Linksys Velop Mesh DNS Setup, Verification, and Troubleshooting

Linksys Velop mesh systems handle DNS differently from a conventional single router, and the app-first interface hides settings that most network documentation assumes you can reach through a browser. Whether you are switching to a faster public resolver, enabling DNS-based content filtering for a household, or diagnosing intermittent resolution failures across a multi-node mesh, the fix almost always starts at the parent node — and almost always requires knowing which menu path applies to your firmware version.

How Velop Routes DNS Traffic

Every Velop deployment has one parent node — the unit physically connected to your modem or ONT. Satellite nodes connect via wireless backhaul or Ethernet and inherit all DNS configuration from the parent automatically. You cannot configure DNS independently on a satellite. Every DNS config change flows through the parent node and propagates outward from there.

On the WAN side, the parent requests DNS server addresses from your ISP as part of the DHCP lease. On the LAN side, Velop pushes its own LAN IP address (default 192.168.1.1) to every connected client as the DNS server. Your devices send queries to the Velop, and the Velop proxies them upstream to whichever WAN DNS resolver is configured. This forwarding model means one WAN DNS change affects every device on the network simultaneously — no per-device changes required.

If a device has static DNS configured at the OS level, that device bypasses the Velop proxy entirely for DNS. This is the most common source of confusion: you update the router, but a specific laptop or phone still uses the old resolver. The router config and device-level config are independent, and only one governs each device at a time.

Which Velop Model Are You Running?

The configuration path is identical across all current Velop hardware, but available admin interfaces vary by model and firmware generation:

• WHW01, WHW02, WHW03 (original Velop): Full app and web UI support. Web UI accessible at http://linksyssmartwifi.com or http://192.168.1.1. Local admin password login available.
• MX4200, MX5300, MX8500, MX10 (Velop AX): App is primary interface. Web UI accessible but may require Linksys cloud account credentials on firmware builds from 2024 onward.
• MBE70 (Velop Pro 7, WiFi 7): App-only for most settings on current firmware. DNS control confirmed working in app version 4.2 and later. Web UI has limited scope.

Across all models: update to the latest firmware before configuring DNS manually. An outdated firmware build is the single most common reason DNS settings appear greyed out, refuse to save, or revert to automatic after a reboot.

Method 1: Linksys App

The Linksys mobile app is the standard configuration interface for all current Velop hardware. The steps below apply to app version 4.x and later on iOS and Android.

1. Open the Linksys app and sign in with your Linksys account credentials.
2. On the home screen, tap the icon representing your Velop network or parent node name.
3. Scroll down to Advanced Settings and tap it.
4. Tap Internet Settings.
5. In the DNS section, tap the selector next to Automatic (DHCP) and switch it to Manual.
6. Enter your preferred resolver address in DNS 1 and a backup in DNS 2.
7. Tap Save. The parent node restarts. Connected devices lose connectivity for 15 to 30 seconds during the reboot.

If the Manual option is greyed out: tap the gear icon top-right → Router Settings → Firmware Update → Check for Updates. Manual DNS control requires firmware 2.1 or later on WHW-series and firmware 1.0.6 or later on MX-series hardware.

Resolver Pairs Worth Using

• Cloudflare (speed and privacy): 1.1.1.1 / 1.0.0.1
• Google (reliability, global uptime): 8.8.8.8 / 8.8.4.4
• Quad9 (security blocking, DNSSEC validation): 9.9.9.9 / 149.112.112.112
• OpenDNS Family Shield (content filtering, no account required): 208.67.222.123 / 208.67.220.123
• OpenDNS Home (custom category-level filtering): 208.67.222.222 / 208.67.220.220

Method 2: Web UI at linksyssmartwifi.com

The browser interface replicates most app functions and is the fallback when the app cannot reach the parent node due to a local network or account authentication issue.

1. Connect a device to your Velop network. A wired connection to the parent node gives the most reliable management access.
2. Open a browser and navigate to http://linksyssmartwifi.com. If DNS is already broken and that hostname will not resolve, use the fallback address http://192.168.1.1 directly.
3. Log in with your Linksys admin password. On older WHW-series firmware this is the local admin password you set during initial setup. On newer MX and Velop Pro firmware, the web UI may require Linksys cloud account credentials. To enable local-only login first: open the Linksys app → gear icon → Router Settings → Administration → toggle Local Management on.
4. In the left-side navigation, click Connectivity.
5. Select the Internet Settings tab.
6. Scroll to the DNS section. Change the dropdown from Automatic to Manual.
7. Enter addresses in the Preferred DNS and Alternate DNS fields.
8. Click Apply Changes. The node restarts.

IPv6 DNS Configuration

If your ISP provides IPv6 — increasingly standard with major Canadian and US broadband carriers in 2026 — configure IPv6 DNS addresses alongside IPv4. Leaving IPv6 DNS as automatic while setting manual IPv4 DNS causes intermittent failures: IPv4 queries hit your chosen resolver, but IPv6 queries fall back to the ISP resolver. The symptom is resolution speed that appears randomly inconsistent across different domains, with no obvious pattern.

In both the app and the web UI, scroll past the IPv4 DNS fields to the IPv6 section and enter your preferred addresses:

• Cloudflare IPv6: 2606:4700:4700::1111 / 2606:4700:4700::1001
• Google IPv6: 2001:4860:4860::8888 / 2001:4860:4860::8844
• Quad9 IPv6: 2620:fe::fe / 2620:fe::9

Verifying the DNS Change

After the node restarts, confirm the DNS change is active from a connected device. The app success screen alone is not reliable confirmation — some firmware builds report success while silently discarding the saved configuration.

Mac and Linux

Windows (PowerShell or Command Prompt)

Linux with systemd-resolved

Use the DNS Lookup tool to query a domain from an external vantage point — useful for confirming your new resolver returns the same records as the global authoritative nameservers, rather than a stale cached answer sitting in a middle-tier resolver.

iOS and Android

On iOS: Settings → Wi-Fi → tap your network name → the DNS field still shows 192.168.1.1 after your change. That is correct. The Velop proxy is transparent to end devices. Indirect verification: enable OpenDNS or Quad9 and attempt to load a domain those resolvers block by default — if the domain is blocked, the resolver is active.

On Android: Settings → Network and Internet → Wi-Fi → tap your network name → Advanced → DNS also shows 192.168.1.1. Same proxy model. For explicit verification, install a DNS query app and check the responder IP in the answer section — it will show the Velop LAN IP, confirming the full proxy path is intact and forwarding to your new upstream.

Pushing Custom DNS Directly to Clients

Velop's standard UI does not expose DHCP option 6, so there is no built-in way to push a custom DNS server IP directly to clients. All clients receive the Velop's LAN IP as their DNS server by default. Three practical workarounds cover most deployment needs:

1. Per-device static DNS: Set DNS manually on each device's OS network adapter settings. That device bypasses the Velop proxy entirely for its own DNS queries. Appropriate for a single machine that requires different filtering from the rest of the network — testing an alternative resolver, for example, without affecting other devices.
2. Pi-hole or AdGuard Home locally: Install on a Raspberry Pi, small local server, or Docker container. Disable DHCP on Velop (app → Advanced Settings → Local Network → DHCP Server: Off) and let Pi-hole or AdGuard Home issue DHCP leases, pushing itself as the DNS server to every client. Both platforms support DNS over HTTPS and DNS over TLS upstream connections natively, and provide per-client query logging.
3. Android Private DNS (DoT): Android 9 and later supports DNS over TLS at the OS level, independent of the router configuration. Settings → Network and Internet → Private DNS → Hostname mode → enter dns.cloudflare.com or dns.quad9.net. Active system-wide on that device regardless of what the Velop hands out via DHCP.

DNS over HTTPS, DoT, and DNSSEC in 2026

Linksys Velop firmware as of mid-2026 does not support DNS over HTTPS or DNS over TLS natively. All forwarded queries leave the parent node over UDP port 53 in plaintext. For most home networks this is an acceptable baseline — your ISP can observe DNS queries regardless of router-level encryption — but it becomes relevant if the network carries sensitive traffic or if DNS interception is a known concern on the upstream connection.

For encrypted DNS on a Velop network:

• AdGuard Home locally: Full DoH and DoT upstream support with a dashboard for per-client query statistics. Point Velop's WAN DNS to the AdGuard Home server's LAN IP, or disable Velop's DHCP and let AdGuard handle leases end-to-end.
• OS-level DoH on Windows 11 and macOS Ventura and later: Each machine encrypts its own DNS independently of the router. Enable in Settings → Network → configure DNS → HTTPS mode. Router DNS configuration becomes irrelevant for those devices.
• DNSSEC: Cloudflare 1.1.1.1 and Google 8.8.8.8 both perform DNSSEC validation before returning answers. Velop does not validate DNSSEC signatures itself, but forwarding to a validating resolver means signed zones are protected end-to-end. For a detailed explanation of how DNSSEC validation works in a recursive forwarder chain, see Cloudflare's DNS documentation.

Common Misdiagnoses

• "DNS is not changing after saving." Confirm you set WAN DNS (the network-wide upstream, found in Internet Settings on the router) and not a device-level static DNS override in the OS network adapter settings. They are fully independent. On Windows run ipconfig /all and read the DNS Servers line for the active adapter. On Mac: System Settings → Network → adapter → Details → DNS tab.
• "Satellite nodes have different DNS behavior." Satellites cannot hold independent DNS config. If a satellite-connected device resolves differently from others on the same network, it has a static DNS entry set at the OS level from a previous network configuration. Clear the device-level override — the satellite itself is not the cause.
• "Sites still do not load after changing DNS." Stale client cache. Run ipconfig /flushdns on Windows, sudo dscacheutil -flushcache on macOS, or sudo resolvectl flush-caches on Linux. Also restart the browser — Chrome and Firefox each maintain their own internal DNS cache that is separate from the OS resolver cache and survives an OS-level flush.
• "linksyssmartwifi.com will not load in the browser." The most common cause is being connected to the Velop guest network, which runs on a separate subnet with no access to the management interface. Connect to the primary SSID and try again. Fallback: navigate directly to http://192.168.1.1. If both fail, the web UI may be disabled — enable Local Management in the app before retrying.
• "DNS 1 field is blank after saving." Known issue in early MX-series firmware: IPv6-format addresses entered in an IPv4 DNS field fail silent validation and the entire DNS section reverts to blank without any error message. Update firmware first, then re-enter. Confirm you are entering dotted-decimal IPv4 format (for example 9.9.9.9) in IPv4 fields and full IPv6 colon notation in IPv6 fields.
• "OpenDNS filtering is not working despite correct DNS servers." OpenDNS content filtering requires your WAN IP to be registered in your OpenDNS dashboard account. The DNS server IP addresses alone are not sufficient — the filtering policy is tied to your registered network IP. Log in at opendns.com and confirm your current WAN IP appears under Networks with the correct content policy applied and active.

Confirming the Fix Persists

Custom DNS settings on Velop have reverted to automatic after firmware updates on certain early MX-series builds. To verify persistence after any firmware update or power cycle:

1. Power-cycle the parent node: unplug for 30 seconds, then reconnect power.
2. Wait 2 full minutes for the node to come online and stabilize.
3. Open the Linksys app → Advanced Settings → Internet Settings. Confirm DNS 1 and DNS 2 show your manual entries — not blank fields or an ISP-issued address.
4. From a laptop on the network, run dig google.com and confirm the SERVER line in the output shows 192.168.1.1, not your ISP's resolver IP directly.

If entries revert: update to the latest available firmware before re-entering values. Linksys resolved the DNS persistence bug in the WHW firmware 3.x release series and in MX firmware 1.0.11 and later. DNS settings entered after updating to a fixed build persist correctly across subsequent firmware updates without manual re-entry.

Preventing DNS Drift

• Enable automatic firmware updates in the app: gear icon → Router Settings → Auto Update: On. Current firmware builds are significantly more reliable at preserving manual DNS config across reboots, ISP reconnects, and incremental updates than builds from 2022 to early 2024.
• Record your DNS configuration with the date in a password manager or notes app. After any factory reset, ISP modem replacement, or Velop hardware swap, re-enter manually — factory resets clear all custom configuration including DNS, and the router returns to automatic ISP-assigned resolvers without notification.
• If using OpenDNS for household content filtering, check the OpenDNS dashboard monthly and look at query volume. Zero traffic for more than a day is the earliest reliable indicator that the network stopped routing through OpenDNS — almost always caused by DNS reverting to automatic after a firmware update.
• For double-NAT setups where an ISP-provided router sits upstream of the Velop: the Velop acquires its WAN DNS from the ISP router via DHCP, which can silently override your manual entries. Check the Velop WAN status page — if it shows the ISP router's IP as DNS despite your manual config, either set DNS on the ISP router instead, or put the ISP device in bridge or pass-through mode so the Velop controls the WAN connection and DHCP lease directly.