How do you change the DNS server on your eero?

To change DNS on an eero, open the eero app, tap the menu icon, navigate to Network Settings, tap DNS, switch from Automatic to Custom, and enter your preferred resolver IPs. The change applies across every device on your mesh within seconds — no reboot needed. One caveat worth knowing upfront: if your account has eero Secure active, that service controls DNS at its own layer and may override or lock the Custom DNS fields entirely.

Why change the DNS server on your eero

By default, the eero forwards DNS queries to whatever resolver your ISP provides via DHCP. ISP resolvers tend to be slower, geographically limited, and often log query data for their own purposes. Switching to a public resolver like Cloudflare (1.1.1.1), Google (8.8.8.8), or Quad9 (9.9.9.9) typically cuts DNS latency, improves privacy, and adds optional DNS-level threat filtering — all without touching any individual device.

Common reasons people look for this fix:

• ISP resolver outage causing simultaneous DNS failures across every device on the network
• Slow page loads traced to high DNS latency — use the DNS Lookup tool to benchmark your current resolver response time before switching
• Wanting DNS-level malware or adult-content blocking for every household device without a per-device app
• Pointing the network at a local Pi-hole or Unbound instance for ad blocking and DNSSEC validation
• Bypassing ISP DNS hijacking that returns ad pages instead of a proper NXDOMAIN response

What you need before you start

Unlike most consumer routers, eero has no browser-based admin panel. All network configuration happens exclusively through the eero mobile app on iOS or Android. You need:

• The eero app installed on iOS or Android
• Owner-level access to the eero network — member or guest accounts cannot change DNS
• The IP addresses of your chosen resolvers (see the list below)

Step-by-step: change DNS in the eero app

These steps reflect current versions of the eero app. Menu labels are consistent across iOS and Android builds, though exact visual placement may shift slightly between app updates. If a label does not match exactly, look for the same concept in a nearby setting.

1. Open the eero app and log in if prompted.
2. Tap the menu icon (three horizontal lines) in the top-left corner of the home screen.
3. Tap Network Settings.
4. Scroll down and tap DNS.
5. The current value reads either Automatic (ISP) or a previously set custom address. Tap Custom DNS or the equivalent toggle.
6. Enter your primary DNS server IP in the first field and a secondary (fallback) IP in the second field. Never leave the secondary blank — if the primary is unreachable, all DNS resolution across the mesh fails silently.
7. Tap Save. The app confirms and distributes the updated resolver to every eero node immediately.

If the DNS setting is greyed out or missing entirely, skip ahead to the eero Secure section before continuing.

Which DNS servers to enter

All of the following are stable, freely available, and have maintained strong uptime records through 2026. Choose based on your priority:

• Cloudflare 1.1.1.1 — Primary: 1.1.1.1 / Secondary: 1.0.0.1. Consistently fastest global average latency. Query logs purged within 25 hours. Good general-purpose choice.
• Cloudflare 1.1.1.1 for Families — Primary: 1.1.1.3 / Secondary: 1.0.0.3. Blocks malware and adult content at the DNS level for every device on the network without any client software.
• Google Public DNS — Primary: 8.8.8.8 / Secondary: 8.8.4.4. High cache-hit rate, very reliable uptime. Full technical detail is available in the Google Public DNS documentation.
• Quad9 — Primary: 9.9.9.9 / Secondary: 149.112.112.112. Blocks known malicious domains using threat intelligence from multiple security partners. Non-profit operated, no advertising business model.
• Local Pi-hole or Unbound — Enter the static LAN IP of your local resolver, for example 192.168.4.2. Best for ad blocking or full recursive DNSSEC validation. Requires the resolver machine to hold a fixed IP — see the prevention section at the end.

The eero Secure conflict

eero Secure is Amazon's paid subscription layer for eero networks. It routes DNS queries through eero's own threat-intelligence and content-filtering infrastructure. When active, the DNS settings screen may be locked, or addresses you enter may be silently ignored for queries that Secure intercepts.

To check whether eero Secure is running: tap the menu icon in the eero app, then tap eero Secure or Discover. Active shields or enabled filtering toggles confirm it is on.

Your options:

• Keep eero Secure. The filtering it provides largely overlaps with what Cloudflare for Families or Quad9 would give you. If content or malware blocking was the goal, Secure may already be doing it.
• Cancel eero Secure. The DNS fields become fully editable immediately after cancellation through your Amazon account settings. No eero reset required.
• Per-device override. Configure DNS statically on specific devices — like a work laptop or a server — to bypass the Secure-controlled DHCP resolver. Instructions follow in the next section.

Per-device DNS override

The eero delivers DNS to clients via DHCP option 6. Any device can override this by hardcoding DNS directly on its network adapter. This requires no change to the eero itself.

Windows 11

1. Settings → Network and Internet → Wi-Fi → click your network name → Hardware properties.
2. Next to DNS server assignment, click Edit.
3. Switch to Manual, enable IPv4, and enter Preferred and Alternate DNS IPs.
4. Optionally enable DNS over HTTPS if your resolver supports it — both Cloudflare and Google do.

macOS (Sequoia / Ventura)

1. System Settings → Network → select your Wi-Fi interface → Details.
2. Click the DNS tab.
3. Click + and add your DNS server IPs. These override DHCP-delivered addresses for this Mac only.

Linux (systemd-resolved)

iOS

Settings → Wi-Fi → tap the info icon next to your network → Configure DNS → Manual. Add resolver IPs and remove any automatically populated entries. For an encrypted option, install a DoH or DoT profile through a provider app such as Cloudflare's 1.1.1.1 app, which applies system-wide across all interfaces.

Android 9 and later

Android's Private DNS feature sets a DNS-over-TLS resolver for the device system-wide, overriding whatever the eero delivers via DHCP. Find it at Settings → Network and internet → Private DNS. Enter a hostname rather than an IP address: one.one.one.one for Cloudflare, or dns.google for Google DNS.

Verify the DNS change actually worked

The eero app save confirmation only means the setting was written — it does not confirm clients received it. Verify independently from a connected device.

dig (macOS, Linux, WSL)

The SERVER line in dig output must match the primary or secondary IP you entered. If it still shows an ISP address, the client has not picked up the change yet — see Troubleshooting below.

nslookup (Windows, macOS, Linux)

resolvectl (Linux with systemd-resolved)

Browser test

Navigate to 1.1.1.1/help in a browser on your network. Cloudflare's diagnostic page confirms whether your device's DNS queries are being handled by their resolver. Google offers a similar confirmation page at dns.google.

Troubleshooting: DNS change not taking effect

If the old resolver is still in use after saving in the eero app, work through these steps in order:

1. Flush the DNS cache on the client. The eero updated its DHCP offer, but the device is still serving cached mappings. Windows: run ipconfig /flushdns in an elevated command prompt. macOS: run sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder. Linux: run sudo resolvectl flush-caches.
2. Force a DHCP lease renewal. Toggle Wi-Fi off and back on, or on Windows run ipconfig /release followed by ipconfig /renew. The new DHCP offer carries the updated DNS option.
3. Check for a static DNS override on the device. A previously hardcoded DNS entry on the machine will win over whatever eero delivers via DHCP. Check network adapter settings on every device that still shows the old resolver and remove any static entries.
4. Confirm eero Secure is not active. See the Secure section above — an active subscription can silently override custom entries.
5. Check for pending firmware updates. In the eero app go to menu → Software Updates. Outdated firmware on a mesh node can cause inconsistent DNS distribution across the network.
6. Reset DNS to Automatic, save, then re-apply Custom. Occasionally the first save completes silently without actually writing the change. Reverting and re-entering resolves this in most cases.

IPv6 DNS on eero in 2026

As IPv6 deployment expands — driven partly by carrier-grade NAT limitations pushing ISPs toward native dual-stack configurations — devices on your eero will also issue AAAA record lookups to an IPv6 DNS server advertised via DHCPv6 or router advertisements. Setting IPv4-only custom DNS in the eero app does not automatically cover these IPv6 queries.

In the eero app DNS settings screen, look for an IPv6 DNS field alongside the IPv4 entries (availability may vary by app version and firmware). If present, enter the IPv6 addresses for your resolver:

• Cloudflare: 2606:4700:4700::1111 and 2606:4700:4700::1001
• Google: 2001:4860:4860::8888 and 2001:4860:4860::8844
• Quad9: 2620:fe::fe and 2620:fe::9

Without matching IPv6 DNS entries, devices that prefer AAAA records — most modern phones, Windows 11 machines, and Linux desktops — can end up querying your ISP's IPv6 resolver for those lookups while your custom resolver handles A record queries. The result is inconsistent filtering, split resolver behavior, and unpredictable latency.

DNS over HTTPS and DNS over TLS on eero

As of 2026, the eero firmware does not expose native DoH or DoT configuration at the router level. The eero forwards DNS queries to the upstream resolver you specify over standard UDP and TCP on port 53. Traffic between the eero and that resolver travels over the public internet without transport-layer encryption on the eero side.

What this means in practice:

• Queries between your devices and the eero stay on your private LAN — low practical interception risk at that hop.
• Queries from the eero outbound to Cloudflare, Google, or Quad9 are unencrypted from the router's perspective. For most home and small-office networks this is an acceptable tradeoff.
• For per-device encrypted DNS, use Android Private DNS (DoT hostname mode) or install a DoH configuration profile on iOS. Both operate independently of whatever the eero is configured to use.
• For whole-network encrypted DNS, run a local DoH or DoT forwarding proxy — dnscrypt-proxy on a Raspberry Pi is a common approach — and point eero's Custom DNS at that machine's static LAN IP.

Common misdiagnoses

• DNS changed but ad-heavy sites still load ads. General-purpose resolvers like 8.8.8.8 and 1.1.1.1 resolve all domains — they do not block ads. Ad blocking via DNS requires a resolver specifically configured for it: Pi-hole, NextDNS, AdGuard DNS, or Cloudflare 1.1.1.1 for Families.
• A Smart TV or streaming device ignores the eero DNS setting. Some TV firmware (certain Samsung and LG models) and older Chromecast hardware hardcode specific DNS IPs to bypass parental controls set at the router level. The eero cannot intercept these at the DNS application layer. Blocking those IPs at a firewall level would be needed, and eero's consumer firmware does not support custom firewall rules.
• eero app shows Custom DNS saved but nslookup still shows the old resolver. The DHCP lease on the device has not expired yet and no renewal was forced. Toggle Wi-Fi off and on rather than waiting for the lease to expire naturally.
• Custom DNS set in eero and also set statically on the device — they conflict. Device-level static DNS always wins over DHCP-delivered DNS. If you want the eero setting to govern a device, remove any static DNS entries from that device first.

Preventing DNS drift after factory resets

• A full eero factory reset — triggered by holding the reset button or by certain power-cycle events depending on firmware version — wipes all settings including custom DNS. The network reverts to Automatic (ISP). Keep your chosen resolver IPs documented somewhere offline so you can restore the setting quickly.
• If you point eero at a local resolver such as Pi-hole, assign that machine a DHCP reservation in the eero app (Network Settings → DHCP and NAT → IP Reservation, or similar — menu labels vary by app version). If the Pi-hole's LAN IP shifts because its DHCP lease expired, every device on the network loses DNS resolution simultaneously.
• Configure both IPv4 and IPv6 DNS entries at initial setup rather than adding them reactively when IPv6-related issues surface later.