The Ubiquiti Dream Machine (UDM) and Dream Machine Pro (UDM-Pro) are powerful all-in-one network devices that give you far more DNS control than a typical consumer router. But that flexibility comes with complexity. Out of the box, the UDM forwards DNS queries to whatever your ISP hands out via DHCP, which can mean slow lookups, zero privacy, and no internal name resolution. Getting DNS properly configured on a UDM makes a noticeable difference in browsing speed, internal hostname resolution, and network security. This guide covers every DNS setting you will encounter in UniFi Network, including WAN DNS, DHCP client DNS distribution, local domain names, and DNS shield options.
Understanding How the UDM Handles DNS
The UDM runs UniFi Network OS on top of a Linux base. DNS on this platform operates at two distinct layers that beginners often confuse:
- WAN DNS servers — used by the UDM itself for its own outbound resolution (firmware updates, UniFi cloud connectivity, etc.)
- DHCP-distributed DNS servers — pushed to client devices on each network (VLAN) when they request an IP address
These are configured separately, and failing to set both is one of the most common mistakes. You can set the WAN DNS to Cloudflare but forget to push it to clients, leaving every laptop and phone still hitting your ISP's resolver.
Accessing the UniFi Network Application
The admin interface for all Dream Machine models lives at https://192.168.1.1 (default gateway) or via https://unifi.ui.com if you manage your device through UniFi Site Manager. For locally-hosted UniFi Network Application on a UDM or UDM-Pro, go directly to the device IP. First-generation UDM units often ship with the gateway at 192.168.1.1, while older EdgeRouter-style setups may use 192.168.0.1.
Log in with your local admin credentials or your Ubiquiti (UI) SSO account depending on how you set up the device. Once inside, you will land on the UniFi Network dashboard.
Step 1: Set WAN DNS Servers
This controls which resolvers the UDM itself uses. Navigate to Settings > Internet (some firmware versions label this Settings > WAN). Select your primary WAN connection and scroll to the DNS Server section.
By default this is set to Auto, which means your ISP's resolver. Change it to Manual and enter your preferred servers. Common choices:
- Cloudflare: 1.1.1.1 and 1.0.0.1
- Google Public DNS: 8.8.8.8 and 8.8.4.4
- Quad9 (malware blocking): 9.9.9.9 and 149.112.112.112
- OpenDNS: 208.67.222.222 and 208.67.220.220
Click Apply Changes. This takes effect immediately for the UDM's own resolution but does nothing yet for your client devices.
Step 2: Configure DHCP DNS for Client Networks
Each network (VLAN) on the UDM has its own DHCP server configuration, and that is where you push DNS servers to clients. Go to Settings > Networks and click the pencil icon on your primary LAN (typically called Default). Scroll down to DHCP and expand the Advanced DHCP Options section.
You will see fields for DNS Server 1 and DNS Server 2. By default these are blank, which causes the UDM to advertise itself (its LAN IP, usually 192.168.1.1) as the DNS server. Clients then forward through the UDM to whatever WAN DNS is configured. This is fine for basic setups, but has caveats:
- The UDM becomes a single point of failure for DNS
- All client DNS traffic is proxied, adding slight latency
- You lose visibility into per-client DNS queries unless you enable logging
To push resolvers directly to clients without the UDM as intermediary, enter your chosen DNS IPs directly in these fields (e.g., 1.1.1.1 and 1.0.0.1). To keep the UDM as the local DNS proxy (needed for local hostname resolution), leave these blank or explicitly enter the UDM's LAN IP.
Step 3: Set a Local Domain Name
The UDM supports a local DNS domain so that internal devices can resolve each other by hostname rather than IP. In Settings > Networks, click on your LAN and find the Domain Name field under DHCP options. Enter something like home.lan or corp.internal. Avoid using real TLDs like .local (used by mDNS) or actual registered domains unless you have split-horizon DNS configured.
Once set, DHCP clients receive this domain name as their search domain. A device with the hostname fileserver becomes reachable as fileserver.home.lan from any other client on that network — as long as the UDM is acting as the DNS forwarder (i.e., the LAN IP is the DNS server for clients).
Step 4: Add Static DNS Entries (Local Records)
For servers, NAS devices, cameras, or any fixed-IP host you want to reach by name, you can add manual DNS entries directly in UniFi Network. Navigate to Settings > Networks, then look for DNS Records or use the older path Settings > Services > MDNS depending on your firmware version.
In newer UniFi Network 8.x firmware, static DNS records are managed under Settings > Networks > DNS Records. Click Add Record, choose the type (A, AAAA, CNAME), enter the hostname and value, and save. These records are served by the UDM's built-in dnsmasq instance to any client using the UDM as its resolver.
Step 5: Enable DNS Shield (DoH)
UniFi Network introduced DNS Shield in Network 7.x, which routes all client DNS queries through the UDM regardless of what DNS server clients are configured to use, then encrypts them using DNS-over-HTTPS (DoH). This prevents ISP snooping and blocks clients (including IoT devices) from bypassing your DNS controls.
To enable it, go to Settings > Security > DNS Shield. Toggle it on and select a provider: Cloudflare, Quad9, or AdGuard. Note that enabling DNS Shield overrides per-client DNS settings at the network level, so even if a device has manually set 8.8.8.8, its queries will be intercepted and handled by the UDM using your chosen DoH provider.
This feature is extremely useful for households with smart TVs and IoT gear that hardcode Google or Cloudflare DNS and would otherwise bypass any Pi-hole or local filtering you have set up.
Step 6: Integrating a Pi-hole or Internal Resolver
If you run a Pi-hole, AdGuard Home, or a recursive resolver like Unbound on your network, point the UDM's client DNS to that device's IP instead of a public resolver. In Settings > Networks > [Your LAN] > DHCP > Advanced, set DNS Server 1 to the Pi-hole's static IP (e.g., 192.168.1.10) and DNS Server 2 to a fallback like 1.1.1.1.
You also want to ensure the Pi-hole's upstream is not the UDM itself (circular forwarding). The Pi-hole should point upstream to Cloudflare, Quad9, or a recursive Unbound instance listening on localhost.
On the UDM side, disable DNS Shield if you are using Pi-hole, or the two systems will conflict — DoH interception will bypass your Pi-hole entirely.
Verifying Your DNS Configuration
After applying changes, verify from multiple angles. First, check the UDM itself via SSH. The default SSH credentials are your local admin username and password. SSH into the gateway at its LAN IP:
Once in, check the resolver the UDM is using:
You should see the WAN DNS servers you configured. Next, check what dnsmasq is configured to forward to:
To test resolution from the UDM itself:
From a client machine on the LAN, open a terminal and run:
The DNS Servers line in ipconfig output should show your intended resolver, not a random ISP IP. Use the DNS Lookup tool to confirm public DNS records resolve correctly if you are also managing a hosted domain.
Common Problems and Fixes
Clients Still Using Old DNS After Change
DHCP leases are cached. Force a renewal on Windows with ipconfig /release && ipconfig /renew, on macOS with sudo ipconfig set en0 DHCP, or simply disconnect and reconnect from Wi-Fi. The UDM itself does not need a reboot for DHCP changes to take effect on new leases.
Local Hostnames Not Resolving
This means either the UDM is not the client's DNS server, or the hostname was not registered in dnsmasq. Check two things: first, confirm the client's DNS server is the UDM LAN IP (not a public resolver). Second, ensure the client device has a static DHCP lease or a manual DNS record in the UniFi dashboard. Dynamic hostnames only register in dnsmasq when the client sends a DHCP request with its hostname option (option 12) set.
DNS Breaks After Firmware Update
Ubiquiti firmware updates occasionally reset custom dnsmasq configurations written directly to the filesystem. Never edit dnsmasq config files directly on the UDM unless you are willing to re-apply after every update. Use the UniFi Network UI for all DNS settings so the configuration is stored in the UniFi database and re-applied automatically after upgrades.
DNS Shield Blocking Internal Resolution
If you enable DNS Shield and then find local hostnames stop resolving, it is because Shield intercepts all DNS traffic including queries destined for your local resolver. Either disable DNS Shield or configure a split-DNS exemption. As of UniFi Network 8.x, there is no native split-horizon exemption for DNS Shield in the UI — the workaround is to use DNS Shield's built-in AdGuard provider and configure your internal records there, or disable Shield and use Pi-hole plus DoH upstream instead.
Recommended DNS Settings for Different Scenarios
- Home user wanting speed and privacy: WAN DNS = Cloudflare (1.1.1.1 / 1.0.0.1), enable DNS Shield with Cloudflare, leave DHCP DNS blank so UDM proxies for clients.
- Home user with Pi-hole: WAN DNS = Cloudflare, DHCP DNS = Pi-hole IP + Cloudflare fallback, DNS Shield off.
- Small business with internal services: WAN DNS = Quad9, set local domain name (corp.internal), add static DNS A records for servers, DHCP DNS = UDM LAN IP, DNS Shield off (conflicts with local resolution).
- Security-conscious setup: Enable DNS Shield with Quad9 (malware blocking), set firewall rules to block outbound UDP/TCP port 53 to all IPs except the UDM to prevent DNS bypass by clients.
Blocking DNS Bypass with Firewall Rules
Hardcoding DNS in client apps or smart TVs is a real problem. Block it at the firewall level. In Settings > Firewall & Security > Firewall Rules, create a LAN In rule:
- Action: Drop
- Protocol: TCP and UDP
- Destination Port: 53
- Destination: Address Group — any IP that is NOT your DNS server
This forces every device, regardless of its configuration, to use the DNS resolver you choose. Combined with DNS Shield or a Pi-hole, this gives you full control over name resolution on your network.
Summary
Proper DNS setup on the Ubiquiti Dream Machine involves configuring WAN resolvers for the gateway itself, distributing the right DNS servers to clients via DHCP on each network, optionally enabling DNS Shield for encrypted forwarding, and adding static records for internal services. The most important thing is not to assume that setting WAN DNS is enough — verify what your clients are actually using with nslookup or dig, and use firewall rules to enforce DNS policy on devices you cannot control directly.