How to Change DNS on a Shaw BlueCurve Gateway

Shaw's BlueCurve Gateway ships preconfigured with Shaw/Rogers DNS servers that handle basic resolution — until they slow down, go offline, or apply filtering you didn't ask for. Swapping to a faster or more privacy-focused resolver takes about five minutes, but the DNS settings are buried deeper in the admin panel than they should be, and the menu labels shift between firmware generations. This guide covers every BlueCurve variant with exact paths, followed by verification commands to confirm the change actually propagated to your devices.

Why Change DNS on a BlueCurve Gateway

The default Shaw/Rogers resolvers are functional but fall short in several areas that matter to home and small-business users:

• Speed: Third-party resolvers like Cloudflare (1.1.1.1) consistently benchmark faster than ISP DNS in Western Canada, especially during peak evening hours when Shaw's resolvers carry heavy load.
• Privacy: ISP DNS logs every query from your network by default. Cloudflare's 1.1.1.1 and Quad9 publish independently audited no-logging policies.
• Malware and phishing blocking: Quad9 (9.9.9.9) blocks connections to known malicious domains at the resolver level — no per-device software needed, it covers every device on your network automatically.
• DNSSEC validation: Shaw's resolvers don't consistently validate DNSSEC signatures, which leaves a door open for cache-poisoning attacks. Quad9 and Cloudflare both validate by default.
• Outage resilience: During Rogers network maintenance windows — a recurring pattern post-2023 merger — having a non-Shaw secondary resolver keeps DNS working when Shaw's infrastructure is degraded.

A gateway-level change is far more efficient than configuring each device individually. One edit in the admin panel propagates to every phone, laptop, TV, and smart home device on your network via DHCP.

What You Need Before Starting

• A device connected to the BlueCurve Gateway — wired Ethernet is more reliable for admin access, but WiFi works fine
• The admin password from the sticker on the bottom or back of the gateway, labelled "Admin Password" or "Password" — this is distinct from your WiFi password
• The DNS server IPs you plan to use (options listed below)

Recommended DNS pairs:

• Cloudflare: 1.1.1.1 / 1.0.0.1 — fastest globally, strong privacy record
• Google Public DNS: 8.8.8.8 / 8.8.4.4 — reliable, no filtering
• Quad9 (DNSSEC + malware blocking): 9.9.9.9 / 149.112.112.112
• OpenDNS Home: 208.67.222.222 / 208.67.220.220 — optional phishing filter
• CleanBrowsing (family-safe): 185.228.168.9 / 185.228.169.9

Identifying Your BlueCurve Hardware

Shaw and Rogers have deployed several hardware variants under the BlueCurve brand. The admin interface is similar across all of them, but the default admin IP and menu depth differ:

• XB6, XB7, XB8 (Arris or Technicolor — most deployments after 2019): Admin panel at http://10.0.0.1
• Hitron CODA-4582 / CODA-4589 (older Shaw deployments): Admin at http://192.168.0.1
• Compal CH7465LG (less common): Admin at http://192.168.100.1

Check the sticker on your device for the model number. In 2026, the vast majority of active BlueCurve deployments are XB6 or newer, so start with http://10.0.0.1. If nothing loads, work through the alternates above.

Step-by-Step: Change DNS in the Admin Panel

Step 1 — Open the Admin Panel

Type http://10.0.0.1 into your browser's address bar — not the search bar. If it doesn't load after a few seconds, try http://192.168.0.1 or http://myshawgateway.shaw.ca (the Shaw hostname resolves locally on most current firmware versions and is a reliable fallback).

At the login prompt, enter username admin and the password from the device label. This is the factory default and most users have never changed it. If the password has been changed and you don't know it, hold the reset pinhole button on the back of the gateway for 10–15 seconds to restore factory defaults — but this also clears custom WiFi passwords and any port-forwarding rules you've configured.

Step 2 — Navigate to the DNS Settings

The path varies by firmware. Two layouts are common in the field:

XB6 / XB7 / XB8 — current firmware (most users):

1. In the left sidebar, click Connection
2. Click Local IP Network
3. Scroll down to the DHCP section
4. Locate the fields labelled DNS Server 1 and DNS Server 2

Hitron CODA / older BlueCurve firmware:

1. Click Advanced in the top navigation or sidebar
2. Click LAN or LAN Setup
3. The DNS fields are inside the DHCP Server configuration block

Before entering new values, check whether Parental Controls DNS filtering is active in your gateway. Rogers Ignite parental controls can silently override custom DNS for enrolled devices even after you save new values. Disable it or note which devices it applies to before proceeding.

Step 3 — Enter Your New DNS IPs

Clear the existing values in both fields. Enter your chosen primary resolver in DNS Server 1 and secondary in DNS Server 2. Use plain IPv4 addresses here — IPv6 DNS is handled separately (covered in the 2026 section below). Example for Cloudflare:

Example for Quad9 with DNSSEC validation and malware blocking:

Step 4 — Save and Apply

Click Save or Apply. The gateway applies DHCP changes without a full reboot. Connected devices don't pick up the new DNS immediately — they continue using the old resolver until they renew their DHCP lease. Force an immediate update using the commands in the next section.

Force Devices to Use the New DNS Immediately

Devices hold their existing DHCP lease, which includes the old DNS server IPs. Without a lease renewal, they'll keep using the old resolver until it naturally expires — typically 24 hours on BlueCurve defaults. To force immediate adoption on each device:

Windows

Run these in an elevated Command Prompt (right-click Start, choose Windows Terminal or Command Prompt, select Run as administrator). The flushdns step clears the Windows DNS resolver cache so stale entries from the old resolver don't linger after the switch.

macOS

Replace en0 with en1 if you're connected via WiFi rather than Ethernet — check System Settings → Network for your active interface name. The killall command restarts mDNSResponder, which manages macOS's DNS cache.

Linux (systemd-based)

The final command shows which DNS servers are currently active per network link — confirm your new resolver IP appears there before moving on.

iOS and Android

Toggle WiFi off, wait three seconds, toggle it back on. This triggers a fresh DHCP request that picks up the new DNS. On iOS, you can also go to Settings → WiFi → tap the ⓘ next to your network → tap Renew Lease. On Android: long-press the network name → Modify Network, or simply Forget and reconnect. Important: iOS 14+ and Android 9+ support system-wide Private DNS (DoT) settings that override DHCP DNS entirely if configured at the OS level — a device-level DoT setting will ignore whatever the gateway pushes.

Verify the Change Worked

Don't assume — verify from a terminal on a connected device.

Windows

ipconfig /all lists the DNS servers assigned to each network adapter. Your new resolver IPs should appear here. The nslookup output header shows "Server: [IP]" — that IP should now match what you entered in the gateway, not a Shaw/Rogers address.

macOS and Linux

The first command shows your OS nameservers. The second confirms resolution is working. The third queries Cloudflare directly — useful for ruling out whether a resolution failure is coming from your resolver or from elsewhere on the path.

Linux with systemd-resolved (Ubuntu 22.04+)

On modern Ubuntu, /etc/resolv.conf often points to the local stub resolver (127.0.0.53) rather than your gateway DNS directly. resolvectl status is the authoritative source — it shows per-link DNS including what was received via DHCP.

Use our DNS Lookup tool to query your domain from multiple global vantage points — especially useful if you've also made domain-level DNS changes and want to confirm propagation worldwide, not just locally.

When DNS Fields Are Missing or Greyed Out

Gateway in Bridge Mode

If Rogers placed your BlueCurve in bridge or IP Passthrough mode so your own router handles networking, the BlueCurve is no longer serving DHCP. Your downstream router — Asus, TP-Link, Netgear, or other — is the one handing out DNS. Change DNS there, not on the BlueCurve. The admin panel in bridge mode deliberately removes LAN and DHCP controls, so the DNS fields simply won't exist.

Firmware Lock on Rogers XB8 Deployments

Some Rogers XB8 firmware builds deployed through 2024–2025 grey out the DNS fields entirely. This appears to be a provisioning policy on certain account types. Three workarounds in order of least disruption:

• Set DNS per-device (see below) — per-device DNS overrides DHCP regardless of what the router pushes
• Call Rogers support and request that they enable "custom DNS" for your gateway — this can be done remotely with no technician visit required
• Put the BlueCurve in bridge mode and add your own router downstream, where you have unrestricted DNS control

The App vs. the Web Admin

The Rogers Ignite WiFi app (formerly the Shaw BlueCurve Home app) does not expose DNS settings. It handles device management, WiFi scheduling, and parental controls only. All DNS configuration must go through the browser-based admin panel at http://10.0.0.1 — there is no app shortcut for this.

Per-Device DNS as a Fallback

If gateway-level DNS isn't configurable, set DNS directly on each device. Per-device settings override DHCP on a device-by-device basis:

Windows 11: Settings → Network and Internet → your connection → Edit next to "DNS server assignment" → Manual → IPv4 → enter DNS IPs → Save.

macOS: System Settings → Network → your interface → Details → DNS tab → click + to add resolver IPs → remove old entries → OK.

Android 9+ (system-wide DoT): Settings → Network and Internet → Private DNS → Private DNS provider hostname → enter dns.cloudflare.com or dns.quad9.net. This applies encrypted DNS globally on the device regardless of which WiFi network it joins.

iOS (per-network): Settings → WiFi → tap ⓘ next to your network → Configure DNS → Manual → add the DNS server IPs you want.

Common Misdiagnoses

• Browser DNS cache: Chrome caches DNS independently of the OS resolver. After changing, go to chrome://net-internals/#dns and click "Clear host cache." Firefox has a similar cache accessible at about:networking#dns.
• DHCP lease not renewed: The single most common cause of "the change didn't work." The device is still holding its old lease with old DNS. Force a renew with the commands listed above — don't wait 24 hours.
• Rogers Ignite parental controls: When DNS-level parental filtering is active in the gateway, it silently overrides custom DNS for enrolled devices. Check the Parental Controls section of the admin panel or the Ignite WiFi app.
• Active VPN client: A VPN tunnels DNS through the VPN provider's own resolver, bypassing your gateway DNS setting entirely. This is by design. Your BlueCurve change has no effect on DNS while a VPN is active on that device.
• iOS Private DNS overriding DHCP: An iPhone or iPad with a manually configured DoT hostname under Settings → WiFi → Configure DNS will ignore DHCP-pushed DNS. The device-level setting takes precedence.
• Corporate split-DNS: A device also connected to a corporate VPN with split-DNS sends some queries through the VPN resolver and some through local. Test with a personal device and no VPN running for a clean result.

Shaw/Rogers DNS Reliability Issues That Drive This Change

Two historical failure modes have sent a large number of BlueCurve users looking for alternatives:

1. NXDOMAIN hijacking: Older Shaw DNS returned a Shaw-branded search redirect instead of a proper NXDOMAIN for failed lookups. Applications that rely on negative DNS responses to detect unreachable hosts break entirely in this scenario. Most current Rogers resolver IPs have stopped doing this, but some legacy addresses in specific markets still do it. Run a quick test after switching: nslookup definitelydoesnotexist-xyz-123.com should return a status of NXDOMAIN with no IP address.
2. Resolver outages during infrastructure work: Post-merger Rogers network events in 2023–2025 caused DNS timeouts in parts of BC and Alberta lasting 10 to 60 minutes. Running a primary and secondary resolver from two different providers — for example, 1.1.1.1 primary and 9.9.9.9 secondary — gives automatic failover when one provider has an issue.

2026: IPv6 DNS, DoH/DoT, and DNSSEC

Set IPv6 DNS Alongside IPv4

Rogers delivers dual-stack IPv4/IPv6 to most BlueCurve homes in 2026. Devices receive IPv6 DNS servers via DHCPv6 or RDNSS. Look for a separate IPv6 DNS Server field in the same LAN/DHCP section as the IPv4 fields and update it at the same time:

If you only update IPv4 DNS and leave the IPv6 DNS at Shaw defaults, dual-stack clients will still use Shaw's resolver for all IPv6 queries. On modern devices that prefer IPv6 connections, this means the majority of DNS traffic is still going through Shaw.

Encrypted DNS (DoH and DoT)

Standard gateway DNS uses unencrypted UDP/TCP port 53. Queries are visible to anyone on the path between your gateway and the resolver. The BlueCurve Gateway does not support upstream DoT or DoH natively in any current firmware version. For encrypted DNS across your whole network, the only path is: put BlueCurve in bridge mode, add an OpenWrt or DD-WRT router downstream, and configure upstream DoT there under Network → DHCP and DNS → DNS over TLS. For encrypted DNS per-device, all major platforms support it natively — Windows 11, macOS 13+, iOS 14+, Android 9+, Firefox, and Chrome all have DoH settings built in.

DNSSEC Validation

According to Cloudflare's DNS security documentation, DNSSEC-validating resolvers return SERVFAIL when a record's cryptographic signature doesn't match — blocking cache-poisoning attacks that can redirect users to malicious servers even when everything on the network looks correct. Shaw's default resolvers do not reliably validate DNSSEC signatures. Switch to Quad9 (9.9.9.9) if DNSSEC validation matters: it validates DNSSEC on all queries and simultaneously blocks connections to known malware and phishing domains at no added latency cost.

Reverting to Shaw/Rogers Defaults

If your chosen resolver causes unexpected issues — aggressive malware filters like CleanBrowsing occasionally produce false positives on CDN or e-commerce domains — revert by returning to the DNS fields in the gateway admin panel and clearing both values. The gateway falls back to whatever DNS Rogers pushes via its own upstream WAN connection. Alternatively, enter Rogers Western Canada DNS servers directly:

These addresses vary by region and Rogers can change them without notice. Blanking the fields is the more reliable revert strategy since it always follows the current Rogers infrastructure for your service area rather than depending on hardcoded IPs remaining accurate.