How to change your DNS settings

Your device asks a DNS resolver to turn every domain name into an address, and by default that resolver is your internet provider's. Changing it is one of the few network adjustments that is genuinely worth doing: It is usually faster, it sidesteps the most common cause of "the internet is down", and it takes about two minutes.

This page is the mechanics. Which resolver to choose is a separate question with a separate answer.

Router - Changes everything at once

The right place to do it if you want every device covered, including the ones with no settings screen of their own: Televisions, consoles, smart speakers, printers.

1. Open 192.168.1.1 or 192.168.0.1 in a browser. If neither responds, the address is printed on a label on the router.
2. Sign in. The default credentials are usually on the same label. If they have been changed and nobody remembers, you will need to reset the router - Which is a bigger job, so be sure before you start.
3. Find DNS settings. They are almost never in an obvious place. Try Internet, WAN, Network, LAN, DHCP, or Advanced.
4. Switch from "Obtain DNS automatically" or "Use ISP DNS" to manual, and enter both addresses.
5. Save. The router may restart, dropping everyone off for a minute.
6. Restart the devices on the network, or wait for their DHCP leases to renew.

Two things to know. Some ISP-supplied routers deliberately lock the DNS fields - If the setting is greyed out, you cannot change it there and will have to set each device individually, or put your own router behind theirs. And a handful of providers intercept port 53 and answer DNS queries themselves regardless of what you configured, which is worth checking with the verification step below.

Windows 11 and 10

The modern route, which also enables encrypted DNS:

1. Settings → Network & internet, then Wi-Fi or Ethernet.
2. Click the connection's name, then Hardware properties.
3. Beside DNS server assignment, click Edit.
4. Change Automatic (DHCP) to Manual, turn on IPv4.
5. Preferred DNS 1.1.1.1, Alternate DNS 1.0.0.1.
6. If DNS over HTTPS is offered, set it to On (automatic template). That encrypts the queries so your network cannot read or alter them.
7. Save.

The classic Control Panel route still works and is sometimes quicker: ncpa.cpl in the Run box, right-click the adapter, Properties, select Internet Protocol Version 4, Properties, "Use the following DNS server addresses".

Then flush the cache from an Administrator command prompt:

ipconfig /flushdns

macOS

1. System Settings → Network.
2. Select the active connection, then Details….
3. Choose the DNS tab.
4. Click + and add 1.1.1.1, then + again for 1.0.0.1.
5. Remove the greyed-out ISP entries if you want - They are inherited from DHCP and will not be used once you have added your own.
6. OK, then Apply.

Then flush:

sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

Note that macOS settings are per-network-service. Setting it on Wi-Fi does not affect Ethernet, and a new Wi-Fi network you join later will use the defaults again.

iPhone and iPad

1. Settings → Wi-Fi.
2. Tap the i beside the connected network.
3. Configure DNS → Manual.
4. Remove the existing servers, Add Server for 1.1.1.1, then again for 1.0.0.1.
5. Save.

This is per Wi-Fi network and does not apply to mobile data at all - IOS gives no way to change the resolver on cellular without a configuration profile. Both Cloudflare and Quad9 publish free profiles that set an encrypted resolver system-wide, including on mobile data, which is the only practical route if that is what you want.

Android

Android has two mechanisms and the good one is easy to miss.

Private DNS (Android 9 and later) - Recommended. This works on Wi-Fi and mobile data, and it is encrypted.

1. Settings → Network & internet → Private DNS. On Samsung it is under Connections → More connection settings.
2. Choose Private DNS provider hostname.
3. Enter a hostname, not an IP address: one.one.one.one for Cloudflare, dns.google for Google, or dns.quad9.net for Quad9.
4. Save.

Per-network static IP is the older method: Long-press the Wi-Fi network, Modify, Advanced, IP settings → Static, then fill in DNS 1 and DNS 2. It requires you to enter a static IP address for the device too, which is fiddly and breaks if you take the device to another network. Use Private DNS instead wherever the option exists.

Consoles

PlayStation 5: Settings → Network → Settings → Set Up Internet Connection → your network → Advanced Settings → DNS Settings → Manual.

Xbox Series X|S: Settings → General → Network settings → Advanced settings → DNS settings → Manual.

Nintendo Switch: System Settings → Internet → your network → Change Settings → DNS Settings → Manual.

Worth saying plainly, because it is a persistent myth: Changing DNS does not reduce ping or lag in games. Name resolution happens once, when you connect. Everything after that goes straight to the game server by IP address and never touches DNS again. It can make store pages and downloads start faster; it cannot affect in-game latency.

Verify it actually worked

This is the step almost every guide omits, and it matters because several things silently override what you just set.

The easy check: Open 1.1.1.1/help. It reports whether you are reaching Cloudflare's resolver and whether the connection is encrypted.

The precise check. On Windows:

nslookup example.com

The "Server:" line at the top is the resolver actually answering you. On macOS or Linux:

dig example.com | grep SERVER

If it still shows your ISP's resolver after a restart, one of these is the reason:

• A VPN is connected. VPN clients push their own resolver and override the system setting entirely. That is intended behaviour.
• The browser is using DNS over HTTPS. Firefox and Chrome can resolve names themselves, bypassing the operating system completely. Firefox: Settings → Privacy & Security → DNS over HTTPS. Chrome: Settings → Privacy and security → Security → Use secure DNS.
• You set it on the device but the router overrides it - Or the reverse. Whichever is closest to the application wins.
• The ISP intercepts port 53. A few do. Encrypted DNS (DoH or Android's Private DNS) defeats this, because interception relies on the queries being plain text.
• The cache was not flushed. Old answers keep being served until they expire.

If something breaks afterwards

Two things stop working for predictable reasons, and both are fixable.

Internal or work addresses stop resolving. Company and home-lab hostnames only exist on the local resolver, and a public one has never heard of them. On a work machine, leave DNS on automatic; on a home network, keep the router's own address as the third entry so local names still resolve.

Router-level ad blocking stops working. A Pi-hole or similar works by intercepting DNS queries. If a device now sends its queries encrypted to Cloudflare, the Pi-hole never sees them. Point devices at the Pi-hole and let the Pi-hole use the upstream resolver of your choice.

To undo any of this, set the value back to Automatic or DHCP and flush the cache. Nothing here is permanent and nothing can break the connection in a way a reset does not fix.