How do I change the DNS server on a UniFi Dream Machine?

To change the DNS servers pushed to your devices, open the UniFi Network application, navigate to Settings → Networks, edit your LAN, scroll to the DHCP section, set DHCP Name Server to Manual, and enter your preferred DNS IPs. After saving, renew DHCP leases on your clients to pick up the new addresses. If you also want the Dream Machine itself to query a different upstream resolver, make a second change under Settings → Internet → [your WAN connection] → DNS Server.

Two separate DNS settings you need to know about

The most common source of confusion is that a UniFi Dream Machine maintains two independent DNS configurations that serve entirely different purposes. Changing one without the other produces partial results and inconsistent behaviour across your network.

DHCP DNS — what your devices get

This is the DNS server address handed to every device on your network as part of its DHCP lease. When a laptop, phone, or smart TV connects and requests an IP address, the UDM responds with an IP, a default gateway, and a list of DNS servers. The DHCP DNS setting is what populates that list. If your goal is to have all devices use a specific resolver — a public one like Cloudflare, or a local one like Pi-hole — this is the setting to change.

WAN / upstream DNS — what the UDM uses itself

The Dream Machine also performs DNS lookups for its own traffic: firmware update checks, remote management connections, and internal service resolution. By default it inherits whatever DNS your ISP assigns on the WAN interface via DHCP. If you want the gateway itself to resolve through a specific server — for consistency, reliability, or because your ISP resolver hijacks NXDOMAIN responses with ad pages — change the WAN DNS setting separately. This does not affect what DNS addresses your devices receive via DHCP; it only controls what the UDM uses for its own outbound queries.

Why change the DNS on your Dream Machine?

The default ISP-assigned resolver is the weakest link for most home and small-business networks. Common reasons to replace it:

• ISP resolver speed or reliability. ISP DNS servers are frequently slower than purpose-built public resolvers and may drop queries under load. Switching to 1.1.1.1 or 8.8.8.8 eliminates this bottleneck for every device on the network simultaneously.
• DNS hijacking. Many ISPs redirect NXDOMAIN responses — domains that do not exist — to their own search or advertising pages instead of returning a proper error. This breaks some software and automated tools. A non-hijacking resolver fixes it entirely.
• Ad and tracker blocking at the network level. Running Pi-hole or AdGuard Home on a local server and pointing DHCP DNS to its LAN IP blocks ads and trackers for every device — including smart TVs, game consoles, and IoT devices that cannot run browser extensions.
• Parental controls and malware filtering. Resolvers like Quad9 (9.9.9.9) block known malicious domains by default. Cloudflare's 1.1.1.3 filters adult content. Point your DHCP DNS to either and all devices on that network are covered without per-device configuration.
• Privacy. ISP DNS servers log every query and may sell the data. Cloudflare's 1.1.1.1 and Quad9 both publish explicit no-logging or privacy-limited policies.
• Internal split-horizon DNS. If you run a site-to-site VPN or have internal hostnames that only resolve on a private DNS server, you need to point clients to that server. The DHCP DNS setting on each VLAN is how you do this per-segment on a UDM.

Step-by-step: change DHCP DNS on the UDM

These steps apply to the UniFi Dream Machine, UDM-Pro, UDM-SE, UDM-Pro Max, and Dream Router running UniFi Network 7.x or 8.x. Exact label names shift slightly between major firmware versions; if a label below does not appear verbatim, look for a field named DNS Server within the DHCP section of your network configuration.

1. Open a browser and navigate to https://192.168.1.1 (or your gateway IP if you changed it). Log in with your local UniFi OS credentials.
2. In the left-hand sidebar of UniFi OS, click the Network application icon to enter UniFi Network.
3. Inside the Network app, click the Settings gear icon, typically located at the bottom-left of the sidebar.
4. Select Networks from the settings menu on the left.
5. Click the LAN network you want to update — usually called Default unless you have renamed it.
6. Scroll to the DHCP section and locate the DHCP Name Server field.
7. Change the dropdown from Auto to Manual.
8. Enter your primary and secondary DNS IPs. Well-known choices:
   • Cloudflare (fast, privacy-focused): 1.1.1.1 and 1.0.0.1
   • Google Public DNS: 8.8.8.8 and 8.8.4.4
   • Quad9 (malware-blocking): 9.9.9.9 and 149.112.112.112
   • Local Pi-hole or AdGuard Home: the server's static LAN IP, for example 192.168.1.5
9. Click Save.

The setting takes effect immediately for all new DHCP leases. Existing devices continue using the old DNS until their current lease expires (typically 24 hours by default) or you force a renewal manually — steps for each platform are in the section below.

Step-by-step: change WAN upstream DNS on the UDM

1. In the UniFi Network app, go to Settings → Internet.
2. Click your active WAN connection — usually labelled Primary or named after your ISP connection type.
3. Scroll to the DNS Server field. In some firmware versions this is nested under an Advanced or Manual toggle — expand it if the field is not immediately visible.
4. Switch from Auto to Manual and enter your DNS IPs.
5. Click Save. The UDM begins using the new resolver for its own queries immediately; no client-side lease renewal is required for this change.

Multiple VLANs and wireless networks

Each VLAN defined in UniFi Network has its own independent DHCP configuration, including its own DHCP Name Server setting. If you run an IoT VLAN, a guest SSID, or a separate corporate network, return to Settings → Networks after updating your primary LAN and repeat the DNS change for every network whose clients should use the new resolver. The guest portal network is also separate and has its own DHCP settings. A common oversight is updating the main LAN and leaving the IoT VLAN on the ISP's resolver, which then bypasses any Pi-hole filtering you intended to apply network-wide.

Force DHCP lease renewal on client devices

After saving the DHCP DNS change, devices holding active leases will not pick up the update until those leases expire or are renewed. Here is how to force an immediate renewal on each platform:

Windows

Run these three commands in sequence in an elevated Command Prompt (right-click → Run as Administrator). Verify the new DNS server is active:

macOS

Replace en0 with your active interface name. Run networksetup -listallhardwareports to match Hardware Port names to interface identifiers. Verify the result:

Linux (systemd-based)

On NetworkManager-based systems, restart the interface by name:

iOS

Go to Settings → Wi-Fi, tap the (i) next to your network name, then tap Renew Lease. The device obtains a fresh DHCP lease that includes the updated DNS server addresses.

Android

Toggle Wi-Fi off and back on. Alternatively, go to Settings → Network & Internet → Wi-Fi, long-press your network name, choose Modify network, confirm IP settings is set to DHCP, and save. Menu paths vary significantly by Android version and device manufacturer.

Verify the DNS change worked

Do not rely on the settings panel alone — confirm that queries are actually being served by the new resolver. The DNS Lookup tool lets you query a domain from multiple global vantage points, but local CLI tools tell you exactly what your specific machine is using right now.

dig

The first command uses your system's active resolver. Run it without +short to see the server address printed in the header line. The second command queries 1.1.1.1 directly, bypassing the system resolver. If both return the same IPs and the first resolves quickly, the change is working. A slow first query combined with a fast second query indicates the system is still pointing at the old resolver — flush and retry.

nslookup

The first command prints the server it used at the top of the output block. Confirm it shows your new DNS IP rather than an ISP-assigned address in the 10.x, 172.x, or your ISP's public range.

SSH into the UDM and inspect dnsmasq

The Dream Machine uses dnsmasq as its internal DNS forwarder. You can confirm its upstream configuration by logging in over SSH:

The server= lines list the upstream resolvers dnsmasq is forwarding queries to. If your updated IPs appear here, the WAN DNS change is active. The exact config file location can vary by firmware version; list the directory first to confirm the correct filenames on your build:

IPv6 DNS and encrypted DNS in 2026

Browser DNS over HTTPS (DoH). Chrome, Firefox, and Edge all support encrypted DNS that bypasses the system resolver entirely. A browser using its own DoH will query a hardcoded public resolver directly, ignoring whatever DNS server the UDM hands out via DHCP. This makes it look like your change has not taken effect inside those browsers. To check in Chrome, navigate to chrome://settings/security and review the Use secure DNS setting. Disabling it forces the browser to use the system resolver your UDM provides. For network-wide enforcement, some UniFi firmware versions support firewall rules that intercept outbound port-853 traffic (DNS over TLS), preventing clients from bypassing your configured resolver entirely.

IPv6 DNS. If IPv6 is active on your network, devices receive a separate DNS server address via DHCPv6 or Router Advertisements. A device with a valid IPv6 DNS will use it even if the IPv4 DHCP DNS has been updated, effectively bypassing your change. In UniFi Network, the IPv6 DNS setting is in the same Networks panel under the IPv6 subsection of your LAN configuration. On Linux, run resolvectl status to list all active resolvers for each interface — both IPv4 and IPv6 — and confirm both point to your intended server.

The base DNS protocol is defined in IETF RFC 1035. For a practical overview of how modern resolvers work, Cloudflare maintains a clear reference at their DNS learning center.

Common misdiagnoses

Content Filtering overrides DHCP DNS

UniFi Network includes a Content Filtering feature — labelled under Traffic Management or Threat Management depending on firmware version — that intercepts DNS queries and routes them through Ubiquiti's own filtering infrastructure. When this feature is enabled, it silently overrides the DNS servers you configure in the DHCP Name Server field. Navigate to Settings → Security and look for a Content Filtering or Traffic Management toggle. Disabling it restores your custom DHCP DNS setting immediately.

A firewall rule is redirecting port 53

If you previously configured DNS interception — common in Pi-hole deployments — a firewall rule on the UDM may be capturing all port-53 traffic from LAN devices and redirecting it to a specific server regardless of what each client thinks its DNS is. Check Settings → Firewall & Security → Firewall Rules for any rules matching destination port 53. A redirect rule pointing to a Pi-hole IP takes precedence over both the DHCP DNS setting and any manually configured DNS on any client device.

VPN client pushing its own DNS

If a WireGuard or OpenVPN client running on the UDM routes all traffic through a VPN tunnel, the VPN server may push a DNS configuration that overrides the WAN DNS setting. Check the VPN client configuration for a DNS Server override field and clear it to defer to your manually configured WAN DNS instead.

Changed WAN DNS but not DHCP DNS

WAN DNS only controls what the gateway itself resolves. Devices on your LAN do not use the WAN DNS setting — they use whatever address the DHCP server hands them in the lease. If devices are still hitting the ISP resolver after you saved a WAN DNS change, return to Settings → Networks → [LAN] → DHCP Name Server and update that field separately.

Lease not yet renewed

A device that received a 24-hour lease before you changed the DNS setting will continue using the old server until that lease expires. If a specific device still shows the wrong DNS server after you save the network change, force a lease renewal on that device using the platform steps above — do not assume the change failed just because one device has not picked it up yet.

Preventing DNS drift

• Always fill both primary and secondary DNS fields. A single-entry configuration means that if the primary becomes unreachable, devices fall back silently to whatever the OS chooses — often the ISP resolver.
• Document your DNS IPs. After a factory reset or major firmware upgrade, DNS settings revert to Auto. Keep a note of your chosen resolvers so you can restore them in under a minute.
• Verify after firmware upgrades. UniFi generally preserves network settings across minor version bumps, but major version upgrades have historically reset some advanced configurations. Run ipconfig /all or scutil --dns on a client device to spot-check after any significant update.
• Set DNS explicitly on every new VLAN. New networks created in UniFi default to Auto for DHCP Name Server. Make it a habit to set your DNS preference on every network at creation time, not as an afterthought.