Quad9 DNS Setup Guide for Windows, Mac, Linux, and Routers

Quad9 is a free, privacy-focused DNS resolver operated by a Swiss non-profit that blocks known malicious domains before your browser ever makes a connection. Unlike your ISP's default DNS, Quad9 checks every lookup against a threat-intelligence feed covering malware distribution sites, phishing pages, and command-and-control servers. Switching takes about three minutes on most devices, costs nothing, and you get a measurable security layer with no software to install and no subscription to manage. This guide covers the exact steps for Windows 10/11, macOS, Linux, and the most common home routers, plus how to verify the change actually took effect.

Why Bother Switching Away from Your ISP's DNS

Your ISP's DNS resolver is optimized for one thing: returning answers fast for their own network. It almost certainly logs every domain you query, may inject ads into NXDOMAIN responses (the page you see when a domain doesn't exist), and provides zero threat filtering. Quad9's primary address 9.9.9.9 (IPv6: 2620:fe::fe) runs DNSSEC validation on every response and cross-references domains against threat feeds from IBM X-Force, Abuse.ch, Bambenek Consulting, and roughly two dozen other sources. If a domain matches a threat indicator, Quad9 returns NXDOMAIN before your machine ever attempts a TCP connection to the malicious host.

Quad9 also offers a second resolver at 9.9.9.11 (IPv6: 2620:fe::11) that skips the blocking and gives you pure DNSSEC validation without filtering — useful for security researchers or anyone who wants the privacy and validation benefits without the blocklist. A third option at 9.9.9.10 skips both blocking and DNSSEC for maximum compatibility with broken zone setups. For most home and small-business users, stick with 9.9.9.9.

Quad9 DNS Addresses at a Glance

• Primary (secured): 9.9.9.9 / 2620:fe::fe
• Secondary (secured): 149.112.112.112 / 2620:fe::9
• Unsecured (no blocking): 9.9.9.10 / 2620:fe::10
• ECS-enabled (secured): 9.9.9.11 / 2620:fe::11

Setting Up Quad9 on Windows 10 and Windows 11

Windows stores DNS settings per network adapter. If you use both Wi-Fi and Ethernet, you need to configure each one separately.

1. Open Settings and go to Network and Internet.
2. Click Ethernet or Wi-Fi depending on your active connection, then click the adapter name.
3. Under DNS server assignment, click Edit.
4. Switch the dropdown from Automatic (DHCP) to Manual.
5. Toggle IPv4 on. Enter 9.9.9.9 as Preferred and 149.112.112.112 as Alternate.
6. If you use IPv6, toggle IPv6 on and enter 2620:fe::fe and 2620:fe::9.
7. Click Save.

You can also do this from an elevated command prompt, which is faster when scripting across multiple machines:

Replace Wi-Fi with the exact adapter name shown in netsh interface show interface if yours differs.

Setting Up Quad9 on macOS Ventura and Sonoma

1. Open System Settings and click Network.
2. Select your active connection (Wi-Fi or Ethernet) and click Details.
3. Click the DNS tab.
4. Click the + button and add 9.9.9.9, then add 149.112.112.112.
5. For IPv6 add 2620:fe::fe and 2620:fe::9.
6. Click OK then Apply.

From Terminal you can do the same thing in one shot:

Use networksetup -listallnetworkservices to see the exact service names on your Mac. After applying, flush the local cache:

Setting Up Quad9 on Linux

The method depends on your distribution's network management stack. Most modern distros use either systemd-resolved or NetworkManager, and a few older servers still use a static /etc/resolv.conf.

systemd-resolved (Ubuntu 20.04+, Fedora, Arch)

Find the [Resolve] section and set:

Save and restart the service:

Verify with:

NetworkManager (common on RHEL/CentOS/Debian desktops)

Note the connection name (e.g., Wired connection 1), then:

Static resolv.conf (servers without a network manager)

Replace or add:

Note: on systems using resolvconf or dhclient, this file gets overwritten on reconnect. Lock it after editing:

Setting Up Quad9 on Your Router

Configuring DNS at the router level is the most efficient approach because every device on your network inherits the setting automatically. The admin interface varies by brand.

TP-Link Routers (Archer series, tplinkwifi.net)

1. Open tplinkwifi.net or 192.168.0.1 in a browser.
2. Log in and go to Advanced then Network then Internet.
3. Find the DNS section. If your connection type is DHCP or PPPoE, there will be primary and secondary fields.
4. Enter 9.9.9.9 and 149.112.112.112.
5. Click Save.

Netgear Routers (routerlogin.net)

1. Browse to routerlogin.net or 192.168.1.1.
2. Go to Advanced then Setup then Internet Setup.
3. Scroll to Domain Name Server (DNS) Address and select Use These DNS Servers.
4. Enter 9.9.9.9 as Primary and 149.112.112.112 as Secondary.
5. Click Apply.

ASUS Routers (asusrouter.com)

1. Browse to router.asus.com or 192.168.1.1.
2. Go to WAN then Internet Connection.
3. Under WAN DNS Setting, set Connect to DNS Server automatically to No.
4. Enter 9.9.9.9 for DNS Server 1 and 149.112.112.112 for DNS Server 2.
5. Click Apply.

Generic Router (192.168.0.1 or 192.168.1.1)

Look for a menu path like WAN Settings, Internet, or Basic Setup. Any field labeled Primary DNS, DNS 1, or Preferred DNS is where you enter 9.9.9.9. Secondary or Alternate DNS gets 149.112.112.112. Save and reboot the router if the change doesn't take effect immediately.

Enabling DNS over HTTPS or DNS over TLS with Quad9

Plain DNS queries travel unencrypted and can be read or tampered with by anyone on the same network path. Quad9 supports both DNS over HTTPS (DoH) and DNS over TLS (DoT).

In Windows 11, after adding 9.9.9.9 in the network adapter settings, look for a dropdown labeled DNS over HTTPS and select On (automatic template). Windows will negotiate DoH automatically with Quad9.

In Firefox, go to Settings, Privacy and Security, scroll to DNS over HTTPS, and select Max Protection. Under Choose provider select Quad9 from the list or enter the custom URL:

For Chrome and Edge, go to Settings, Privacy and Security, Security, enable Use secure DNS, and choose With: Custom, then enter https://dns.quad9.net/dns-query.

For DoT on Linux with systemd-resolved, add DNSOverTLS=yes to /etc/systemd/resolved.conf alongside the Quad9 addresses and restart the service.

Verifying the Quad9 Setup Worked

Never assume a DNS change worked — verify it. There are several quick methods:

From Windows Command Prompt or macOS/Linux Terminal:

The response should come from a Quad9 anycast address. For a more direct check:

Quad9 publishes a test domain specifically for this purpose. Query it:

If Quad9 is active, it returns the IP 9.9.9.9. To confirm threat blocking is working, try resolving a known test domain that Quad9 intentionally blocks:

You should get an NXDOMAIN or a blocked response, not a real IP. Use the DNS Lookup tool to run a live A record query against 9.9.9.9 directly from multiple global vantage points and confirm Quad9 is responding as expected.

Troubleshooting Common Quad9 Issues

Certain sites stop loading after the switch

Quad9 may be blocking a domain you need to access. Check whether the domain is flagged by visiting https://www.quad9.net/result/ and entering the domain name. If it's a false positive, Quad9 has a reporting form to dispute the block. As a workaround, temporarily switch to 9.9.9.10 (unfiltered) to confirm Quad9 is the cause, then revert once you've reported the issue.

DNS leaks through the ISP resolver

If your system has multiple network interfaces or your VPN client manages its own DNS, your queries may leak to the ISP's resolver even after you've configured Quad9. Run a DNS leak test at dnsleaktest.com to check. On Windows, setting the same DNS on all adapters (including virtual VPN adapters) usually resolves this.

Router changes not propagating to devices

After changing router DNS settings, existing clients keep their DHCP lease until it expires. Force renewal with ipconfig /release then ipconfig /renew on Windows, or sudo dhclient -r && sudo dhclient on Linux. On macOS, turn Wi-Fi off and on again.

How to Prevent Regression

The most common way to lose your Quad9 configuration is a router firmware update resetting WAN settings to defaults, or a new DHCP lease pushing the ISP's DNS address back to client machines. Set a calendar reminder to re-verify DNS settings after any router firmware update. On Windows, consider using Group Policy to lock the DNS settings on managed machines. On Linux servers, use configuration management (Ansible, Puppet, Chef) to enforce /etc/systemd/resolved.conf state on every converge run. At the router level, disable automatic DNS assignment from your ISP's DHCP if your router's WAN settings allow it — most do under an option labeled something like Get DNS server address automatically.

Quad9 also maintains an Anycast network with over 200 points of presence, so you should never need to fall back to your ISP's resolver for performance reasons. The 9.9.9.9 address routes to the geographically nearest Quad9 node automatically, and round-trip times are typically comparable to or better than ISP resolvers for most regions.