DNS Settings on a Router

Updated 2026-10-09 • By Marcus Vance, CCNA (Senior Network Engineer)

Replacing slow, unencrypted ISP DNS resolvers on your router with high-performance public resolvers like Cloudflare (1.1.1.1), Quad9 (9.9.9.9), or Google (8.8.8.8) cuts domain lookup latency, prevents ISP NXDOMAIN hijacking, and blocks known phishing domains across every device on your LAN. To deploy custom DNS properly, you must understand the difference between WAN upstream forwarders, DHCP LAN option 6 announcements, and encrypted DNS-over-TLS (DoT).

1. WAN Upstream DNS vs. LAN DHCP Server DNS Explained

Consumer and prosumer routers expose DNS fields in two separate menus: under WAN / Internet Connection and under LAN / DHCP Server. Understanding how packets flow in each mode prevents local hostname resolution issues:

• WAN DNS Configuration (Recommended for Local Hostnames): When you enter custom DNS servers (like 1.1.1.1 and 9.9.9.9) under the WAN settings and leave LAN DHCP DNS blank, the router hands out its own LAN gateway IP (e.g., 192.168.1.1) to clients via DHCP Option 6. The router's internal dnsmasq or Unbound daemon caches responses in RAM, resolves local LAN hostnames (such as nas.local or printer.lan), and forwards external queries upstream.
• LAN DHCP DNS Configuration: Entering public DNS IPs directly in the LAN DHCP Server fields instructs every phone and laptop to query 1.1.1.1 or 8.8.8.8 directly, bypassing the router's DNS proxy. This reduces router CPU load on older hardware but breaks local LAN hostname resolution unless mDNS/Bonjour is used.

2. Choosing Between Cloudflare 1.1.1.1, Quad9 9.9.9.9, and Google 8.8.8.8

Not all public anycast DNS providers optimize for the same goal. Choosing the right upstream resolver depends on whether your home office prioritizes raw millisecond lookup speed, automatic threat blocking, or EDNS Client Subnet (ECS) CDN proximity:

• Cloudflare (1.1.1.1 / 1.0.0.1): Consistently delivers the lowest global query latency (typically 8–14 ms in major USA metros) and strict privacy policies. Its security variant, 1.1.1.2, blocks malware and phishing domains at the DNS layer.
• Quad9 (9.9.9.9 / 149.112.112.112): Operated by the non-profit Quad9 Foundation with threat intelligence feeds from 20+ security providers. Quad9 automatically drops lookups for known command-and-control (C2) servers, ransomware hosts, and phishing kits while validating DNSSEC signatures.
• Google Public DNS (8.8.8.8 / 8.8.4.4): Supports EDNS Client Subnet (ECS), passing a truncated prefix of your IP to Akamai, CloudFront, and Fastly CDNs so video streams and large software downloads route to the closest geographic edge node.

3. Enabling Encrypted DNS (DNS-over-TLS and DNS-over-HTTPS)

Standard UDP/TCP port 53 DNS queries travel across your ISP's last-mile network in cleartext, allowing transparent DNS proxies to log every domain you visit or intercept queries. If your router runs ASUSWRT, Synology SRM, UniFi OS, OpenWrt, or GL.iNet firmware, enable DNS-over-TLS (DoT, TCP Port 853) or DNS-over-HTTPS (DoH, TCP Port 443):

• On ASUS Routers: Go to WAN → Internet Connection, set Connect to DNS Server automatically to No, enable DNS Privacy Protocol → DNS-over-TLS (DoT), select Strict profile mode, and add 1.1.1.1 with TLS hostname cloudflare-dns.com (or 9.9.9.9 with dns.quad9.net).
• On Ubiquiti UniFi / GL.iNet: Enable DNS Shield or Encrypted DNS in the Network Security settings and select Cloudflare or Quad9 from the pre-populated DoH/DoT stamp list.

Always choose Strict TLS verification so the router validates the upstream X.509 certificate against the TLS hostname before sending queries.

4. Preventing IPv6 DNS Bypass and Verifying with CLI Diagnostics

The most common mistake when configuring router DNS is changing IPv4 DNS while leaving IPv6 DNS set to Automatic. Dual-stack operating systems (Windows 11, macOS, iOS, and Android) frequently prefer IPv6 DNS resolvers advertised via Router Advertisements (RDNSS) over IPv4 DHCP DNS, silently sending all lookups back to Comcast, AT&T, or Verizon resolvers. Open your router's IPv6 tab and explicitly enter the matching IPv6 anycast addresses (such as 2606:4700:4700::1111 and 2606:4700:4700::1001) before saving.

To verify your new configuration, flush your computer's local DNS cache (ipconfig /flushdns on Windows or sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder on macOS). Then run nslookup -type=txt debug.opendns.com in Command Prompt or visit https://1.1.1.1/help in a browser to confirm which upstream resolver POP answered your query and verify that DoT or DoH encryption is active.

Public DNS Resolver Reference Table (IPv4, IPv6, and DoT/DoH)

Router DNS Configuration & Leak Test Checklist

1. Automatic ISP DNS disabled under WAN / Internet Connection settings.
2. Both Primary and Secondary IPv4 DNS addresses entered (either same provider or redundant pair).
3. Matching IPv6 DNS servers entered under the router's IPv6 configuration menu.
4. DNSSEC validation and DNS Rebinding Protection enabled in router advanced DNS settings.
5. DNS-over-TLS (DoT) or DNS-over-HTTPS (DoH) enabled with Strict TLS hostname verification.
6. Client OS DNS cache flushed and upstream resolver verified via 1.1.1.1/help or nslookup.

Frequently Asked Questions

Should I mix two different DNS providers as Primary and Secondary on my router?

Only mix providers if both share identical filtering policies—for example, pairing Cloudflare Standard (1.1.1.1) with Quad9 Unsecured (9.9.9.10) for pure uptime redundancy. Never mix a malware/family filtering DNS (like 1.1.1.3) with an unfiltered secondary (like 8.8.8.8), because client operating systems query both servers and will resolve blocked domains through the unfiltered secondary.

What is DNS Rebinding Protection and should I enable it on my router?

DNS Rebinding Protection drops external public domain responses that resolve to private RFC 1918 IP addresses (like 192.168.1.1 or 10.0.0.1). You should always enable it so malicious JavaScript in a web browser cannot hijack DNS lookups to attack your local router web GUI or NAS.

Why do Chrome or Firefox ignore my router's custom DNS settings?

Modern desktop browsers enable their own built-in Secure DNS (DNS-over-HTTPS) by default, which can bypass your router's local DNS cache or parental controls. If you rely on router-level DNS filtering, disable built-in Secure DNS inside browser privacy settings or block outbound DoH resolvers on the firewall.

Does changing router DNS increase my download bandwidth in Mbps?

Changing DNS does not raise your ISP's provisioned megabit-per-second throughput ceiling, but it significantly reduces Time to First Byte (TTFB) when opening web pages and apps. Additionally, resolvers with accurate geo-routing help CDNs serve files from closer regional servers.

Related Router Setup & Engineering Guides

• Parental Control Setup on a Router — Configure router parental controls that kids cannot bypass: set up Family DNS (1.1.1.3), defeat MAC address randomization, and create a Kid-Safe WiFi SSID.
• How to Fix WiFi Connected but No Internet — Solve 'WiFi Connected, No Internet' errors in 60 seconds using the 3-Ping isolation test to pinpoint LAN DHCP failures, WAN modem dropouts, or DNS outages.
• Pi-hole & AdGuard Home Router DNS Setup Guide — Configure your router for Pi-hole or AdGuard Home using LAN DHCP DNS, Conditional Forwarding, and Port 53 firewall redirects to block hardcoded Smart TV DNS.
• GL.iNet Travel Router Setup: Captive Portals & WireGuard — Set up your GL.iNet Beryl AX or Slate AX travel router at 192.168.8.1 to bypass hotel WiFi captive portals, clone MAC addresses, and lock on a WireGuard VPN.