How do I change my DNS server in Windows 11?

Open Settings, navigate to Network & Internet, click your active connection, change the DNS server assignment from Automatic to Manual, enter your preferred addresses, and click Save. Then run ipconfig /flushdns in an elevated Command Prompt to push the change through. Windows 11 also supports DNS over HTTPS natively in 2026 builds, so you can encrypt your queries in the same step with no third-party software required.

What DNS does and why changing it matters

Every time you type a domain name into a browser, your OS sends a DNS query to a resolver — a server that translates the name into an IP address. Your Internet provider assigns that resolver automatically, and in most homes it has never been changed. ISP resolvers are often slower than public alternatives, log query data for extended periods, and in some regions enforce domain-level blocks. Switching to Cloudflare, Google, or Quad9 costs nothing and typically cuts DNS response time from 30–80 ms to under 10 ms on a residential connection. It does not encrypt your web traffic on its own, but combined with DNS over HTTPS it significantly narrows what your ISP can observe about your browsing.

Method 1: Settings app (recommended)

This is the cleanest path and works on all Windows 11 versions from 21H2 through the current 24H2 and 2026 updates.

1. Press Win + I to open Settings.
2. Click Network & Internet in the left sidebar.
3. Click Wi-Fi or Ethernet depending on your connection type.
4. For Wi-Fi: click the name of your connected network or click Hardware properties. For Ethernet: click the adapter name shown.
5. Scroll to DNS server assignment and click Edit.
6. In the dropdown, change Automatic (DHCP) to Manual.
7. Toggle IPv4 on. Enter your preferred DNS in the first field and alternate in the second.
8. Optional but recommended: set DNS over HTTPS to On (automatic template) for Cloudflare, Google, or Quad9 servers. This encrypts queries over port 443.
9. Click Save.
10. Open Command Prompt and run ipconfig /flushdns.

Recommended public DNS servers

• Cloudflare — 1.1.1.1 / 1.0.0.1: fast, privacy-first, supports DoH and DoT natively, no query filtering by default.
• Google Public DNS — 8.8.8.8 / 8.8.4.4: globally distributed, highly reliable, good choice for consistency.
• Quad9 — 9.9.9.9 / 149.112.112.112: automatically blocks domains tied to malware and phishing based on threat-intelligence feeds.
• OpenDNS — 208.67.222.222 / 208.67.220.220: optional category-based content filtering via a free web dashboard.

For most home users, Cloudflare (1.1.1.1) is the safe default. Choose Quad9 if you want passive malware-domain blocking with zero extra configuration.

Method 2: Control Panel (ncpa.cpl)

The legacy Network Connections dialog still works on every Windows 11 build. It is useful when the Settings app is restricted by Group Policy or you need a predictable interface over a remote session.

1. Press Win + R, type ncpa.cpl, press Enter.
2. Right-click your active adapter and select Properties.
3. Double-click Internet Protocol Version 4 (TCP/IPv4).
4. Select Use the following DNS server addresses.
5. Enter your preferred and alternate DNS addresses, then click OK twice.
6. Repeat from step 3 for Internet Protocol Version 6 (TCP/IPv6) if your connection uses IPv6.

Method 3: PowerShell (best for IT pros and scripting)

Open PowerShell as Administrator by right-clicking Start and selecting Terminal (Admin) or Windows PowerShell (Admin). The adapter alias must match exactly what Get-DnsClientServerAddress returns — it is case-sensitive.

To reset an adapter back to DHCP-assigned DNS at any time:

netsh alternative

Classic netsh commands still function on all 2026 Windows 11 builds and are useful in batch scripts or remote cmd sessions where PowerShell execution policy is restrictive.

Enabling DNS over HTTPS in Windows 11

DoH wraps every DNS query inside HTTPS on port 443. Your ISP sees encrypted traffic to an IP address rather than the plaintext domain names you are resolving. DoH also bypasses transparent DNS proxies — hardware or software that silently intercepts outbound UDP port 53 traffic and redirects it to the provider's own resolver regardless of the destination IP you configured. If your DNS setting keeps reverting to your ISP's resolver despite being saved correctly, a transparent proxy is the most likely cause and DoH is the fix.

In the Settings DNS edit dialog, after entering a supported server IP, a DNS over HTTPS dropdown appears with three options:

• Off — plain unencrypted UDP port 53. This is the default on all Windows 11 installations.
• On (automatic template) — Windows has built-in knowledge of the DoH endpoints for major public resolvers and configures the URL automatically. Use this for Cloudflare, Google, and Quad9.
• On (manual template) — for custom or enterprise DoH resolvers where you supply the HTTPS URL yourself.

Servers with automatic template support in Windows 11: Cloudflare (1.1.1.1, 1.0.0.1), Google (8.8.8.8, 8.8.4.4), Quad9 (9.9.9.9, 149.112.112.112). Any IP outside this list requires the manual template option and a DoH URL.

To configure DoH via PowerShell on Windows 11 22H2 or later:

IPv6 DNS — do not skip this

If your router provides IPv6 (run ipconfig /all and look for a global unicast address starting with 2 under your adapter), you must configure IPv6 DNS as well. Windows uses IPv6 for AAAA record lookups when the protocol is available, and an unconfigured IPv6 DNS silently falls back to your ISP's resolver, bypassing everything you just set for IPv4.

• Cloudflare IPv6 — 2606:4700:4700::1111 / 2606:4700:4700::1001
• Google IPv6 — 2001:4860:4860::8888 / 2001:4860:4860::8844
• Quad9 IPv6 — 2620:fe::fe / 2620:fe::9

In the Settings DNS dialog, toggle IPv6 on directly below the IPv4 toggle and enter the corresponding addresses. Via PowerShell, the cmdlet infers address family from the IP format — run it once per family:

Verifying the change worked

A saved setting in the UI is not the same as working DNS. Always verify before declaring success.

The Server: and Address: lines at the top of nslookup output should match your configured resolver IP. If they show your router's LAN IP (typically 192.168.1.1, 192.168.0.1, or 10.0.0.1), the router is intercepting DNS queries before they reach your chosen resolver. Enabling DoH is the reliable bypass in that situation.

Users running WSL2 should also check the Linux resolver independently:

An entry like 172.x.x.1 in resolv.conf is the WSL NAT gateway forwarding to Windows DNS — expected behavior in current builds. If it shows an ISP address directly, WSL2 is overriding DNS independently; consult /etc/wsl.conf to control that behavior.

Use the DNS Lookup tool to run a live query from Google Public DNS and confirm a domain resolves correctly on Google Public DNS — particularly useful after any DNS change.

When the change does not stick

These are the most common reasons a manually configured DNS reverts or fails to apply:

• DHCP option 6 (router pushing DNS) — Some routers force specific DNS servers onto every DHCP client, overriding per-device settings regardless of what you configure in Windows. Log into the router admin page, remove any hardcoded DNS from the DHCP configuration, or set DNS at the router level instead.
• Transparent DNS proxy — ISP-supplied routers on cable and fiber networks often intercept all outbound UDP port 53 traffic to their own resolver regardless of the destination IP. DoH on port 443 is the only reliable bypass.
• VPN client override — VPN software redirects DNS through its own tunnel while connected. This is intentional behavior. Your custom DNS settings resume when the VPN disconnects.
• Group Policy on domain-joined PCs — A GPO can silently enforce DNS assignments. The Settings UI may show your change, but policy reverts it on the next refresh cycle. Run gpresult /r elevated and look for DNS-related policy entries.
• Multiple active adapters — If both Wi-Fi and Ethernet show as connected, Windows draws DNS from both. Configure DNS on both adapters or disable the idle one.
• Post-update reset — Windows 11 feature updates occasionally reset adapter settings. After any major update, run Get-DnsClientServerAddress to confirm your DNS is still in place.

Setting DNS at the router (covers all devices at once)

Changing DNS in the router's DHCP server settings propagates it to every device on the network automatically — phones, tablets, and smart TVs included. Admin page locations vary by manufacturer:

• ASUS — asusrouter.com or 192.168.1.1 → Advanced Settings → WAN → WAN DNS Setting
• TP-Link — tplinkwifi.net → Advanced → Network → Internet (look for DNS Server fields)
• Netgear — routerlogin.net → Basic → Internet → Domain Name Server (DNS) Address
• Linksys — linksyssmartwifi.com → Connectivity → Internet Settings
• Netgear Orbi — orbilogin.com → Advanced → Setup → Internet Setup
• Xiaomi MiWiFi — miwifi.com → More Settings → Internet Settings

On OpenWrt: Network → DHCP and DNS → General Settings → DNS forwardings. On DD-WRT: Setup → Basic Setup → Static DNS 1 / Static DNS 2. Labels vary by firmware version — look for DNS fields in the WAN or DHCP section.

After changing router DNS, renew your IP lease on the Windows 11 machine to receive the updated assignment:

Common misdiagnoses

• Changed DNS but browsing is still slow. DNS latency affects only the very first connection to each domain per session. Ongoing page load time is driven by bandwidth, server response time, and page weight. Use browser DevTools (F12 → Network tab) to find the actual bottleneck.
• nslookup still shows the old server. You likely edited the wrong adapter. Run ipconfig /all and check the DNS Servers line under the adapter that has a Default Gateway assigned — that is your active connection.
• Changed DNS but ISP can still monitor browsing. DNS change only affects name resolution. Actual web traffic still transits your ISP. HTTPS encrypts the content; a VPN encrypts the connection path. DNS change combined with DoH removes a significant visibility window but is not a complete privacy solution on its own.
• ping 1.1.1.1 fails. Cloudflare's 1.1.1.1 is among the most reliably reachable IPs in the world. If it times out, the problem is local network connectivity or a router firewall rule blocking outbound traffic — not DNS configuration.

For the foundational specification covering DNS message structure and resolver behavior across all platforms, RFC 1035 is the authoritative reference that every DNS implementation traces back to.