_PPP_MPPE_SUPPORT && !LWIP_PPP_MSCHAP_SUPPORT
+        default n
+        help
+            This option uses mbedTLS crypto functions (instead of internal PolarSSL
+            implementation) for PPP authentication modes (PAP, CHAP, etc.).
+            You can use this option to address symbol duplication issues, since
+            the internal functions are not namespaced (e.g. md5_init()).
+
     menuconfig LWIP_SLIP_SUPPORT
         bool "Enable SLIP support (new/experimental)"
         default n
@@ -1060,12 +1071,12 @@ menu "LWIP"
                 SNTP callback for such replies should be set accordingly (see sntp_servermode_dhcp() func.)
 
         config LWIP_DHCP_MAX_NTP_SERVERS
-            int "Maximum number of NTP servers aquired via DHCP"
+            int "Maximum number of NTP servers acquired via DHCP"
             default 1
             range 1 16
             depends on LWIP_DHCP_GET_NTP_SRV
             help
-                Set maximum number of NTP servers aquired via DHCP-offer.
+                Set maximum number of NTP servers acquired via DHCP-offer.
                 Should be less or equal to "Maximum number of NTP servers", any extra servers would be just ignored.
 
         config LWIP_SNTP_UPDATE_DELAY
@@ -1101,6 +1112,12 @@ menu "LWIP"
 
     menu "DNS"
 
+        config LWIP_DNS_MAX_HOST_IP
+            int "Maximum number of IP addresses per host"
+            default 1
+            help
+                Maximum number of IP addresses that can be returned by DNS queries for a single host.
+
         config LWIP_DNS_MAX_SERVERS
             int "Maximum number of DNS servers"
             default 3
@@ -1124,6 +1141,15 @@ menu "LWIP"
             help
                 This option allows you to config dns fallback server address.
 
+        config LWIP_DNS_SETSERVER_WITH_NETIF
+            bool "Enable DNS server settings with netif"
+            default n
+            help
+                This option allows collecting DNS server settings per netif using
+                configurable callback function.
+                It's typically used with CONFIG_ESP_NETIF_SET_DNS_PER_DEFAULT_NETIF
+                which configures a callback to collect the DNS info on esp_netif layer.
+
     endmenu # DNS
 
     config LWIP_BRIDGEIF_MAX_PORTS
diff --git a/components/lwip/lwip b/components/lwip/lwip
index f79221431f..bced058f73 160000
--- a/components/lwip/lwip
+++ b/components/lwip/lwip
@@ -1 +1 @@
-Subproject commit f79221431fa9042b3572d271d687de66da7560c4
+Subproject commit bced058f737eaabea1aa193f3c365ee78ff555f3
diff --git a/components/lwip/port/include/lwipopts.h b/components/lwip/port/include/lwipopts.h
index 51e3c3c3d0..db4ef60bcf 100644
--- a/components/lwip/port/include/lwipopts.h
+++ b/components/lwip/port/include/lwipopts.h
@@ -470,6 +470,10 @@ static inline uint32_t timeout_from_offered(uint32_t lease, uint32_t min)
  */
 #define LWIP_DNS                        1
 
+/** The maximum number of IP addresses per host
+ */
+#define DNS_MAX_HOST_IP                 CONFIG_LWIP_DNS_MAX_HOST_IP
+
 /** The maximum of DNS servers
  */
 #define DNS_MAX_SERVERS                 CONFIG_LWIP_DNS_MAX_SERVERS
@@ -499,6 +503,17 @@ static inline uint32_t timeout_from_offered(uint32_t lease, uint32_t min)
 #define LWIP_DNS_SUPPORT_MDNS_QUERIES   0
 #endif
 
+/**
+ * LWIP_DNS_SETSERVER_WITH_NETIF: If this is turned on, the dns_setserver_with_netif() is enabled and called
+ * from all internal modules (instead of dns_setserver()) allowing to setup a user callback to collect DNS server
+ * information acquired by the related network interface.
+ */
+#ifdef CONFIG_LWIP_DNS_SETSERVER_WITH_NETIF
+#define LWIP_DNS_SETSERVER_WITH_NETIF   1
+#else
+#define LWIP_DNS_SETSERVER_WITH_NETIF   0
+#endif
+
 /*
    ---------------------------------
    ---------- UDP options ----------
@@ -1103,7 +1118,7 @@ static inline uint32_t timeout_from_offered(uint32_t lease, uint32_t min)
 /**
  * PPP_MAXIDLEFLAG: Max Xmit idle time (in ms) before resend flag char.
  * TODO: If PPP_MAXIDLEFLAG > 0 and next package is send during PPP_MAXIDLEFLAG time,
- *       then 0x7E is not added at the begining of PPP package but 0x7E termination
+ *       then 0x7E is not added at the beginning of PPP package but 0x7E termination
  *       is always at the end. This behaviour brokes PPP dial with GSM (PPPoS).
  *       The PPP package should always start and end with 0x7E.
  */
@@ -1136,6 +1151,15 @@ static inline uint32_t timeout_from_offered(uint32_t lease, uint32_t min)
 #define PPP_SUPPORT                     0
 #endif  /* CONFIG_LWIP_PPP_SUPPORT */
 
+/**
+ * LWIP_USE_EXTERNAL_MBEDTLS: Use external mbed TLS library for crypto implementation used in PPP AUTH
+ */
+#ifdef CONFIG_LWIP_USE_EXTERNAL_MBEDTLS
+#define LWIP_USE_EXTERNAL_MBEDTLS 1
+#else
+#define LWIP_USE_EXTERNAL_MBEDTLS 0
+#endif
+
 /*
    --------------------------------------
    ---------- Checksum options ----------
diff --git a/docs/en/api-guides/lwip.rst b/docs/en/api-guides/lwip.rst
index 56e9c54f67..462ded4e9e 100644
--- a/docs/en/api-guides/lwip.rst
+++ b/docs/en/api-guides/lwip.rst
@@ -459,6 +459,10 @@ Limitations
 
 ESP-IDF additions to lwIP still suffer from the global DNS limitation, described in :ref:`lwip-dns-limitation`. To address this limitation from application code, the ``FALLBACK_DNS_SERVER_ADDRESS()`` macro can be utilized to define a global DNS fallback server accessible from all interfaces. Alternatively, you have the option to maintain per-interface DNS servers and reconfigure them whenever the default interface changes.
 
+The number of IP addresses returned by network database APIs such as ``getaddrinfo()`` and ``gethostbyname()`` is restricted by the macro ``DNS_MAX_HOST_IP``. By default, the value of this macro is set to 1.
+
+In the implementation of ``getaddrinfo()``, the canonical name is not available. Therefore, the ``ai_canonname`` field of the first returned ``addrinfo`` structure will always refer to the ``nodename`` argument or a string with the same contents.
+
 Calling ``send()`` or ``sendto()`` repeatedly on a UDP socket may eventually fail with ``errno`` equal to ``ENOMEM``. This failure occurs due to the limitations of buffer sizes in the lower-layer network interface drivers. If all driver transmit buffers are full, the UDP transmission will fail. For applications that transmit a high volume of UDP datagrams and aim to avoid any dropped datagrams by the sender, it is advisable to implement error code checking and employ a retransmission mechanism with a short delay.
 
 .. only:: esp32