How to Change Your DNS Server on Windows, Mac, Linux & Router

Your ISP provides a default DNS server, but switching to a third-party DNS can offer several benefits:

• Speed: Public DNS servers like Cloudflare (1.1.1.1) and Google (8.8.8.8) are often faster than ISP DNS, reducing page load times.
• Reliability: Major public DNS services have 100% uptime SLAs and global anycast networks. ISP DNS servers sometimes go down or become slow.
• Privacy: Some DNS providers (like Cloudflare) commit to not selling your DNS queries and purge logs within 24 hours. ISP DNS may log and sell your browsing data.
• Security: Services like Quad9 (9.9.9.9) automatically block known malicious domains. Cloudflare's 1.1.1.2 and 1.1.1.3 offer content filtering options.
• Access: Some ISP DNS servers have stale caches or fail to resolve certain domains. Switching to a public DNS can fix these issues.

Which one to choose? Cloudflare (1.1.1.1) is typically the fastest. Google (8.8.8.8) has the longest track record. Quad9 is best if you want automatic malware blocking. OpenDNS is best for families who want content filtering with custom settings.

1. Open Settings > Network & internet > Wi-Fi (or Ethernet).
2. Click on your connected network.
3. Click Edit next to DNS server assignment.
4. Switch from "Automatic (DHCP)" to Manual.
5. Toggle IPv4 on.
6. Enter your preferred DNS server (e.g., 1.1.1.1) as Preferred DNS.
7. Enter the secondary DNS (e.g., 1.0.0.1) as Alternate DNS.
8. Optionally toggle IPv6 on and enter the IPv6 DNS addresses.
9. Click Save.

Verify: Open Command Prompt and run nslookup google.com. The server shown should be your new DNS. Also check using LookMyIP's DNS Lookup tool to confirm queries are going through the expected resolver.

1. Open System Settings (or System Preferences on older macOS).
2. Click Network in the sidebar.
3. Select your active connection (Wi-Fi or Ethernet).
4. Click Details (or Advanced on older macOS).
5. Click DNS in the sidebar.
6. Click the + button to add DNS servers.
7. Enter 1.1.1.1 and 1.0.0.1 (or your preferred DNS).
8. Remove any existing DNS entries you don't want by selecting them and clicking -.
9. Click OK, then Apply.

Flush DNS cache after changing: Open Terminal and run: sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

Verify: Run nslookup google.com in Terminal to confirm the new DNS is being used.

Using NetworkManager (Ubuntu, Fedora, etc.):

1. Open Settings > Network > click the gear icon on your connection.
2. Go to the IPv4 tab.
3. Turn off "Automatic" for DNS and enter your DNS servers.
4. Apply and reconnect.

Using the terminal (systemd-resolved):

1. Edit /etc/systemd/resolved.conf:

sudo nano /etc/systemd/resolved.conf

1. Set: DNS=1.1.1.1 1.0.0.1
2. Restart the service: sudo systemctl restart systemd-resolved

Change DNS at the router level (recommended): Changing DNS on your router applies to every device on your network:

1. Log into your router's admin panel (usually 192.168.1.1 or 192.168.0.1).
2. Find DNS settings (often under WAN, Internet, or DHCP settings).
3. Replace the ISP DNS servers with your preferred DNS (e.g., 1.1.1.1 and 1.0.0.1).
4. Save and reboot the router.

This is the best approach because it protects all devices, including smart home devices and IoT devices that you can't configure individually.

Setting DNS on each device works, and it is tedious and easy to get wrong. Setting it once on the router applies to everything that joins the network — phones, consoles, smart TVs, guests — because the router hands out DNS settings over DHCP.

The path varies by manufacturer, but the shape is the same:

1. Find the router's address. It is the default gateway: ipconfig on Windows, ip route | grep default on Linux, or System Settings → Network → Details on macOS. It is usually 192.168.1.1 or 192.168.0.1.
2. Open it in a browser and log in. If you have never changed the password, it is on a sticker on the device — and you should change it.
3. Find DNS settings. Common locations are Internet / WAN, LAN / DHCP Server, or Advanced → Network.
4. Set the primary and secondary servers, save, and reboot the router.

Set them in the DHCP section if there is a choice. Some routers have DNS fields in both the WAN and LAN/DHCP sections. The WAN fields set which resolver the router itself uses; the DHCP fields set what it advertises to clients. You generally want both, but the DHCP one is what actually affects your devices.

Two caveats catch people out.

Some ISP-supplied routers do not allow it. The fields are absent or greyed out, deliberately. Your options are to put the ISP device into bridge mode and run your own router behind it, or to configure DNS per device.

Devices may cache the old settings until they renew their lease. Rebooting the router is usually enough; if not, disconnect and reconnect the client, or run ipconfig /release and ipconfig /renew.

Verify the change took effect from a client:

nslookup -type=txt o-o.myaddr.l.google.com ns1.google.com

The address returned should be your chosen resolver, not your ISP's.

Changing your resolver stops your ISP from *answering* your queries. It does not stop them from *reading* them, because plain DNS is unencrypted. Encrypted DNS closes that gap, and every major platform now supports it natively.

Windows 11. Settings → Network & Internet → your adapter → Hardware properties → DNS server assignment → Edit. Set the addresses manually and change "DNS over HTTPS" to On (automatic template). Windows recognises the well-known resolvers and applies the correct DoH endpoint.

macOS and iOS. No built-in interface, but they support DNS configuration profiles. Cloudflare, Quad9 and NextDNS all publish signed .mobileconfig profiles — download, install in Settings, and encrypted DNS applies system-wide including on cellular.

Android 9+. Settings → Network & Internet → Private DNS → Private DNS provider hostname. Enter a hostname, not an IP address:

one.one.one.one          (Cloudflare)
dns.google               (Google)
dns.quad9.net            (Quad9)

This uses DNS over TLS and applies to Wi-Fi and mobile data alike. It is the single easiest encrypted DNS setup on any platform.

Firefox. Settings → Privacy & Security → Enable DNS over HTTPS. Note this applies to Firefox only; the rest of the system continues using the OS resolver.

Chrome. Settings → Privacy and security → Security → Use secure DNS.

Linux with systemd-resolved. Edit /etc/systemd/resolved.conf:

[Resolve]
DNS=1.1.1.1#one.one.one.one 1.0.0.1#one.one.one.one
DNSOverTLS=yes
DNSSEC=yes

Then sudo systemctl restart systemd-resolved.

One honest caveat: encrypted DNS moves your queries from your ISP to your resolver operator. You are choosing a different observer, not removing one. Pick an operator whose privacy policy you have actually read.

Most DNS changes are uneventful. The failures that do occur follow a small number of patterns.

Internal or corporate hostnames stop resolving. Company intranets, network printers and NAS devices are often published only by an internal DNS server. Overriding DNS globally means those names no longer resolve. On a work machine, do not change DNS; if you must, configure split DNS so internal domains still go to the internal resolver. On Linux with systemd-resolved:

sudo resolvectl domain eth0 '~corp.example.com'

Captive portals fail to appear. Hotel and airport Wi-Fi hijacks DNS to redirect you to a login page. A hardcoded resolver, and especially encrypted DNS, defeats the hijack — so the portal never loads and you cannot get online. Temporarily set DNS back to automatic, authenticate, then switch back.

Content filtering stops working. If you rely on router-level filtering or a school/parental control service, it almost certainly works by DNS. A device configured with its own DoH resolver bypasses it entirely, which is precisely why some networks block encrypted DNS.

Some CDN-hosted sites get slower. CDNs choose a nearby server based on the resolver's location. A resolver far from you, or one that does not send EDNS Client Subnet, can direct you to a distant node. Cloudflare deliberately omits Client Subnet for privacy reasons, which occasionally trades a few milliseconds of CDN accuracy for less information disclosure. Google's resolver does send it.

VPN conflicts. A VPN that pushes its own DNS servers overrides your setting while connected, which is usually correct behaviour — it prevents DNS leaks. If your queries need to go to your chosen resolver instead, that is a VPN client setting, not an OS one.

If something breaks after a change, set DNS back to automatic first to confirm DNS is actually the cause before investigating further.

Will changing DNS make my internet faster?

Marginally, and only for the first lookup of each new domain — typically 10–50ms saved. It has no effect on download speed, video quality or throughput. The realistic benefits are reliability, avoiding ISP redirection of failed lookups to advertising pages, and optional malware filtering.

Is it safe to use a public DNS server?

From the major operators, yes. The trade-off is that they see your query history. Cloudflare and Quad9 both publish privacy commitments and Cloudflare has had its no-logging claim independently audited. Avoid obscure free resolvers with no published policy — DNS is a powerful position from which to redirect traffic.

Can I use two different providers as primary and secondary?

You can, and it is generally a poor idea. There is no guarantee which one is queried, so you get the *weaker* provider's filtering and privacy properties at random. Use both addresses from the same operator — for example 1.1.1.1 and 1.0.0.1.

Does changing DNS hide my browsing from my ISP?

Not by itself. Plain DNS is unencrypted, so your ISP can still read the queries in transit even when they go to a different resolver. Encrypted DNS prevents that, though the TLS handshake to the site itself has historically still exposed the hostname via SNI.

How do I undo the change?

Set DNS back to "Obtain automatically" or DHCP on whichever layer you changed — device, router or both. Then flush the local cache: ipconfig /flushdns on Windows, sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder on macOS, sudo resolvectl flush-caches on Linux.