How to Change Your DNS Server on Windows, macOS, Linux, Android, iOS and Router

Short answer. To change your DNS server, open the properties of your network connection and enter resolver addresses manually: Windows 11 — Settings, Network, Hardware properties, DNS server assignment; macOS — Network, Details, DNS; Linux — systemd-resolved or NetworkManager; Android — Private DNS; iOS — Configure DNS. This changes the resolver for you only and does not touch your domain's NS records.

"Changing DNS" means two completely different things

The phrase "change DNS" covers two operations that share nothing but the acronym. People confuse them constantly and end up editing the wrong thing: switching the resolver on a laptop hoping a website will move to new hosting, or editing a domain's NS records when a single site simply fails to load.

Scenario 1: change the resolver on your device or router

A recursive resolver is the server you ask "what is the IP of example.com". By default its address arrives over DHCP from your ISP. When you type 1.1.1.1, 8.8.8.8 or 9.9.9.9 into your adapter settings, you are simply choosing a different middleman for your own lookups. It affects you only — or every device on your network if you edit the router. No visitor to your website will ever notice.

Common reasons: the ISP resolver is slow or serves stale cached records; you want a resolver that filters malicious domains, or one that filters nothing; you need to prove whether a problem is caused by the resolver at all; you want encrypted queries over DoH or DoT.

Scenario 2: change the domain's NS records at the registrar

NS records declare which DNS servers are authoritative for a zone. You change them when moving to a different host or a different DNS provider. This affects every visitor worldwide, does not apply instantly, and happens in the registrar's control panel — not in Windows network settings. Details are in NS records and delegation explained and in the guide to DNS propagation.

A simple test: if the problem is visible only to you, and the site loads fine from a phone on mobile data, you need scenario 1. If the site is down for everyone right after a hosting migration, you need scenario 2.

Where DNS actually changes and who it affects

Where it changes	Who it affects	When it applies	How to verify
Device: desktop, laptop, phone	That device only	Immediately after saving, plus a cache flush	nslookup, resolvectl status, ipconfig /all
Router: WAN or LAN/DHCP section	Every device on the network except those with manual DNS	After the DHCP lease renews or the device reconnects	ipconfig /all on a client, router status page
VPN profile or corporate policy	Traffic inside the tunnel, sometimes all traffic	The moment the VPN connects	DNS leak test, DNS lookup
Domain NS records at the registrar	Every visitor to the site, worldwide	Minutes to 1–2 days, depending on TTL and caches	WHOIS and propagation check
A/AAAA/CNAME records at the DNS provider	Every visitor to the site	According to that record's TTL	DNS lookup, dig

How to change the DNS server on Windows 11 and Windows 10

The mechanics are identical in both systems: a network adapter has IPv4 and IPv6 protocol properties, and you can switch them from "obtain automatically" to manual entry. Only the path to those properties differs.

Windows 11: through Settings

1. Open Settings → Network & internet.
2. Pick the active connection: Wi-Fi or Ethernet.
3. Click Hardware properties (for Wi-Fi, select the network itself first).
4. Next to DNS server assignment, click Edit.
5. Switch the dropdown from Automatic (DHCP) to Manual.
6. Turn on the IPv4 toggle and enter the preferred and alternate DNS servers.
7. If IPv6 is live on your network, turn on that toggle too and enter IPv6 resolver addresses. Otherwise the system keeps querying the ISP's IPv6 resolver and results become unpredictable.
8. Click Save.

Recent Windows 11 builds add a DNS over HTTPS option next to each entry, with values "Off", "On (automatic template)" and encrypted-preferred behaviour. It becomes available when the address you typed is in the built-in list of known DoH resolvers. How that protocol works is covered in DNS over HTTPS explained.

Windows 10: through Network Connections

1. Press Win + R, type ncpa.cpl and press Enter — the adapter list opens. The same screen lives under Control Panel → Network and Internet → Network and Sharing Center → Change adapter settings.
2. Right-click the active adapter → Properties.
3. Select Internet Protocol Version 4 (TCP/IPv4) → Properties.
4. Choose Use the following DNS server addresses and enter two addresses.
5. Repeat for Internet Protocol Version 6 (TCP/IPv6) if IPv6 is in use.
6. Click OK in both dialogs.

On Windows 10 version 2004 and later the same result is available through Settings → Network & Internet → Change connection properties → IP settings → Edit → Manual.

PowerShell and netsh: faster and repeatable

The console is far more convenient when you have many adapters or need to repeat the change on several machines. Run PowerShell as Administrator.

# See which resolvers are in use right now
Get-DnsClientServerAddress -AddressFamily IPv4

# Find the exact name of the active adapter
Get-NetAdapter | Where-Object Status -eq 'Up' | Format-Table Name, InterfaceDescription, Status

# Set resolvers manually (IPv4)
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses ("1.1.1.1","9.9.9.9")

# Set IPv6 resolvers
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses ("2606:4700:4700::1111","2620:fe::fe")

# Roll back to DHCP-provided addresses
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ResetServerAddresses

# Flush the Windows resolver cache
Clear-DnsClientCache

The netsh equivalent, if PowerShell is unavailable:

netsh interface ip show dnsservers
netsh interface ip set dns name="Ethernet" source=static addr=1.1.1.1
netsh interface ip add dns name="Ethernet" addr=9.9.9.9 index=2
netsh interface ip set dns name="Ethernet" source=dhcp

ipconfig /all
ipconfig /flushdns

ipconfig /all prints a "DNS Servers" section per adapter — the quickest way to confirm the change took effect. If stale answers keep coming back, flush the cache with ipconfig /flushdns. A full walkthrough of every cache layer is in how to flush the DNS cache.

Do not change DNS on a work machine joined to an Active Directory domain. Domain controllers are located through internal SRV records that public resolvers do not have. Replacing the resolver breaks domain logon, group policy processing and access to network shares. In a corporate network this change belongs to the administrator, applied centrally.

How to change DNS on macOS

On current macOS versions the path is: System Settings → Network → select the active service (Wi-Fi or Ethernet) → Details… → the DNS tab → the + button under "DNS Servers" → type the address → OK. On older releases with the previous settings UI it was System Preferences → Network → Advanced → DNS.

An important macOS quirk: DNS settings belong to a network service, not to the system as a whole. If you have both Wi-Fi and Ethernet, edit the service that actually carries traffic — or edit both. Greyed-out entries in the list are addresses learned over DHCP and will be overwritten; your manual entries appear in normal black text and take priority.

# List network services in the order the system uses them
networksetup -listallnetworkservices

# Which resolvers are currently set manually for Wi-Fi
networksetup -getdnsservers Wi-Fi

# Set resolvers (order matters: the first one is primary)
sudo networksetup -setdnsservers Wi-Fi 1.1.1.1 9.9.9.9

# Return to DHCP-provided values
sudo networksetup -setdnsservers Wi-Fi Empty

# What the system is actually resolving with right now
scutil --dns

# Flush the resolver cache
sudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder

If the service name differs from Wi-Fi — for example "Wi-Fi 2" or "USB 10/100/1000 LAN" — copy the exact spelling from networksetup -listallnetworkservices and wrap it in quotes.

Note that recent macOS releases may not ship dig and nslookup in the base install. In that case use scutil --dns and dscacheutil -q host -a name example.com, or install a package with the BIND utilities.

How to change DNS on Linux: systemd-resolved, NetworkManager and /etc/resolv.conf

Linux causes the most confusion, because several subsystems store DNS configuration and /etc/resolv.conf is no longer the source of truth on most modern distributions.

First, find out who owns name resolution

# Who owns resolv.conf: a real file or a symlink?
ls -l /etc/resolv.conf
cat /etc/resolv.conf

# Is systemd-resolved running
systemctl is-active systemd-resolved
resolvectl status

If /etc/resolv.conf is a symlink to /run/systemd/resolve/stub-resolv.conf and contains nameserver 127.0.0.53, queries go to the local systemd-resolved stub, and the real upstream addresses appear in resolvectl status under "DNS Servers" for each link.

Hand-editing /etc/resolv.conf is almost always pointless: NetworkManager, systemd-resolved, resolvconf or the DHCP client will rewrite the file on the next reconnect or reboot. Change the setting in whichever subsystem owns that file.

Option A: systemd-resolved

Temporarily, until the link is reconfigured:

sudo resolvectl dns wlan0 1.1.1.1 9.9.9.9
resolvectl status wlan0
resolvectl flush-caches

Permanently, via /etc/systemd/resolved.conf or a drop-in file under /etc/systemd/resolved.conf.d/:

[Resolve]
DNS=1.1.1.1 9.9.9.9
FallbackDNS=
Domains=~.
DNSOverTLS=opportunistic
DNSSEC=allow-downgrade

Then run sudo systemctl restart systemd-resolved. The Domains=~. line matters: it makes your servers the default route for all domains, otherwise per-link resolvers learned over DHCP may win. Every directive is documented in the official systemd documentation.

Option B: NetworkManager

If DHCP settings keep overriding yours, set the resolvers on the connection profile and forbid taking them from DHCP:

nmcli connection show

sudo nmcli connection modify "Wired connection 1" ipv4.dns "1.1.1.1 9.9.9.9"
sudo nmcli connection modify "Wired connection 1" ipv4.ignore-auto-dns yes

# IPv6 uses its own properties
sudo nmcli connection modify "Wired connection 1" ipv6.dns "2606:4700:4700::1111"
sudo nmcli connection modify "Wired connection 1" ipv6.ignore-auto-dns yes

# Apply by bouncing the connection
sudo nmcli connection down "Wired connection 1"
sudo nmcli connection up "Wired connection 1"

Verify with resolvectl status or nmcli device show | grep DNS. On servers without NetworkManager, look at systemd-networkd instead — the DNS= option in the [Network] section of a .network unit — or at the netplan configuration if your distribution uses it.

How to change the DNS server on Android and iPhone

Android: "Private DNS" is DNS-over-TLS, and it wants a hostname

Since Android 9 the system has a global Private DNS setting: Settings → Network & internet → Private DNS (in some vendor skins it hides under "Advanced" or "More settings"). Choose Private DNS provider hostname and enter the resolver's domain name.

The most common mistake: typing an IP address such as 1.1.1.1 into the Private DNS field and getting "Couldn't connect". That field accepts a hostname only — for example dns.google or one.one.one.one — because the mode runs over DNS-over-TLS (RFC 7858, port 853) and requires a valid TLS certificate for that name.

The upside: it applies on both Wi-Fi and mobile data, and queries are encrypted. The downside: if the resolver becomes unreachable, connectivity stops entirely — in strict mode Android does not fall back to plain DNS.

To change DNS for a single Wi-Fi network only: long-press the network → Modify network → Advanced options → IP settings: Static → fill in DNS 1 and DNS 2. The catch is that this path forces you to enter a static IP address, gateway and prefix length as well; get one wrong and the network stops working. Fine for a one-off test, poor as a permanent setup.

iPhone and iPad

Go to Settings → Wi-Fi → tap the (i) icon next to the connected network → Configure DNS → switch from Automatic to Manual → Add Server → type the address → Save. Addresses inherited from DHCP can be removed with the minus button.

Two iOS limitations. First, the setting is bound to that specific Wi-Fi network — join another network and DHCP takes over again. Second, DNS for the cellular connection cannot be changed with built-in controls. A system-wide encrypted resolver (DoH or DoT) on iOS requires a configuration profile or an app that installs one. Only install profiles from sources you trust: such a profile redirects every DNS query the device makes.

How to change the DNS server on a router

Changing DNS on the router is the practical option when every device on the network should use the new resolver: TV, console, smart plugs, guests. Clients pick the addresses up over DHCP and need no individual configuration.

The general procedure:

1. Open the router admin panel — usually 192.168.0.1 or 192.168.1.1. The exact address equals your default gateway: check it with ipconfig /all on Windows or ip route on Linux.
2. Find the internet settings section: WAN, Internet or Internet Setup. It normally has a toggle between "Obtain DNS server address automatically" and "Use the following DNS servers".
3. Check the LAN → DHCP server section separately. That is where you define which resolver addresses the router hands out to clients (DHCP option 6). On many models the two sections are independent: the WAN setting only affects the router itself, while clients keep receiving the ISP's addresses.
4. Save and reboot the router if it asks you to.

Clients do not pick this up instantly: a device learns the new addresses when its DHCP lease renews or when it reconnects. The fastest nudge is toggling Wi-Fi off and on, then checking ipconfig /all.

A device with manually configured DNS ignores router settings entirely. If a laptop still queries the old resolver after you changed the router, it almost certainly kept manual addresses from an earlier experiment. Put the adapter back into DHCP mode.

Consoles, TVs and everything else

On a PlayStation 5 the path is roughly Settings → Network → Settings → Set Up Internet Connection → pick the network → Advanced Settings → DNS Settings: Manual → enter primary and secondary addresses. On Xbox it is Settings → General → Network settings → Advanced settings → DNS settings → Manual. Menu labels shift between firmware versions, but the logic is always the same: manual entry instead of automatic.

For devices with no meaningful interface — smart bulbs, cameras, printers — the router is the only practical place to change DNS. Be aware that some IoT devices ignore the DHCP-provided resolver and talk to hardcoded addresses instead. You can spot that in the router logs or by watching port 53 traffic from the device's address.

How to verify the DNS change actually took effect

Verification has two halves: which resolver is serving you, and what it answers.

Local commands

# Windows: the Server line shows the resolver in use
nslookup example.com

# Windows: the "DNS Servers" section for each adapter
ipconfig /all

# Linux: which server answered and over which protocol
resolvectl query example.com
resolvectl status

# Linux/macOS: query specific resolvers and compare answers
dig +short example.com @1.1.1.1
dig +short example.com @8.8.8.8

# Look up the authoritative NS records (scenario 2)
dig NS example.com +short
nslookup -type=ns example.com

If different resolvers disagree, one of them most likely holds a stale cached record and you simply wait for the TTL to expire. If your local nslookup still prints the old address on the Server line, the change did not apply: check that you edited the right adapter and that IPv4 and IPv6 settings do not contradict each other.

Checking from the outside with enterno.io

• DNS record lookup — shows what public resolvers return for your domain: A, AAAA, MX, TXT, NS. Useful for separating "my device is broken" from "the zone is broken".
• DNS propagation check — queries resolvers in many locations worldwide. This is what you need after changing NS records or an IP address: it shows where the update is already visible and where old cached data still wins.
• WHOIS lookup — shows which NS servers the registry currently lists for the domain. That is the source of truth for scenario 2: if it still shows the old servers, the change at the registrar did not save.

If nothing resolves at all after switching resolvers, the usual causes are collected in DNS not resolving: how to fix it.

Public DNS resolvers: how they differ and how to choose

There are many public resolvers and they all do the same job — resolve names recursively. What differs is filtering policy, support for encrypted transports, how close their nodes are to you, and what the operator does with query logs. A ranking is meaningless here: the "best" one depends on your goal and your route to the nearest node.

Resolver type	What it gives you	What to watch out for
ISP resolver (default)	Usually the closest one on the network, minimal latency	Cache quality, how quickly records refresh, possible answer rewriting
Public, unfiltered	Neutral answers, wide anycast footprint, DoH/DoT support	Blocks nothing malicious — protection stays on other layers
Public with threat filtering	Blocks known malicious and phishing domains at the DNS layer	False positives; DNS-level blocking is bypassed by using a raw IP
Ad and tracker blocking	Fewer requests to ad domains across every device on the network	Can break some sites and apps; the block lists are maintained by a third party
Family or "safe" variants	Adult-content filtering at the network level	Bypassed by any other resolver or a VPN, so it is not a control mechanism
Your own recursive resolver	Full control, no third party in the chain	Needs maintenance, DNSSEC validation and protection against outside abuse

Practical advice: configure two addresses from different networks, not two addresses from the same operator. If the primary resolver goes fully dark, a secondary from the same anycast network will most likely be dark too. A detailed comparison of the popular options lives in public DNS servers compared, and the difference between recursive, authoritative and forwarding servers is covered in DNS server types explained.

After switching, measure the difference honestly: compare response times across a dozen domains before and after instead of trusting the feeling that "it got faster". Any speed-up is measured in tens of milliseconds on the first lookup of a new domain; for names already in cache there is no difference at all.

What changing DNS does not do: myths, risks and DNS leaks

What a new resolver does not change

• It does not change your IP address. Your public IP comes from your ISP; the resolver has nothing to do with it. Check yours with the IP lookup tool.
• It does not make you anonymous. Quite the opposite: you hand the full list of domains you visit to a new operator instead of your ISP. Nothing becomes private, only the recipient changes.
• It does not always restore access to a site. If a resource is restricted at the IP level or by the SNI field in the TLS handshake, changing resolvers achieves nothing: the name resolves and the connection still fails.
• It does not speed up your internet. Bandwidth, packet loss and routing do not depend on the resolver. Only the latency of the first name lookup is affected. Claims of "double your internet speed" are marketing.
• DoH and DoT hide the query only. The path to the resolver is encrypted. After that you still open a TCP connection to the site's IP address, and that address is visible on the wire.

Risks

Dubious "DNS accelerators" and "DNS optimizer" utilities from untrusted sources swap your resolver for their own and gain the complete list of your queries — and, in the worst case, the ability to return forged answers. The same risk comes from an iOS configuration profile or a VPN client that silently overrides DNS. Symptoms of tampering: sites load but carry unfamiliar ads, or a banking site looks subtly wrong. Check the chain: which resolver answers, whether the returned IP matches expectations, and whether the TLS certificate validates.

DNS leaks with a VPN

The classic failure: the VPN is up and traffic goes through the tunnel, but DNS queries escape around it — to the ISP resolver or to addresses hardcoded on the physical adapter. Typical causes: manual DNS addresses on the physical adapter outrank the ones the VPN pushes; Windows queries several interfaces in parallel; on Linux systemd-resolved keeps per-link configuration and without Domains=~. may keep asking the "home" resolver.

The fix: remove manual addresses from the physical adapter, enable the VPN client options for "use tunnel DNS" and blocking queries outside the tunnel, and on Linux check resolvectl status to see which link is the default route for domains. Step-by-step diagnostics are in how to test and fix a DNS leak.

Frequently asked questions

How many DNS servers should I enter — one, two or more?

Two is the sensible minimum: if the first one stops answering, the system falls back to the second after a timeout. Adding more than two rarely helps — client resolvers seldom reach the third and fourth entry, and the cumulative timeouts grow. What matters is that the addresses belong to different operators.

Do I need to reboot after changing DNS?

No. Apply the settings and flush the cache: ipconfig /flushdns on Windows, sudo dscacheutil -flushcache plus restarting mDNSResponder on macOS, resolvectl flush-caches on Linux. Keep in mind that browsers maintain their own DNS and connection caches, so restarting the browser sometimes helps.

I changed DNS but the site still shows the old IP. Why?

Most likely it is not your resolver but the record TTL: an old answer still lives somewhere in the cache chain. Check the record TTL with the DNS lookup and the worldwide picture with the propagation check. The other common cause is a leftover entry in your local hosts file, which is consulted before DNS.

Does changing DNS on my machine affect my website's visitors?

No. The resolver on your device serves your queries only. Visitors are affected by the domain's NS records, the contents of the zone and the DNS provider's settings — all edited in the registrar or DNS hosting panel.

Android: Private DNS or manual addresses in Wi-Fi settings?

Private DNS is the more robust choice: it works on every network including mobile data, encrypts queries, and does not force you to configure a static IP. Manual addresses in Wi-Fi properties are worth using only for a one-off test on a specific network.

How do I roll everything back if something breaks?

Return the adapter to automatic addressing: on Windows Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ResetServerAddresses, on macOS sudo networksetup -setdnsservers Wi-Fi Empty, on Linux ipv4.ignore-auto-dns no in the NetworkManager profile, on Android set Private DNS to "Off", on iOS set Configure DNS back to "Automatic". Then flush the cache.

DNS change checklist:

• Identified the scenario: your own resolver, or the domain's NS records at the registrar.
• Wrote down the current values so there is something to roll back to.
• Entered two addresses from different networks, not two from the same operator.
• Configured IPv6 resolvers if IPv6 is actually in use on the network.
• Confirmed you edited the active adapter or network service, not an idle one.
• Flushed the resolver cache and, if needed, restarted the browser.
• Verified with nslookup, ipconfig /all or resolvectl status that the new server answers.
• Left DNS alone on Active Directory domain machines unless the administrator agreed.
• Reconnected clients after a router change so they renew their DHCP lease.
• Checked for DNS leaks if a VPN is in play.
• For the domain scenario: confirmed NS records via WHOIS and the rollout via the propagation check.