Change your DNS servers

DNS turns names into addresses. By default your devices ask your router, which asks your ISP. Switching to a different resolver can fix outages, speed up lookups, block malware or adult content, or give you encrypted queries. Here is how, everywhere.

Which servers?

Two things to weigh. First, local names: if you point a computer straight at 1.1.1.1, it can no longer resolve printer.home or nas via the router; use the router as one of the servers, or change DNS on the router instead of the device. Second, CDN locality: some content networks pick servers by your resolver's location; the large providers handle this well now, so it rarely matters.

Where to change it

• On the router: every device on the LAN gets the new servers via DHCP. Best for households. The setting is usually under Internet/WAN or DHCP server; some ISP routers (Sky, Virgin Media Hub in router mode) do not allow it, in which case change it per device or put the hub in modem mode behind your own router.
• On the device: overrides the router. Best for one machine, or laptops that roam.
• In the browser: Chrome, Edge, Firefox and Brave can use DNS-over-HTTPS independently of the OS. Handy on a locked-down machine, but it only affects that browser.

Windows

Settings (Windows 11)

1. Settings › Network & internet › Ethernet, or Wi-Fi › your network's properties.
2. Next to DNS server assignment click Edit, choose Manual, switch IPv4 on.
3. Enter preferred and alternate DNS. Set DNS over HTTPS to On (automatic template) for a provider Windows knows (Cloudflare, Google, Quad9) to encrypt the queries. Save.

Command line

netsh interface ipv4 set dnsservers name="Ethernet" static 1.1.1.1 primary
netsh interface ipv4 add dnsservers name="Ethernet" 1.0.0.1 index=2
netsh interface ipv6 set dnsservers name="Ethernet" static 2606:4700:4700::1111 primary
ipconfig /flushdns

:: back to DHCP-supplied
netsh interface ipv4 set dnsservers name="Ethernet" source=dhcp

Set-DnsClientServerAddress -InterfaceAlias Ethernet -ServerAddresses 1.1.1.1, 1.0.0.1
Clear-DnsClientCache
Get-DnsClientServerAddress -AddressFamily IPv4

# DNS over HTTPS (Windows 11)
Add-DnsClientDohServerAddress -ServerAddress 1.1.1.1 -DohTemplate https://cloudflare-dns.com/dns-query -AllowFallbackToUdp $false -AutoUpgrade $true
Get-DnsClientDohServerAddress

# back to DHCP-supplied
Set-DnsClientServerAddress -InterfaceAlias Ethernet -ResetServerAddresses

Apply it to every adapter at once: Get-NetAdapter | Where-Object Status -eq Up | Set-DnsClientServerAddress -ServerAddresses 1.1.1.1, 1.0.0.1.

macOS

1. System Settings › Network › the service (Wi-Fi or Ethernet) › Details… › DNS.
2. Click + under DNS Servers and add each address. Greyed-out entries are the DHCP-supplied ones and disappear once you add your own.
3. OK, then Apply. Flush: sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder.

sudo networksetup -setdnsservers "Wi-Fi" 1.1.1.1 1.0.0.1 2606:4700:4700::1111
networksetup -getdnsservers "Wi-Fi"
scutil --dns | grep nameserver          # what is really in use

# back to DHCP-supplied
sudo networksetup -setdnsservers "Wi-Fi" Empty

Encrypted DNS on macOS and iOS is set up by installing a configuration profile from the provider (Cloudflare, Quad9, NextDNS and AdGuard all publish one) or via an app such as the 1.1.1.1 app. Once installed it applies system-wide and shows in scutil --dns as a resolver with flags: Supplemental and a DoH/DoT protocol.

Linux

sudo nmcli con mod "Wired connection 1" ipv4.dns "1.1.1.1 1.0.0.1" ipv4.ignore-auto-dns yes
sudo nmcli con mod "Wired connection 1" ipv6.dns "2606:4700:4700::1111" ipv6.ignore-auto-dns yes
sudo nmcli con up "Wired connection 1"
resolvectl status    # or: cat /etc/resolv.conf

# per interface, until reboot
sudo resolvectl dns enp3s0 1.1.1.1 1.0.0.1
# global, persistent: /etc/systemd/resolved.conf
#   [Resolve]
#   DNS=1.1.1.1#cloudflare-dns.com 1.0.0.1#cloudflare-dns.com
#   DNSOverTLS=yes
#   FallbackDNS=9.9.9.9
sudo systemctl restart systemd-resolved
resolvectl status

network:
  version: 2
  ethernets:
    enp3s0:
      dhcp4: true
      dhcp4-overrides:
        use-dns: false
      nameservers:
        addresses: [1.1.1.1, 1.0.0.1]

sudo netplan apply

# only when nothing manages the file (check: ls -l /etc/resolv.conf is not a symlink)
sudo tee /etc/resolv.conf <<'X'
nameserver 1.1.1.1
nameserver 1.0.0.1
options timeout:2 attempts:2
X
# dhclient will overwrite it at the next lease; to stop that:
# echo 'supersede domain-name-servers 1.1.1.1, 1.0.0.1;' | sudo tee -a /etc/dhclient.conf

If /etc/resolv.conf keeps reverting, something is managing it: systemd-resolved (the symlink to stub-resolv.conf), NetworkManager, resolvconf, or dhclient. Change the setting in that manager rather than fighting the file. Details →

iPhone and iPad

Settings › Wi-Fi › (i) › Configure DNS › Manual › delete the existing entries and add yours. Per network; mobile data DNS cannot be changed in Settings. For all connections including mobile data, install a provider's encrypted-DNS profile (Settings › General › VPN & Device Management after downloading it) or use a DNS app.

Android

Two mechanisms. Private DNS (Android 9 and later): Settings › Network & internet › Private DNS › Private DNS provider hostname › enter one.one.one.one, dns.google, dns.quad9.net or dns.adguard-dns.com. This is DNS-over-TLS and applies to Wi-Fi and mobile data. Per-network static DNS: edit the Wi-Fi network › Advanced › IP settings › Static, which also requires a static IP; avoid unless you need it.

Routers

Look for Internet, WAN, DHCP Server or DNS settings. Two different fields may exist: the DNS servers the router itself uses upstream, and the DNS servers it hands to clients via DHCP. Changing the upstream one is enough for most homes (clients still point at the router, which forwards to your chosen resolver). Changing the DHCP one makes clients bypass the router. UK ISP hubs: BT Smart Hub 2 and later allow custom DNS under Advanced Settings › Broadband; Sky and Virgin Media hubs do not, and Virgin's Hub 5 in modem mode behind your own router is the usual workaround. OpenWrt: Network › Interfaces › WAN › Advanced › Use custom DNS servers; Pi-hole: Settings › DNS › Upstream servers.

Browsers (DNS-over-HTTPS)

Browser DoH bypasses the OS and the router entirely, including Pi-hole style blocking. If you run a network-wide blocker and it seems to have stopped working in one browser, this is why.

Verify which resolver is answering

nslookup example.com                 # first lines show the server used (Windows/mac/Linux)
dig example.com | grep SERVER        # Linux/macOS
resolvectl status                    # Linux systemd-resolved
scutil --dns | grep nameserver       # macOS
Get-DnsClientServerAddress           # PowerShell
dig +short whoami.akamai.net         # returns the address of the resolver that reached Akamai
dig +short txt ch id.server @9.9.9.9 # which Quad9 node you hit

Then flush the cache (how) and, if using an encrypted provider, confirm at the provider's test page: Cloudflare has 1.1.1.1/help, which reports whether DoH or DoT is active.

Related pages

• Flush the DNS cache
• nslookup, dig and host
• DNS troubleshooting
• Set a static IP address