Netgear Genie looked simple enough when you installed it — a clean dashboard for your Nighthawk or Orbi router — but when you go hunting for DNS settings, the app either hides them three menus deep or refuses to expose them at all depending on your firmware version. This guide cuts through the confusion: exactly where DNS settings live in Genie, how to change them, how to verify the change actually took effect, and what to do when Genie does not cooperate.
What Netgear Genie Actually Controls
Netgear Genie (and its successor, the Nighthawk app) is a management interface layered on top of your router's web UI at routerlogin.net (192.168.1.1 by default). It does not replace that interface — it mirrors a subset of it. DNS settings fall into that subset inconsistently: some firmware versions expose a DNS Address field directly in Genie; others require dropping into the full web UI.
There are two distinct DNS settings on any Netgear router:
- WAN DNS — the upstream DNS servers your router itself queries. Set under Internet or WAN settings. This affects all devices on your network unless overridden per-device.
- LAN DNS (DHCP-pushed) — the DNS server addresses your router hands to clients via DHCP. Usually mirrors WAN DNS but can be set independently, under LAN or DHCP settings.
Most guides conflate these two. For a whole-network DNS change — switching to Cloudflare 1.1.1.1 or Google 8.8.8.8 — you want the WAN DNS setting.
Finding DNS Settings in the Netgear Genie App
Mobile App (iOS and Android)
Open the Netgear Genie or Nighthawk app and connect to your home Wi-Fi. From the home screen, tap Router Settings (bottom nav or hamburger menu depending on app version), then tap Internet — some firmware versions label this WAN. Look for Domain Name Server (DNS) Address. If your ISP uses DHCP, this field may be grayed out with Get Dynamically from ISP selected. Switch the dropdown to Use These DNS Servers to unlock the primary and secondary fields.
If there is no DNS field at all in the Internet section, your firmware restricts DNS editing to the web UI. This is common on pre-2022 firmware on R6xxx and R7xxx series routers.
Desktop Genie (Windows and macOS)
Desktop Genie installs as a system-tray application. Right-click the tray icon and select Router Settings. This opens a local web panel at routerlogin.net inside a Genie window. The path is: Advanced tab → Setup → Internet Setup. Scroll to Domain Name Server (DNS) Address, select Use These DNS Servers, enter your addresses, and click Apply.
Desktop Genie on Windows 10 and Windows 11 sometimes clips the Apply button below the visible area of the window. If you cannot see it, resize the Genie window to full-screen or navigate to routerlogin.net directly in a browser tab instead — both reach the same settings page.
Changing DNS via routerlogin.net
For any router running current Netgear firmware, the web UI is the more reliable path. Genie is a wrapper around it — going direct removes one layer of abstraction that can introduce display bugs and saves you from app update dependencies.
- Connect to your Netgear network (wired or Wi-Fi).
- Open a browser and navigate to http://routerlogin.net or http://192.168.1.1. Some older models default to 192.168.0.1 — check the label on the underside of your router.
- Log in. Default credentials are printed on the router label: typically
adminfor username andpasswordfor the password. Change these if you have not already. - Click Advanced in the top navigation bar.
- Go to Advanced Setup → Internet Setup. On older firmware this path may be Setup → Internet Setup.
- Scroll to the Domain Name Server (DNS) Address section.
- Select Use These DNS Servers.
- Enter your preferred addresses:
- Cloudflare:
1.1.1.1primary,1.0.0.1secondary - Google:
8.8.8.8primary,8.8.4.4secondary - Quad9 (malware blocking):
9.9.9.9primary,149.112.112.112secondary
- Cloudflare:
- Click Apply. The router saves the change without rebooting.
Orbi Mesh Systems: Where DNS Lives
Netgear Orbi uses a separate admin URL: orbilogin.com (or orbilogin.net). The path to DNS settings is the same as standard Nighthawk: Advanced → Advanced Setup → Internet Setup, then scroll to Domain Name Server (DNS) Address.
On Orbi systems running firmware RBR860s or newer (2024 and later), a DNS Filtering toggle appears in the Security section of the Orbi app, powered by Netgear Armor and Bitdefender. If this is enabled, it may silently override your custom DNS addresses. Disable Armor's DNS filtering if you want unfiltered custom resolver behavior — the custom DNS you configured in Internet Setup will not take effect while Armor DNS filtering is active.
Setting IPv6 DNS
If your ISP provides IPv6 — increasingly standard in 2026 — your router distributes IPv6 DNS addresses via DHCPv6 or RDNSS. Changing only the IPv4 DNS while leaving IPv6 DNS on ISP servers means a significant share of your clients' DNS queries will still route through ISP resolvers. To fix this, go to Advanced → Advanced Setup → IPv6 in the web UI, then enter IPv6 addresses for your chosen resolver:
- Cloudflare:
2606:4700:4700::1111/2606:4700:4700::1001 - Google:
2001:4860:4860::8888/2001:4860:4860::8844 - Quad9:
2620:fe::fe/2620:fe::9
The Genie mobile app typically does not expose IPv6 DNS fields. Use routerlogin.net directly for this configuration.
DNS-over-HTTPS and DNS-over-TLS in 2026
Standard consumer Netgear firmware does not support DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) at the router level. Even with 1.1.1.1 set as your resolver, queries between your router and Cloudflare travel unencrypted over UDP port 53. If encrypted DNS matters at the network level, the realistic options on Netgear hardware are:
- Pi-hole plus cloudflared: Run Pi-hole as your DHCP-pushed DNS server with cloudflared providing DoH upstream. Your Netgear router simply points DHCP clients at the Pi-hole's LAN IP — no firmware change needed.
- Third-party firmware: OpenWrt and DD-WRT support DoT via the
stubbypackage and DoH viahttps-dns-proxy. OpenWrt flashing is supported on select Netgear models including the R7800 and several Nighthawk R-series units. Verify your specific model on the OpenWrt Netgear hardware table before attempting a flash. - Per-device DoH: Chrome, Firefox, and Edge support DoH natively in their privacy or security settings — a useful stopgap for devices you control directly.
Verifying the Change Worked
Do not assume the Apply button succeeded. Netgear's settings page occasionally silently fails under load or on a slow wireless connection. Confirm with command-line tools before closing the browser.
Windows
The ipconfig /all output should list your new DNS server — for example, 1.1.1.1 — under the active network adapter. If your ISP's DNS address still appears, disconnect and reconnect the network connection, then recheck.
macOS
The dig SERVER line shows which resolver actually answered the query. You want to see your new DNS IP address there, not your ISP's address.
Linux
On systemd-resolved systems, resolvectl status shows per-interface DNS configuration. If the active interface still shows the old server after reconnecting to the network, run sudo systemctl restart systemd-resolved to force a refresh.
iOS and Android
On iOS, go to Settings → Wi-Fi → tap your network name → scroll to the DNS section. If it shows your new resolver address, the device picked up the change. Toggle Wi-Fi off and back on to force a DHCP renewal if the old address is still showing.
On Android, the path is Settings → Network and Internet → Wi-Fi → tap the network → Advanced → IP settings. Note that Android 9 and later includes a separate Private DNS option at Settings → Network and Internet → Advanced → Private DNS. If Private DNS is set to a hostname such as dns.google or one.one.one.one, that setting overrides anything your router sends via DHCP — this is by design and takes full precedence over router-level DNS configuration.
Common Misdiagnoses and Pitfalls
Changing DNS Per-Device Instead of on the Router
Per-device DNS changes — Windows adapter settings, macOS Network Preferences, iOS manual DNS — apply to that device only. Smart TVs, game consoles, and IoT devices on your network continue to use the old DNS resolver. Router-level changes cover the entire network in one step. Per-device settings also need to be reapplied after factory resets or OS reinstalls, which makes them fragile over time.
ISP DNS Hijacking
Some ISPs intercept all outbound UDP port 53 traffic and redirect it to their own resolvers regardless of what you have configured on the router. To test this: run nslookup google.com 1.1.1.1 and check whether the response comes from Cloudflare's IP or from an ISP-owned address. If the ISP is hijacking DNS, browser-level DoH or routing traffic through a VPN are the only available bypasses.
Netgear Armor Intercepting DNS
Netgear Armor on newer Nighthawk and Orbi models routes DNS queries through Bitdefender's threat intelligence layer, overriding your custom DNS setting at the packet level. Your configured addresses appear correctly in the UI but receive no actual traffic while Armor is active. Disable Armor's DNS filtering in the Security section of Genie to restore direct control. Verify by running dig +short whoami.cloudflare.com TXT @1.1.1.1 — if Cloudflare is genuinely answering, it returns your public IP address in the response.
DHCP Lease Not Renewed
After a router DNS change, devices on valid DHCP leases (Netgear defaults to 24-hour lease time) do not immediately receive the new DNS server. A full router reboot forces all clients to renew. Alternatively: run ipconfig /release then ipconfig /renew on Windows, or disconnect and reconnect on mobile.
Secondary DNS Left at ISP Default
Setting primary to 1.1.1.1 while leaving secondary blank or at the ISP address means your router falls back to ISP DNS on any upstream hiccup. Always populate both primary and secondary with addresses from the same resolver. A blank secondary field on Netgear firmware is not the same as no fallback — it may silently revert to a system default.
DNSSEC and Your Resolver Choice
Cloudflare, Google, and Quad9 all validate DNSSEC signatures on responses. When your Netgear router forwards queries to any of these resolvers, DNSSEC validation happens upstream automatically with no additional configuration required. Per RFC 4033, DNSSEC provides cryptographic proof that DNS responses have not been tampered with, but it does not encrypt the query in transit — that requires DoT or DoH. To confirm DNSSEC validation is active through your resolver:
Preserving DNS Settings Through Firmware Updates
Netgear's auto-update feature can push firmware overnight without a visible notification, and major version updates occasionally reset custom settings including DNS server addresses. After any firmware update, log into routerlogin.net and verify your DNS servers are still set correctly. To protect against this, export a configuration backup before any planned update: Advanced → Administration → Backup Settings → Back Up. The resulting .cfg file can be restored after an update to recover all settings — including DNS — without starting from scratch. Consider disabling auto-update (Advanced → Administration → Firmware Update → uncheck Auto Update) if DNS stability is critical to your network.