If you're on a Canadian home or office network and want free, privacy-respecting DNS filtering that blocks malware and phishing before a connection is ever made, CIRA Canadian Shield is the most underused tool available to you. It's operated by the Canadian Internet Registration Authority — the same organization that runs the .ca registry — resolves queries entirely in Canadian data centres, and costs nothing. This guide covers every platform, every major router brand, and the 2026-era encrypted DNS options so you can get fully configured in one pass.
What CIRA Canadian Shield Does and Does Not Do
Canadian Shield is a recursive DNS resolver with threat intelligence layered on top. When any device on your network makes a DNS query, Canadian Shield checks the requested domain against a continuously updated feed of malware, phishing, and (depending on your tier) adult content domains. If the domain is flagged, it returns a block page IP instead of the real address. Your actual traffic never passes through CIRA servers — only the DNS lookup does. This is DNS-layer filtering, not a VPN or proxy. A VPN on a device bypasses it entirely because the VPN handles DNS internally.
All three tiers support DNSSEC validation, DNS over HTTPS (DoH), and DNS over TLS (DoT). CIRA is a non-profit and publishes a privacy policy committing to no sale of query data and minimal retention. For Canadian households and businesses concerned about US-jurisdiction resolvers like Google 8.8.8.8 or Cloudflare 1.1.1.1, this keeps DNS resolution under Canadian law. The service has no rate limits and no registration required for the standard tiers.
Choose Your Protection Tier Before You Start
Pick one tier and apply it consistently. Mixing tiers across devices on the same network creates inconsistent filtering and makes troubleshooting much harder. The last octet of each IP is the key: .10 = Protected, .20 = Private, .30 = Family.
Protected — Best Default for Most Households
Blocks malware and phishing domains. No adult content filtering. Appropriate for households with adults who want threat protection without over-blocking.
- Primary IPv4: 149.112.121.10
- Secondary IPv4: 149.112.122.10
- Primary IPv6: 2620:10A:80BB::10
- Secondary IPv6: 2620:10A:80BC::10
- DoH URL: https://protected.canadianshield.cira.ca/dns-query
- DoT hostname: protected.canadianshield.cira.ca
Private — Threat Protection with Minimal Logging
Same malware and phishing blocking as Protected, but CIRA commits to not logging your IP address in association with queries. Choose this if privacy from the resolver itself is the priority.
- Primary IPv4: 149.112.121.20
- Secondary IPv4: 149.112.122.20
- Primary IPv6: 2620:10A:80BB::20
- Secondary IPv6: 2620:10A:80BC::20
- DoH URL: https://private.canadianshield.cira.ca/dns-query
- DoT hostname: private.canadianshield.cira.ca
Family — Adds Adult Content Filtering
Includes everything in Protected plus blocks adult and explicit content domains. Intended for networks with children. Important caveat: the filter relies on domain categorization. Any VPN app or browser with its own DoH settings on a child's device will bypass it.
- Primary IPv4: 149.112.121.30
- Secondary IPv4: 149.112.122.30
- Primary IPv6: 2620:10A:80BB::30
- Secondary IPv6: 2620:10A:80BC::30
- DoH URL: https://family.canadianshield.cira.ca/dns-query
- DoT hostname: family.canadianshield.cira.ca
Router-Level Setup (Recommended First Step)
Setting Canadian Shield at the router applies it to every device on your network including smart TVs, game consoles, printers, and IoT devices that have no DNS settings of their own. This is the highest-leverage change you can make. The one limitation: devices that hard-code a public DNS server (some Chromecast hardware, certain Samsung TVs) will bypass router-level DNS unless you add a firewall rule redirecting port 53 traffic.
Asus Routers (AsusWRT and Merlin)
Log in at asusrouter.com or 192.168.1.1. Go to Advanced Settings → WAN → Internet Connection tab → DNS Setting. Set Connect to DNS Server automatically to No. Enter your primary and secondary IPs. Click Apply. On AsusWRT-Merlin firmware, the same WAN page also exposes a DNS Privacy Protocol dropdown — select DNS-over-TLS and enter the Canadian Shield DoT hostname to encrypt queries leaving the router.
TP-Link (Archer and AX series)
Log in at tplinkwifi.net. Go to Advanced → Network → Internet. Under DNS, uncheck Get DNS server automatically and enter Primary and Secondary DNS. On newer Deco mesh units: open the Deco app → More → Advanced → DNS. Some older Archer models put DNS under Advanced → DHCP → DNS Address instead — check both locations if the Internet page doesn't show DNS fields.
Netgear (Orbi and Nighthawk)
For Orbi, log in at orbilogin.com → Advanced → Advanced Setup → WAN Setup → DNS Address. For Nighthawk, log in at routerlogin.net → Advanced → Setup → Internet Setup → Domain Name Server (DNS) Address. Set to Use These DNS Servers and enter the IPs.
Linksys (Velop and MR series)
Log in at linksyssmartwifi.com → Router Settings → Connectivity → Internet Settings → IPv4 → set Static DNS. On Velop mesh: open the Linksys app → Wi-Fi Settings → Advanced → DNS.
D-Link
Log in at 192.168.0.1 (or 192.168.1.1 on some models) → Setup → Internet → Manual DNS. Enter primary and secondary IPs and save.
Xiaomi (Mi Router and AX series)
Log in at miwifi.com. Go to Advanced → DHCP → DNS Settings. Enter the primary and secondary Canadian Shield IPs.
OpenWrt and DD-WRT
On OpenWrt: Network → DHCP and DNS → General Settings → DNS forwardings. Add 149.112.121.10 and 149.112.122.10. To use DoT on OpenWrt, install the stubby package and configure it with the Canadian Shield DoT hostname and port 853. For DD-WRT: Setup → Basic Setup → Static DNS 1 and Static DNS 2 fields.
Windows Setup
Windows 11 supports DoH natively in the network settings UI. Windows 10 supports plain DNS only at the OS level unless you install a third-party stub resolver.
Windows 11 — GUI Method
Settings → Network & Internet → Wi-Fi or Ethernet → click your connected network → DNS server assignment → Edit → Manual. Toggle IPv4 on. Set Preferred DNS to 149.112.121.10, Alternate to 149.112.122.10. For the DNS over HTTPS dropdown on each entry, select On (automatic template) — Windows 11 recognizes the Canadian Shield IPs and will use the DoH endpoint automatically. Set IPv6 entries to 2620:10A:80BB::10 and 2620:10A:80BC::10 as well if your connection is dual-stack.
Windows 10 and 11 — Command Line
Replace Wi-Fi with your actual adapter name, visible in netsh interface show interface. For Ethernet adapters, the name is typically Ethernet or Local Area Connection.
macOS Setup
System Settings (Ventura, Sonoma, Sequoia) → Network → click your active interface (Wi-Fi or Ethernet) → Details → DNS tab. Click the + button and add 149.112.121.10, then add 149.112.122.10. Remove any ISP-assigned entries that appear in black text (grey entries are DHCP-pushed and do not need to be deleted — your manually added entries take precedence). Click OK, then Apply.
For IPv6: same DNS tab, add 2620:10A:80BB::10 and 2620:10A:80BC::10. macOS does not have a native DoH GUI option. To use Canadian Shield over DoH on macOS, download and install the CIRA-provided configuration profile from the Canadian Shield website — it installs in one click under Settings → General → VPN & Device Management.
Linux Setup
Use the method that matches your network manager. Editing /etc/resolv.conf directly on a system running systemd-resolved or NetworkManager will be overwritten at next connection. Identify which is running: systemctl is-active systemd-resolved and systemctl is-active NetworkManager.
systemd-resolved (Ubuntu 18.04+, Fedora, Debian 10+)
NetworkManager
iOS and Android Setup
iOS and iPadOS
The fastest path is the CIRA-provided .mobileconfig profile, which sets DoH system-wide including for all apps. Download it from the CIRA Canadian Shield website, approve the install under Settings → General → VPN & Device Management. Without the profile: Settings → Wi-Fi → tap your network (i) → Configure DNS → Manual → Add Server. This applies only to that specific network and does not cover cellular data.
Android 9 and Later
Android supports DNS over TLS natively via the Private DNS setting, which covers all apps across both Wi-Fi and cellular. Settings → Network & Internet → Private DNS → Private DNS provider hostname. Enter the tier-appropriate hostname: protected.canadianshield.cira.ca, private.canadianshield.cira.ca, or family.canadianshield.cira.ca. Android tests the DoT connection and shows a checkmark when successful. If it shows Couldn't connect, your carrier may be blocking port 853 — fall back to per-network plain DNS under the advanced Wi-Fi settings.
Encrypted DNS in 2026: DoH and DoT Guidance
Plain DNS on port 53 is unencrypted — your ISP and anyone on the same local network can read every hostname you look up. DoH (RFC 8484, port 443) and DoT (RFC 7858, port 853) both encrypt the query. As of 2026, the practical recommendation by platform:
- Routers with Merlin or OpenWrt firmware: configure DoT via stubby or unbound — simpler than DoH at the router level, and port 853 is rarely blocked on residential connections.
- Windows 11: use native DoH via the DNS settings UI described above.
- Browsers (Firefox, Chrome): both have their own DoH settings that override OS DNS entirely. Set Firefox under Settings → General → Network Settings → Enable DNS over HTTPS → Custom. Set Chrome under Settings → Privacy and security → Security → Use secure DNS → With Custom. Use the appropriate Canadian Shield DoH URL.
- Android: use the Private DNS DoT setting — covers all apps, not just the browser.
- iOS: install the CIRA .mobileconfig profile for system-wide DoH.
One critical 2026 note on IPv6: many ISPs now deploy CGNAT on IPv4 while providing native IPv6 to end devices via DHCPv6 or SLAAC. A device that receives an IPv6 address will use IPv6 DNS unless you've explicitly set IPv6 DNS entries. If you configure only IPv4 Canadian Shield addresses, devices on a dual-stack connection may send all IPv6 DNS queries to your ISP's resolver instead. Always configure both IPv4 and IPv6 addresses as shown in the tier lists above. For the authoritative DNS protocol specification, see RFC 1035, the foundational document that still underlies everything DNS does today.
Verifying the Setup Worked
Don't assume the change took effect — verify it immediately.
Visit the CIRA Canadian Shield website and click Check Your Protection. The page performs a live test that detects whether your DNS queries are being resolved through Canadian Shield servers, which tier is active, and whether DNSSEC validation is working. If the test shows your ISP's resolver instead of CIRA, one of the common problems below is the likely cause.
Common Problems and Misdiagnoses
Browser DoH Overriding OS DNS
This is the most common reason Canadian Shield appears to be working from the OS but blocking isn't happening in the browser. Chrome and Firefox both have independent DoH settings that bypass whatever DNS the OS or router is configured to use. If you've set Canadian Shield at the router or OS level, also configure it in each browser's DNS-over-HTTPS settings, or disable the browser's DoH entirely so it falls through to the OS.
DHCP Overwriting Manual DNS Settings
On Windows, if Obtain DNS server address automatically is still selected, a DHCP lease renewal pushes the ISP's DNS back. Verify the adapter is set to Use the following DNS server addresses. On macOS, grey DNS entries in the DNS tab are DHCP-pushed — they appear below your manually entered black entries and are normal. Your entries take priority as long as they appear in the list.
IPv6 Bypass
Covered above in the 2026 note, but worth repeating: if you configured only IPv4 DNS and your device has a working IPv6 address, it will use IPv6 DNS from your ISP for all IPv6-capable domains. The fix is adding the Canadian Shield IPv6 addresses to every configuration you've already done.
Mismatched Tier IPs
The Protected, Private, and Family tiers use the same middle octets (149.112.121.x and 149.112.122.x) but different last octets (.10, .20, .30). Entering 149.112.121.20 as primary and 149.112.122.10 as secondary mixes the Private and Protected tiers — the first resolver to answer any given query determines which filtering rules apply, producing inconsistent results. Make sure both the primary and secondary share the same last octet.
ISP Blocking or Hijacking Port 53
Some ISPs intercept all outbound UDP/TCP port 53 traffic and redirect it to their own resolver regardless of what DNS server address you configure. If you're certain your settings are correct but tests keep showing the ISP resolver, switch to DoH or DoT, which use standard HTTPS ports that ISPs cannot transparently redirect.
Smart TV or IoT Device Ignoring Router DNS
Some Samsung TVs, Chromecast devices, and certain smart home hubs hard-code public DNS servers (usually 8.8.8.8 or 1.1.1.1) and ignore the DHCP-provided DNS. The only reliable fix is a firewall rule on the router that redirects all outbound port 53 traffic to the router itself or directly to the Canadian Shield IPs. On OpenWrt: add an iptables REDIRECT rule in the firewall config. On Merlin firmware: Custom Configuration in the firewall section supports iptables rules.
Preventing Recurrence
- Set DNS at the router level first — device-level DHCP renewals cannot override router-pushed DNS when the router is the resolver for the LAN.
- On Merlin or OpenWrt routers, enable DoT — this ensures DNS queries are encrypted even on the local network path between the device and the router.
- On Android, use the Private DNS setting — it persists across all Wi-Fi networks and cellular, so a new Wi-Fi network doesn't revert to plain DNS.
- After any router firmware update, verify DNS settings — some firmware updates reset WAN DNS to automatic.
- Check the CIRA Canadian Shield website periodically for IP or endpoint changes. CIRA has maintained stable IPs since launch, but server infrastructure changes do happen.
- If children's devices are the concern, note that Canadian Shield Family filtering is bypassed by any VPN or browser DoH setting pointing to another resolver. Pair it with a content-filtering approach at the OS or MDM level for tighter enforcement.