How do I change DNS settings on macOS Sonoma?

Changing your DNS server on macOS Sonoma takes under a minute. Open System Settings → Network, click Details next to your active connection, go to the DNS tab, remove existing entries, add your preferred server IPs, click OK, then click Apply. For a one-liner in Terminal: sudo networksetup -setdnsservers Wi-Fi 1.1.1.1 1.0.0.1. Flush the DNS cache afterward so stale cached records do not linger.

Why Change Your Default DNS Resolver

Out of the box, your Mac uses whatever DNS server your router assigns over DHCP — almost always your ISP's resolver. That works, but ISP resolvers are frequently slower than public alternatives, log every domain your devices query, and occasionally redirect failed lookups to ad-filled pages rather than returning a clean error. Public resolvers like Cloudflare and Google operate globally redundant infrastructure specifically built for DNS and outperform most ISP resolvers on both speed and reliability.

There are practical troubleshooting reasons to switch too. If a domain you recently updated resolves to the wrong IP on your Mac, pointing at a neutral public resolver tells you immediately whether the problem is your ISP's cache or a genuine propagation delay. Knowing how to change and revert DNS is a useful skill in both directions.

Popular DNS Servers Worth Using

Choose a primary and a secondary before you start. macOS automatically fails over to the secondary if the primary is unreachable, so both entries matter.

• Cloudflare — 1.1.1.1 / 1.0.0.1: Consistently fast in independent global benchmarks. No query logging by IP address. A security-filtered variant (1.1.1.2 / 1.0.0.2) blocks known malware domains; a family-safe variant (1.1.1.3 / 1.0.0.3) adds adult content filtering.
• Google Public DNS — 8.8.8.8 / 8.8.4.4: Globally distributed and highly reliable. Google collects anonymized query data for security research. Full technical documentation is at developers.google.com/speed/public-dns.
• Quad9 — 9.9.9.9 / 149.112.112.112: Operated by a non-profit. Blocks domains flagged by threat intelligence feeds before resolution completes. A solid default for home users who want passive malware blocking without installing additional software.
• OpenDNS — 208.67.222.222 / 208.67.220.220: Owned by Cisco. Free tier includes phishing protection; a paid tier adds per-account configurable content filtering and query dashboards.

Changing DNS in macOS Sonoma via System Settings

macOS Ventura and Sonoma replaced System Preferences with the redesigned System Settings app and reorganized the Network panel substantially. If your muscle memory still reaches for the old Advanced button, the steps below reflect the current Sonoma 14.x UI.

1. Click the Apple menu in the top-left corner and choose System Settings.
2. In the left sidebar, click Network. You will see all available interfaces: Wi-Fi, Ethernet, any VPN adapters, and others.
3. Find your active connection — the one in use shows a green dot to its left. Click Details... to the right of its name.
4. In the Details sheet, click the DNS tab along the top row.
5. The left column shows current DNS servers, usually your router's IP address. Select each entry and click the – (minus) button at the bottom of the column to remove it. Leaving the router's IP as a fallback is possible, but macOS may query it during brief periods of high latency to your primary, which produces inconsistent results when testing propagation.
6. Click the + (plus) button and type your primary server IP — for example 1.1.1.1. Press Return.
7. Click + again and enter the secondary — for example 1.0.0.1. Press Return.
8. Click OK to close the Details sheet.
9. Back in the Network panel, click Apply. This is a separate button from OK and is the step most people miss. Closing the window without clicking Apply silently discards every change you just made.

The new servers are active immediately for new DNS queries. Records already cached by mDNSResponder persist until their TTL expires or you flush the cache manually.

Changing DNS via Terminal on macOS Sonoma

The networksetup command-line tool is faster when you switch resolvers regularly or need to script the change across multiple Macs. It requires administrator privileges and operates on the same per-interface model as the GUI.

First, find the exact service name macOS uses for each interface:

Typical output on a MacBook Pro:

Service names are case-sensitive. Use the name exactly as listed — Wi-Fi with a capital W and a hyphen, not wifi or WIFI. Now set your DNS servers:

Enter your admin password when prompted. No output after the password prompt means success. You can supply additional IPs as space-separated arguments and macOS queries them left to right. Confirm what is now configured:

If this returns There aren't any DNS Servers set on Wi-Fi, no static entries exist and the interface is using DHCP-assigned DNS from the router. That is the default state on a fresh macOS install — DNS still works, it just uses the router's resolver.

To remove your static entries and revert to DHCP-assigned DNS:

Verifying the Change Took Effect

Do not trust System Settings looking correct — confirm the OS is actively using the new resolver before moving on.

The fastest method is scutil:

Find the block labeled resolver #1. Underneath it, nameserver[0] should display the IP you just configured. If you see your router's IP there instead, return to System Settings and confirm Apply was clicked, or re-run the networksetup command.

Test that the resolver actually answers queries from your Mac:

Both commands bypass macOS's cache and send the query directly to the IP specified. A valid address in the answer section confirms the resolver is reachable. If dig returns SERVFAIL or times out entirely, your network is likely blocking outbound port 53 — common on corporate networks, school Wi-Fi, and some hotel connections. DNS-over-HTTPS travels over port 443 and bypasses that block, covered in the section below.

Flushing the DNS Cache on macOS Sonoma

Switching resolvers only changes where future queries go. Records mDNSResponder has already cached persist until their TTL expires — potentially up to 24 hours for domains with high TTL values. Force an immediate flush with two commands:

The first purges the local cache. The second sends a hang-up signal to mDNSResponder, forcing it to reset its internal state. Neither produces output on success. Open a new browser tab immediately after to test resolution.

If you do this often, add a shell alias to ~/.zshrc:

Browsers maintain their own DNS cache separate from the OS. In Chrome, go to chrome://net-internals/#dns and click Clear host cache. In Firefox, a browser restart clears the browser-level cache. Safari has no separate DNS cache control — flushing mDNSResponder is sufficient.

DNS Settings Are Per-Interface, Not Global

This is the most common source of confusion on macOS. DNS settings are tied to each network interface independently. If your MacBook uses USB-C Ethernet at a desk and Wi-Fi elsewhere, you need to configure DNS on both interfaces — otherwise the unconfigured one continues using the DHCP-assigned resolver from the router.

Run networksetup -listallnetworkservices, identify every interface you actively use, and apply the -setdnsservers command to each. If you want a single DNS change to cover every device on your network without touching individual machines, configure your preferred DNS servers in the router's DHCP settings. Every device — Mac, iPhone, Windows PC, Android — inherits them automatically.

Common Mistakes That Make the Change Appear Broken

These account for the vast majority of cases where someone reports that changing DNS on macOS had no effect:

• Wrong interface selected: You edited Wi-Fi DNS while connected via Ethernet. Check which interface shows the green dot in Network settings before making changes.
• Skipped the Apply button: The Details sheet OK button and the Network panel Apply button are two separate actions. OK closes the sheet; Apply persists the configuration. One without the other saves nothing.
• Active VPN overriding DNS: VPN clients push their own DNS servers for the duration of the tunnel, overriding System Settings entirely. Disconnect the VPN and test. If you need custom DNS inside the tunnel, configure it at the VPN client level.
• Router intercepting port 53: Some routers with parental controls or DNS rebinding protection transparently redirect all outbound DNS traffic to themselves, regardless of which server the client specifies. If scutil --dns shows your custom server but queries still return answers sourced from your ISP, check your router's DNS or security settings for options labeled DNS hijack protection, DNS rebinding protection, or parental controls. Switching to DNS-over-HTTPS bypasses this because it runs over port 443.
• Browser DoH overrides system DNS: Chrome and Firefox each implement DNS-over-HTTPS independently of the OS. If DoH is active in the browser with a different provider, the browser ignores the System Settings resolver entirely. Check Chrome Settings → Privacy and Security → Security → Use secure DNS; and Firefox Settings → Privacy and Security → DNS over HTTPS.
• Clearing browser history is not a DNS flush: Browser history deletion removes URL records from the browser's local database. It has no effect on mDNSResponder's DNS cache. Use the two-command flush described above.

DNS on Windows, Linux, and iOS for Reference

When supporting users on other platforms, the equivalent workflows are:

On Windows 11, DNS is set per adapter at Settings → Network and Internet → select your adapter → Edit under DNS server assignment. Command-line: netsh interface ip set dns Wi-Fi static 1.1.1.1. Flush with ipconfig /flushdns. Windows 11 also adds a native DoH toggle per adapter in the same DNS assignment dialog.

On Linux (Ubuntu 22.04 and later), DNS is typically managed by systemd-resolved. Edit /etc/systemd/resolved.conf, set DNS=1.1.1.1 1.0.0.1, then run sudo systemctl restart systemd-resolved. Verify the active configuration with resolvectl status. Older distributions that write /etc/resolv.conf directly can add nameserver 1.1.1.1 lines, but note that DHCP clients may overwrite the file on reconnect.

On iOS and iPadOS, DNS is configured per Wi-Fi network at Settings → Wi-Fi → tap the i next to your network name → Configure DNS → Manual → add your server IPs. There is no terminal equivalent on iOS. For cellular connections, DNS is assigned by the carrier and cannot be changed without a configuration profile or a VPN.

Encrypted DNS on macOS Sonoma in 2026

macOS Sonoma does not include a native GUI toggle for DNS-over-HTTPS or DNS-over-TLS in System Settings. Apple built the NEDNSSettingsManager framework for app developers and MDM deployments, but there is no user-visible switch as of Sonoma 14.x — unlike Windows 11, which added per-adapter DoH to its native network UI.

Practical routes to system-wide encrypted DNS on macOS today:

• Install a DNS configuration profile: Cloudflare, NextDNS, and other providers offer downloadable .mobileconfig files. Open the file in Finder, then approve it at System Settings → General → VPN and Device Management. Once installed, it activates DoH or DoT for the entire system with no VPN tunnel running in the background. The profile is removable from the same Device Management screen at any time.
• Browser-level DoH: Firefox and Chrome support DoH natively per-browser. This protects queries made inside that browser but does not cover system-level DNS calls from Mail, the App Store, Terminal processes, or background daemons.
• Privacy VPN: Encrypts all traffic including DNS at the OS level, but routes everything through a third-party provider — a larger trust commitment than simply changing a resolver IP.

DNSSEC is handled by the resolver, not the client. When you use Cloudflare (1.1.1.1), Google (8.8.8.8), or Quad9 (9.9.9.9) — all of which perform DNSSEC validation — signed zones are validated server-side before the answer reaches your Mac. You benefit from DNSSEC coverage automatically without any additional macOS configuration.