When you open the eero app and spot the DNS settings field, you are staring at one of mesh networking's most misunderstood tradeoffs. eero Secure is a paid subscription promising malware blocking, content filtering, and ad blocking for every device on your network. Custom DNS is free and promises faster lookups, privacy-respecting resolvers, or third-party filtering you control yourself. The problem: they cannot fully coexist, and most guides either bury this fact or get the details wrong. Here is exactly what happens at the DNS layer when you pick one over the other, what breaks, and how to recover as much functionality as possible on either path.

What eero Secure Actually Does at the DNS Layer

eero Secure — bundled with the eero Plus or eero Secure+ subscription ($2.99–$9.99/month as of 2026) — delivers all its filtering through eero's managed DNS resolvers. When the default DNS is active, every lookup from every device on your eero network routes through eero's upstream servers. Those servers check each query against continuously updated threat intelligence: malware domains, phishing infrastructure, typosquatting domains, and (if enabled) content category blocklists for parental controls or ad-domain blocklists.

The block happens at resolution time. A blocked domain returns either NXDOMAIN or a sinkhole IP. The device's browser or app gets no valid address and the connection never starts. eero Secure is not a deep-packet inspection system, not a transparent HTTP proxy, and not a stateful firewall rule. It is a DNS resolver with a continuously maintained blocklist. This architecture is efficient and adds minimal latency, but it has one non-negotiable requirement: all DNS queries must pass through eero's resolvers. Change the resolver, and eero Secure goes blind.

How Custom DNS Works Inside eero

Custom DNS on eero replaces the upstream resolver the eero gateway uses when forwarding queries from your local devices. Here is the exact path in the eero app as of 2026 firmware:

eero app → Settings (bottom tab) → Advanced Settings → DNS Toggle Automatic off → enter Primary and Secondary DNS IPs → Save

On older eero firmware the path was Network Settings → DNS. The result is identical: eero will forward all client DNS queries to whatever resolver IP you enter, bypassing eero's own infrastructure entirely.

Common choices for custom DNS include:

  • 1.1.1.1 / 1.0.0.1 — Cloudflare, lowest latency of any public resolver, strong privacy posture
  • 8.8.8.8 / 8.8.4.4 — Google Public DNS, highly reliable, comprehensive anycast coverage worldwide
  • 9.9.9.9 / 149.112.112.112 — Quad9, malware-blocking at the resolver level, non-profit operated
  • 192.168.x.x — a local resolver like Pi-hole or AdGuard Home running on your LAN

One hard limitation: eero's custom DNS field accepts plain IPv4 addresses only. There is no native eero interface for DNS-over-HTTPS or DNS-over-TLS from the app. You are configuring cleartext UDP/TCP port-53 forwarding. The implications of this are covered in the 2026 section below.

The Core Conflict Explained

Setting any custom DNS server immediately and completely disables eero Secure's filtering layer. This is not a bug or firmware regression — it is the expected consequence of the architecture. eero's filtering lives entirely inside eero's resolvers. If queries go to 1.1.1.1 instead, they never touch eero's blocklists. The eero app may still show eero Secure as active in your subscription status, but zero filtering is occurring on any blocked category or domain you have configured.

The eero app will display a warning when you enter custom DNS: Using a custom DNS server will disable eero Secure content filtering features. Many users click past this without grasping the full scope of what stops working.

💡 Not sure which DNS your eero is actually using right now? Use our DNS Propagation Checker to see what resolvers are answering for your domains — useful for confirming whether eero Secure or your custom resolver is actually active on your network.

What Specifically Breaks When Custom DNS Is Active

Here is the complete list of eero Secure features that stop working the moment a custom DNS server is saved:

  • Threat protection — malware, phishing, and botnet command-and-control domain blocking all go offline
  • Content filtering — every category filter (adult content, violence, gambling, social media, etc.) stops enforcing
  • Ad blocking — the eero Secure ad blocker is entirely DNS-based; it goes completely dark
  • Parental control profiles — any device assigned a content-category profile loses DNS enforcement; the profile still exists in the app but has no effect
  • SafeSearch enforcement — eero Secure forces SafeSearch on Google, YouTube, and Bing by intercepting and redirecting DNS for those domains; this stops entirely
  • Activity feed and Insights — the per-device DNS query logs that eero Secure populates become empty or show only partial data

What does not break when you switch to custom DNS:

  • Device pause (this is a firewall/ARP feature, not DNS)
  • Scheduled access windows (also implemented at the routing layer)
  • Basic eero mesh connectivity and Wi-Fi performance
  • Bandwidth controls and traffic prioritization

Step-by-Step: Setting Custom DNS on eero

  1. Open the eero app on iOS or Android.
  2. Tap Settings (bottom-right icon).
  3. Scroll to and tap Advanced Settings.
  4. Tap DNS.
  5. Tap the toggle next to Automatic to disable it.
  6. Enter your primary DNS IP — for example, 9.9.9.9.
  7. Enter your secondary DNS IP — for example, 149.112.112.112.
  8. Tap Save. eero applies the change across all mesh nodes within seconds; no reboot is required.

There is no web-based admin interface for eero in 2026. All configuration, including DNS, must go through the mobile app. If you are used to router admin panels at 192.168.1.1, asusrouter.com, orbilogin.com, or tplinkwifi.net, this is an intentional eero design choice that frustrates power users. There is no equivalent local web UI, and no third-party firmware (OpenWrt, DD-WRT) with official eero hardware support that would expose more DNS controls.

Reverting to eero Secure DNS

  1. eero app → Settings → Advanced Settings → DNS
  2. Toggle Automatic back on.
  3. Tap Save.

Filtering resumes within seconds. Verify immediately by attempting to load a domain in whichever category you have blocked — it should return the eero block page. If it does not, flush the device DNS cache and retry.

Workarounds That Recover Some of Both Worlds

Several approaches let you retain meaningful security filtering while still using a custom resolver, or replicate eero Secure's protections without the subscription.

Option 1: Use Quad9 as Your Custom DNS

Quad9 (9.9.9.9) performs malware and phishing domain blocking at the resolver level — directly comparable to eero Secure's threat-protection component. It does not do content-category filtering or parental controls, but if your primary goal was threat protection rather than supervised browsing for children, Quad9 effectively replaces the most critical security layer. You lose activity logs, SafeSearch enforcement, and content categories. Malware and phishing domains still get blocked.

Option 2: Pi-hole or AdGuard Home as a Local Resolver

Run Pi-hole or AdGuard Home on a Raspberry Pi or other always-on device and set that device's LAN IP as eero's custom DNS. Benefits:

  • Network-wide ad and tracker blocking with blocklists far larger than eero Secure's
  • Per-client query logs and a dashboard with historical data
  • Custom blocklists and allowlists with full granular control
  • Upstream resolver flexibility — point Pi-hole itself to 1.1.1.1, 9.9.9.9, or an encrypted DoH/DoT upstream

The tradeoff: requires a device running 24/7, some Linux familiarity, and ongoing maintenance. No polished per-child-profile UI. For a technical household this is the recommended long-term path — more capability than eero Secure, no recurring cost, and you retain control over the upstream resolver chain.

## Verify Pi-hole is answering after setting it as eero custom DNS # From any device on the eero network: nslookup doubleclick.net 192.168.4.5 # Should return 0.0.0.0 (Pi-hole sinkhole) if blocking is active ## Confirm Pi-hole IP is what client received as DNS server: nslookup -debug google.com | grep -i "^Server"

Option 3: Cloudflare Family Resolvers

Cloudflare offers two free family-safe resolver pairs requiring no account, subscription, or local hardware:

  • 1.1.1.3 / 1.0.0.3 — blocks malware and adult content
  • 1.1.1.2 / 1.0.0.2 — blocks malware only, no content filtering

For simple household filtering needs this is the lowest-friction option. You still lose eero's parental control profiles, per-device activity logs, and SafeSearch enforcement — but the most dangerous threat categories are covered with a one-time DNS change.

CLI Verification: Confirm Which DNS Your eero Is Actually Using

After any DNS change on eero, verify from a client device before assuming the change took effect:

## macOS / Linux — check which resolver answered dig +short TXT whoami.ds.akahelp.net ## Flush DNS cache first on macOS sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder ## Windows — flush cache then check resolver ipconfig /flushdns nslookup google.com # Inspect the "Server:" line — it should show your custom resolver IP ## Linux — check configured system resolvers resolvectl status ## Test Quad9 malware blocking directly dig @9.9.9.9 eicar.org +short # Returns 0.0.0.0 if Quad9 is actively blocking this known malware test domain

The DNS Lookup tool on this site lets you confirm A and AAAA records are resolving correctly from external vantage points — useful for verifying that your custom resolver is not returning stale or incorrect results for legitimate domains after the change.

Device-Level DNS Overrides That Bypass eero Entirely

Even with eero custom DNS correctly configured, individual devices can route DNS outside the router completely:

  • Android 9+ Private DNS (DoT): Settings → Network & Internet → Advanced → Private DNS. A configured hostname like dns.google or cloudflare-dns.com causes the device to make encrypted DNS-over-TLS queries on port 853, bypassing eero's relay entirely. eero Secure has zero visibility into these queries regardless of your router setting.
  • iOS and macOS DNS configuration profiles: MDM profiles or manually installed DoH profiles (Settings → General → VPN & Device Management) route all device DNS completely outside eero.
  • Apps with hardcoded DNS: Some streaming apps and VPN clients embed 8.8.8.8 or 1.1.1.1 directly in their code and issue port-53 queries to those IPs directly, bypassing eero's DNS relay regardless of router configuration.
  • Active VPN clients: Any VPN pushes its own DNS server to the device's OS resolver configuration, overriding eero DNS for the duration of the VPN session.

If eero Secure's activity log is showing far fewer queries than expected, or filtering seems inconsistent across devices, device-level DoT or an active VPN is the most common cause.

The IPv6 DNS Leak Problem on eero

This is the most underreported issue with custom DNS on eero: the router may still advertise IPv6 DNS server addresses to your devices via DHCPv6 or SLAAC Router Advertisements even after you configure custom IPv4 DNS. If your ISP provides IPv6 and eero passes through the ISP's IPv6 resolver addresses, devices will use those in parallel with — or in preference to — your custom IPv4 resolvers. Modern operating system stacks (Windows 11, macOS Sequoia and later, recent Android) prefer IPv6 for DNS queries, meaning your carefully set custom DNS effectively gets bypassed for most lookups.

Check for this from a device on your eero network:

## macOS scutil --dns | grep nameserver ## Linux resolvectl dns ## Windows PowerShell Get-DnsClientServerAddress

If you see IPv6 addresses you did not configure — typically starting with 2001: or your ISP's prefix — those are coming from your ISP via IPv6 RA/DHCPv6, not from your eero custom DNS setting. eero currently provides no UI to suppress IPv6 DNS advertisement independently. Workaround: eero app → Settings → Advanced Settings → IPv6 → toggle off. Trade-off: your LAN loses native IPv6 connectivity.

2026 Update: Encrypted DNS and DNSSEC on eero

As of mid-2026, eero's custom DNS field still accepts only plain UDP/TCP port-53 resolver IPs. There is no native eero interface for DNS-over-HTTPS or DNS-over-TLS at the router level. Practical consequences:

  • Queries from eero to your custom resolver travel unencrypted on the WAN link — visible to your ISP through passive port-53 inspection.
  • If encrypted upstream DNS is a requirement, the only supported path is running a local resolver (Pi-hole with Unbound, or AdGuard Home with a DoT/DoH upstream) and pointing eero to that local IP. The encrypted leg then runs from your local resolver outward, not from eero directly.
  • DNSSEC validation: eero Secure resolvers perform DNSSEC validation, protecting against cache poisoning and spoofed records. Custom resolvers vary significantly. Cloudflare 1.1.1.1, Google 8.8.8.8, and Quad9 9.9.9.9 all validate DNSSEC. Most ISP-provided resolvers do not. If you switch to custom DNS, use one of those three to maintain protection. For a deeper look at how DNS security underpins everything from DNSSEC to resolver privacy, Cloudflare's DNS learning center has thorough explainers on each layer.

Amazon has not announced native DoH or DoT support in the eero DNS settings as of mid-2026. Competitors such as Asus (AsusWRT 386+), Firewalla, and OPNsense all expose full encrypted DNS configuration at the router level. This is a meaningful gap in eero's prosumer feature set.

Common Misdiagnoses

  • eero Secure stopped working after a firmware update — check the DNS setting first. Firmware updates on eero occasionally reset custom DNS or re-surface the conflict state. Open Settings → Advanced Settings → DNS and verify the toggle is in the intended state.
  • Pi-hole is set as custom DNS but the eero app shows content filtering off — this is correct and expected behavior. The eero app always reports content filtering as disabled whenever custom DNS is active, regardless of what your custom resolver does. It is a UI status indicator, not a malfunction.
  • Custom DNS is saved but the eero block page still appears occasionally — eero can take up to 60 seconds to propagate the DNS change to all mesh nodes. Flush the device DNS cache and wait. Also confirm no other device on the network reset the setting.
  • Set 1.1.1.1 but a DNS leak test shows ISP DNS — almost always an IPv6 DNS leak as described above. Disable IPv6 on eero or accept that IPv6 DNS will follow ISP assignment.
  • eero Secure activity log is empty with custom DNS active — expected. The log is populated from eero's own resolver telemetry. Queries that never reach eero's resolvers produce no log entries.

How to Confirm the Configuration Is Working Correctly

  1. From a client device, run nslookup google.com. The Server line should show your custom resolver IP, or an eero infrastructure address if you restored Automatic.
  2. If eero Secure is restored: attempt to load a domain in a blocked category. It should return the eero block page within one or two seconds.
  3. If using Quad9: run nslookup eicar.org 9.9.9.9 — Quad9 blocks this known malware test domain and should return 0.0.0.0.
  4. If using Pi-hole: open the Pi-hole admin dashboard and confirm the query log is live and populating with traffic from your LAN clients in real time.
  5. Run the IPv6 DNS check commands above to confirm no unexpected resolver addresses are active on your devices alongside your intended custom DNS.