How to Change DNS Settings in Windows 10 and Windows 11

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

Quick answer: On Windows 11, open Settings → Network & internet, select your Wi‑Fi or Ethernet connection, edit the DNS server assignment, and enter the new preferred and alternate DNS addresses. On Windows 10, the most dependable method is Control Panel → Network and Internet → Network and Sharing Center → Change adapter settings → adapter Properties → Internet Protocol Version 4 (TCP/IPv4) → Properties.

Change only the DNS fields. Leave the IP address, subnet mask, and default gateway on automatic unless you deliberately need a static IP configuration. After saving, verify the active adapter with ipconfig /all and test name resolution with nslookup. If the change causes problems, return DNS to Automatic or Obtain DNS server address automatically.

What changes when you change DNS?

DNS, or the Domain Name System, translates names such as example.com into IP addresses that computers use to connect to websites and services. Normally, your router supplies DNS server addresses to Windows through DHCP along with the computer’s IP address, subnet mask, and default gateway.

When you manually enter DNS addresses for a Windows network adapter, those DNS addresses override the DNS addresses supplied by DHCP on that adapter. This changes which resolver Windows asks to look up domain names. It does not change your Internet connection speed or increase the bandwidth provided by your ISP. A different resolver may improve lookup reliability, lookup latency, filtering, or access to a particular resolver’s answers, but performance varies by location and network.

For ordinary home networking, Microsoft recommends leaving IP configuration on Automatic (DHCP). A DNS-only change should not require entering a new IP address, subnet mask, or gateway.

First decide where DNS should change

The right location depends on the scope you want:

Where you change DNS	Who it affects	Use it when
Windows adapter	That computer and selected adapter	You want to test a resolver on one PC or laptop. Wi‑Fi and Ethernet settings may need to be configured separately.
Home router	Usually every device using that router	You want phones, televisions, consoles, and computers to use the same resolver. The router may still impose its own DNS behavior.
Web browser	That browser only	You want browser lookups to use DNS over HTTPS independently of Windows. Edge and Chrome can use their own secure-DNS settings.
VPN	Connections using the VPN	The VPN provider or company deliberately supplies DNS, including split-DNS rules for private domains.

A Windows DNS change normally affects applications that use the Windows DNS client. It does not necessarily control a browser configured to use its own encrypted DNS provider, and it may not control DNS while a VPN or virtual network adapter is active.

Before changing anything

1. Record the existing configuration. Open Command Prompt and run:

ipconfig /all

Note the active adapter—usually Wi‑Fi or Ethernet—and its current DNS server addresses. The command also shows the adapter’s IP address, gateway, and IPv4 and IPv6 information. Microsoft documents the command and its switches in the ipconfig reference.

PowerShell provides a more focused view of DNS addresses:

Get-DnsClientServerAddress

Do not replace the DNS server on a company, school, or Active Directory computer without approval. Internal DNS may be required for private hostnames, domain discovery, VPN name resolution, security policies, and access to internal services.

Also check whether a VPN is connected. A VPN may add a virtual adapter and route DNS through the VPN rather than through the physical Wi‑Fi or Ethernet adapter.

Choose a DNS provider

Public DNS providers are examples, not a universal speed ranking. Choose based on reliability from your location, privacy policy, filtering behavior, IPv6 support, DNS over HTTPS support, and compatibility with your network. The provider receives the DNS queries sent to it, even when those queries are encrypted with DNS over HTTPS.

Provider or service	IPv4 addresses	IPv6 addresses	Behavior and related information
Google Public DNS	8.8.8.8 8.8.4.4	2001:4860:4860::8888 2001:4860:4860::8844	General-purpose public resolver. Google documents separate IPv4 and IPv6 addresses.
Cloudflare standard	1.1.1.1 1.0.0.1	2606:4700:4700::1111 2606:4700:4700::1001	Standard resolver. DoH endpoint: https://cloudflare-dns.com/dns-query.
Cloudflare malware blocking	1.1.1.2 1.0.0.2	2606:4700:4700::1112 2606:4700:4700::1002	Blocks domains classified as malware by the service.
Cloudflare malware and adult-content blocking	1.1.1.3 1.0.0.3	2606:4700:4700::1113 2606:4700:4700::1003	Adds adult-content filtering to malware blocking.
Quad9 secure	9.9.9.9 149.112.112.112	2620:fe::fe 2620:fe::9	Malware blocking and DNSSEC validation. DoH endpoint: https://dns.quad9.net/dns-query.

Use two addresses from the same provider when you want consistent filtering and policy. Mixing providers is technically possible, but the two services may return different answers or apply different blocking rules. The preferred and alternate fields are multiple resolver addresses managed by the Windows DNS client; do not assume Windows always uses the first address exclusively or switches only after a fixed number of failures.

Change DNS in Windows 11 using Settings

Windows 11 exposes DNS controls in the Settings app. Labels and placement can vary between Windows builds, connection types, and managed devices. The current Microsoft path is:

1. Open Start → Settings → Network & internet.
2. For Wi‑Fi, select Wi‑Fi, then select the connected network or open Manage known networks and choose the network. For a wired connection, select Ethernet, then select the connected Ethernet network.
3. Find IP assignment or DNS server assignment, depending on the Windows build, and select Edit.
4. If the editor offers a choice, select Manual.
5. Turn on IPv4.
6. Enter the first resolver address in Preferred DNS and the second in Alternate DNS. For example, Cloudflare standard DNS uses 1.1.1.1 and 1.0.0.1.
7. Leave IP addressing on Automatic (DHCP) when that option is available.
8. Select Save.

Do not accidentally configure a static IP

Some Windows 11 builds place IP address, subnet mask, gateway, and DNS fields in one manual editor. If the page asks you to supply an IP address, subnet prefix or mask, and gateway when you only intend to change DNS, stop and use the Control Panel adapter method below. Do not invent values for those fields. An incorrect static IP configuration can disconnect the computer even when the DNS addresses are valid.

If Windows does apply the change but applications still use the old result, disconnect and reconnect Wi‑Fi or Ethernet, restart the affected application, or flush the local DNS cache.

Change DNS in Windows 10 using Control Panel

The classic adapter-properties method is the dependable universal route for Windows 10 and remains useful on Windows 11 when the Settings interface differs from these instructions.

1. Press Windows + R.
2. Enter ncpa.cpl and press Enter. This opens Network Connections directly.
3. Right-click the active Wi‑Fi or Ethernet adapter and select Properties.
4. Select Internet Protocol Version 4 (TCP/IPv4), then select Properties.
5. Keep Obtain an IP address automatically selected unless you intentionally use a static IPv4 configuration.
6. Select Use the following DNS server addresses.
7. Enter the preferred and alternate IPv4 DNS addresses.
8. Select OK, then Close.

For example, to use Google Public DNS, enter 8.8.8.8 as Preferred DNS and 8.8.4.4 as Alternate DNS. To use Cloudflare standard DNS, enter 1.1.1.1 and 1.0.0.1.

If Windows does not apply the change immediately, disconnect and reconnect the adapter. The official Google Public DNS Windows instructions document this adapter-properties route and recommend recording the old addresses before changing them.

Configure IPv6 when appropriate

IPv4 and IPv6 have separate DNS settings. If your network has working IPv6 and you change only IPv4, Windows may still use the IPv6 DNS addresses supplied by the router or ISP. That can make testing confusing and can mean that not every lookup uses the resolver you intended.

If the chosen provider supplies IPv6 addresses and your network uses IPv6:

1. Return to the adapter’s Properties window.
2. Select Internet Protocol Version 6 (TCP/IPv6), then select Properties.
3. Leave IPv6 address configuration automatic unless a static IPv6 setup is intentional.
4. Select Use the following DNS server addresses.
5. Enter the provider’s two IPv6 DNS addresses.
6. Select OK, then close the remaining dialogs.

For example, Google’s IPv6 addresses are 2001:4860:4860::8888 and 2001:4860:4860::8844. Cloudflare’s standard IPv6 addresses are 2606:4700:4700::1111 and 2606:4700:4700::1001.

Universal Control Panel path for Windows 10 and 11

If you prefer the older interface or cannot find the required Windows 11 Settings control, use this path:

Control Panel → Network and Internet → Network and Sharing Center → Change adapter settings → right-click Wi‑Fi or Ethernet → Properties → Internet Protocol Version 4 (TCP/IPv4) → Properties

Choose either Obtain DNS server address automatically or Use the following DNS server addresses. Repeat the process for Internet Protocol Version 6 (TCP/IPv6) when appropriate. This changes DNS for the selected adapter only, so configure both Wi‑Fi and Ethernet if you regularly use both.

Change DNS with PowerShell

PowerShell is useful for scripting or for systems where the graphical controls are difficult to locate. Open PowerShell as Administrator before changing adapter settings.

Identify the interface

Start by finding the active interface name and its addressing information:

Get-NetIPConfiguration

To list DNS addresses associated with interfaces, run:

Get-DnsClientServerAddress

Common interface aliases are Wi-Fi and Ethernet, but use the exact alias shown on your computer.

Set DNS on Wi‑Fi or Ethernet

This example sets Cloudflare standard IPv4 DNS on the Wi‑Fi interface:

Set-DnsClientServerAddress -InterfaceAlias "Wi-Fi" -ServerAddresses ("1.1.1.1","1.0.0.1")

For Ethernet:

Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses ("1.1.1.1","1.0.0.1")

The cmdlet statically assigns DNS addresses to the selected interface and overrides DHCP-provided DNS for that interface. If you use IPv6, configure the provider’s IPv6 addresses through the adapter Properties window or a command designed for the appropriate address family, then verify the result.

Return an interface to DHCP-provided DNS

For Wi‑Fi:

Set-DnsClientServerAddress -InterfaceAlias "Wi-Fi" -ResetServerAddresses

For Ethernet, replace the alias:

Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ResetServerAddresses

To reset every Windows DNS client interface:

Get-DnsClient | Set-DnsClientServerAddress -ResetServerAddresses

Use the all-interface command carefully because it can also affect adapters added by VPNs, virtualization software, or other network products. Microsoft documents the reset behavior in the Set-DnsClientServerAddress documentation.

Use netsh for scripting

The built-in netsh dnsclient command can set, add, display, and reset DNS client settings on Windows 10 and Windows 11.

Set a primary static DNS server on Wi‑Fi:

netsh dnsclient set dnsserver name="Wi-Fi" source=static address=1.1.1.1 register=primary validate=yes

Add a secondary server:

netsh dnsclient add dnsserver name="Wi-Fi" address=1.0.0.1 index=2 validate=yes

Return Wi‑Fi to DNS supplied by DHCP:

netsh dnsclient set dnsserver name="Wi-Fi" source=dhcp

Display global DNS client settings:

netsh dnsclient show global

Use the exact interface name reported by Windows. The Microsoft netsh dnsclient reference also documents encrypted-DNS-related settings.

Enable DNS over HTTPS in Windows 11

DNS over HTTPS, or DoH, encrypts DNS traffic between Windows and a compatible DNS resolver over HTTPS. It protects the DNS portion of the connection in transit, but it is not a VPN and does not encrypt all Internet traffic. The selected resolver can still see the DNS queries it receives.

After entering DNS addresses in the Windows 11 DNS editor, look for the DNS encryption or DNS over HTTPS setting. Depending on the Windows build, the choices may be labelled similarly to these:

• Off: DNS queries use ordinary unencrypted DNS.
• On (automatic template): Windows attempts to use the provider’s recognized or default DoH template.
• On (manual template): You enter the provider’s DoH URL yourself.

For a normal home configuration, automatic template mode is easier when Windows recognizes the selected provider. For manual mode, examples from the provider documentation include:

• Cloudflare: https://cloudflare-dns.com/dns-query
• Quad9: https://dns.quad9.net/dns-query

Windows may also show Fallback to plaintext:

• Fallback on: Windows can use unencrypted DNS if encrypted resolution fails. This generally improves compatibility, but a failed DoH connection can silently result in plaintext DNS.
• Fallback off: Windows does not send the query as ordinary DNS if DoH fails. This avoids a silent downgrade but can prevent name resolution on networks that block or interfere with DoH.

Disabling fallback is a reasonable privacy-focused choice if you accept that some networks may stop resolving names. It can also interfere with captive Wi‑Fi portals that expect initial DNS or web traffic to be handled in a particular way. You may need to enable fallback temporarily, return DNS to Automatic, or complete the portal login before enforcing encrypted-only DNS.

Microsoft’s DNS encryption documentation explains the distinction between encrypted DNS transport and DNSSEC. DNSSEC validates the authenticity and integrity of signed DNS data; DoH encrypts the connection to the resolver. They are complementary, not interchangeable.

Windows 10 does not provide this native DNS over HTTPS control in its built-in network Settings. That does not mean encrypted DNS is impossible on Windows 10: a browser or third-party application may provide its own DoH feature.

Verify that Windows is using the new DNS server

Check the configured addresses

Open Command Prompt and run:

ipconfig /all

Find the active Wi‑Fi or Ethernet section and look at DNS Servers. Confirm that the intended addresses appear there. In PowerShell, check a specific interface:

Get-DnsClientServerAddress -InterfaceAlias "Wi-Fi"

If the old addresses remain, you may have edited the wrong adapter, changed only IPv4 while checking IPv6, or been overridden by a VPN, security product, router policy, or device-management policy.

Test Windows’ normal resolver

Run:

nslookup example.com

Because no server is specified, nslookup uses the default DNS server selected by the system. Its output identifies the server it contacted and displays the returned address records.

PowerShell provides an equivalent test:

Resolve-DnsName example.com -DnsOnly

The -DnsOnly switch focuses the test on DNS rather than other Windows name-resolution mechanisms.

Test a particular resolver directly

To test Cloudflare directly, regardless of what Windows is configured to use:

nslookup example.com 1.1.1.1

PowerShell equivalent:

Resolve-DnsName example.com -Server 1.1.1.1 -DnsOnly

Comparing the default test with the direct-server test helps distinguish a problem with the selected resolver from a general network or DNS problem. A successful nslookup test does not prove that Edge, Chrome, a VPN, or another application is using that same resolver.

Clear the local DNS cache

If an application continues using a cached answer after the change, run:

ipconfig /flushdns

This clears Windows’ local DNS resolver cache. It does not change the configured DNS server. Restarting the browser may also be necessary because browsers can maintain their own caches or use their own encrypted-DNS settings.

Measure DNS lookup latency

To compare resolver response time from your own connection:

(Measure-Command { Resolve-DnsName -Name example.com -Server 1.1.1.1 -DnsOnly }).TotalMilliseconds

Run comparable tests against other resolvers, preferably several times and with more than one domain. A result under one second is considered acceptable in Microsoft’s DNS troubleshooting context, but it is not a universal performance guarantee. DNS latency is separate from download speed, streaming bandwidth, and general Internet performance.

Troubleshoot common problems

Changing DNS did nothing

First establish whether the problem is actually DNS:

ipconfig /all

ipconfig /flushdns

nslookup example.com

Common explanations include:

• The computer has no usable IP address, gateway, or Internet connection.
• You edited an inactive adapter instead of the adapter currently carrying traffic.
• IPv6 is still using a different DNS configuration.
• The browser or application is using its own secure DNS.
• A VPN or virtual adapter is handling DNS.
• A cached DNS result is still being used.
• A router, company policy, firewall, or security product is intercepting or overriding DNS.

Test the intended server directly with nslookup example.com 1.1.1.1. If the direct test works but the normal test fails, inspect the active adapter and any VPN or browser DNS settings.

Wi‑Fi is connected but there is no Internet

Changing DNS will not repair a failed Wi‑Fi association, missing DHCP response, bad gateway, or ISP outage. Run ipconfig /all and check whether the adapter has an IP address, default gateway, and DNS server.

An address beginning with 169.254., such as 169.254.x.x, usually means Windows could not obtain an IP address from the router when the network normally uses DHCP. That is primarily an IP/DHCP problem, not evidence that a public DNS change will fix the connection. Check the router, Wi‑Fi signal, cable, and DHCP service first. You can renew a DHCP lease with:

ipconfig /release

ipconfig /renew

DNS queries time out

Check the DNS addresses shown by ipconfig /all and test whether the server works from the current network. Ordinary DNS may require UDP or TCP port 53. Firewalls, endpoint-security software, public Wi‑Fi restrictions, and unreachable resolvers can cause timeouts.

If using DoH, the client must reach the provider’s HTTPS endpoint over TCP 443. Check the DoH template, security software, firewall, and network policy rather than simply entering a different IP address. Do not disable firewall protection permanently just to make DNS work.

Only some websites fail

Some sites failing can indicate a filtering policy, a stale or incorrect cached answer, a broken IPv6 path, DNSSEC validation differences, a browser-specific DNS setting, or a problem at the site itself. Compare:

nslookup affected-domain.example

nslookup affected-domain.example 1.1.1.1

Also test with IPv6 enabled and disabled only as a diagnostic step, check the browser’s secure-DNS setting, and inspect whether the hosts file or security software is overriding normal DNS behavior. A filtered resolver may intentionally refuse or redirect certain domains; switching to an unfiltered resolver changes that policy rather than proving the original resolver was broken.

A captive Wi‑Fi portal does not appear

Hotels, airports, cafés, and other public networks may require a browser login before normal Internet access is available. Strict DoH can interfere with some portal-detection or interception methods. Try one of these practical workarounds:

1. Temporarily return DNS to Automatic or DHCP-provided DNS.
2. Enable Fallback to plaintext temporarily.
3. Complete the captive-portal login before enforcing encrypted-only DNS.

After authentication, restore the intended DNS and DoH settings if the network permits them.

A VPN is connected

VPN software may deliberately route all DNS through the VPN provider or organization. It may also use split tunneling, where private company names go to an internal resolver and public names use another path. Test with the VPN connected and disconnected, and inspect the VPN application’s DNS and split-tunneling options.

Do not assume the physical Wi‑Fi adapter shown in Control Panel is the adapter actually handling DNS. Changing its DNS may have no effect while the VPN is active, or may conflict with the VPN’s intended leak-prevention and private-name-resolution behavior.

It is a work, school, or Active Directory computer

Public DNS can break internal hostnames, domain operations, VPN name resolution, enterprise filtering, or private DNS zones. Active Directory environments depend heavily on correctly configured internal DNS for locating domain services. Windows can also apply organization-specific DNS rules through policies such as the Name Resolution Policy Table.

On a managed computer, use the DNS servers provided by the administrator unless you have explicit permission to change them. If you need to troubleshoot public DNS, ask the administrator whether the organization supports that configuration.

Edge or Chrome uses another DNS resolver

Modern browsers can use DNS over HTTPS independently of Windows.

• Microsoft Edge: Open Settings → Privacy, search, and services → Security → Use secure DNS. Edge supports off, automatic, and secure modes, and an organization policy can control the setting. See Microsoft’s Edge Secure DNS documentation.
• Google Chrome: Open Settings → Privacy and security → Security → Use secure DNS. Chrome can use automatic mode or a custom provider. Managed devices and parental-control configurations may disable the feature. See Google’s Chrome Secure DNS documentation.

If browser lookups do not match Windows tests, compare these settings before concluding that Windows ignored the DNS change. Windows DNS, browser DoH, VPN DNS, and router DNS are separate layers.

Windows Settings does not match these instructions

Windows 11 labels and page placement vary by build. You may see a separate DNS server assignment control, or DNS may be inside the combined IP assignment editor. Wi‑Fi and Ethernet pages also differ. Device-management policies can hide or lock controls.

If the Settings page asks for an IP address, subnet mask, and gateway when you only want to change DNS, use ncpa.cpl and the adapter Properties method. That avoids accidentally converting a DHCP connection into an incorrectly configured static-IP connection.

Use Network reset only as a last resort

Network reset is not a normal DNS rollback. Microsoft recommends it only after other troubleshooting steps because it removes installed network adapters and their settings, then reinstalls the adapters after a restart. VPN software, Hyper‑V virtual switches, and other virtual networking components may need to be reinstalled or configured again.

• Windows 11: Settings → Network & internet → Advanced network settings → Network reset
• Windows 10: Settings → Network & Internet → Status → Network reset

Record current settings first and understand the consequences before using it. See Microsoft’s Wi‑Fi and network troubleshooting guidance.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Restore automatic DNS

Graphical rollback

Return to the same DNS editor used to make the change:

• In Windows 11 Settings, select Automatic (DHCP) where available, or edit the DNS server assignment and choose automatic DNS.
• In the adapter Properties window, select Obtain DNS server address automatically for IPv4 and, when configured, IPv6.

This restores DNS addresses supplied by the router or access point. It does not necessarily restore a manually configured IP address, so confirm that IP addressing is also set to automatic if that was the original configuration.

PowerShell rollback

Set-DnsClientServerAddress -InterfaceAlias "Wi-Fi" -ResetServerAddresses

Replace Wi-Fi with Ethernet or the exact interface alias. After rollback, clear cached results and renew DHCP:

ipconfig /flushdns

ipconfig /renew

If the computer has several adapters, verify each one with Get-DnsClientServerAddress. Microsoft lists /release, /renew, and /flushdns among the standard Windows connection troubleshooting commands.

Frequently asked questions

Frequently Asked Questions

Does changing DNS make the Internet faster?

It does not increase ISP bandwidth. A different resolver can make domain lookups more reliable or faster from your location, but it can also be slower. Test resolver latency separately from download speed with tools such as Resolve-DnsName.

Should I change DNS on my router instead of Windows?

Change Windows DNS when you want to affect one computer or test a provider. Change the router when you want most devices on the home network to receive the same DNS configuration. A VPN, browser, router policy, or ISP may still override or intercept DNS.

Should I configure IPv4, IPv6, or both?

Configure both when your network uses IPv6 and the chosen provider supplies IPv6 resolvers. Changing only IPv4 can leave Windows using different IPv6 DNS servers. If you do not intentionally use a provider’s IPv6 DNS, leave IPv6 address and DNS configuration automatic rather than entering incomplete values.

Can I mix Google and Cloudflare DNS addresses?

You can, but using two addresses from the same provider is usually more predictable. Different providers can return different answers or apply different malware, adult-content, or other filtering policies.

What is the difference between DNS over HTTPS and DNSSEC?

DNS over HTTPS encrypts DNS traffic between the client and resolver. DNSSEC validates the authenticity and integrity of signed DNS data. They solve different problems and can be used together.

Why is the DNS over HTTPS option missing?

The native DoH control is available in Windows 11 but not in the Windows 10 built-in Settings interface. On Windows 10, Edge, Chrome, or third-party software may provide separate encrypted-DNS features. Windows 11 builds and device policies can also place, rename, or restrict the setting.

Why did changing DNS break my company VPN?

The VPN or organization may require internal DNS for private hostnames, domain discovery, split DNS, or security rules. Restore the administrator-provided DNS and ask the IT department before changing it again.

Does ipconfig /flushdns change the DNS server?

No. It clears cached DNS records maintained by Windows. It does not change DNS addresses. Use ipconfig /all or Get-DnsClientServerAddress to inspect the configured servers.

Why does Windows still show the old DNS server?

You may have edited the wrong adapter, checked IPv4 while IPv6 remains unchanged, or been overridden by a VPN, browser, router, security product, or organization policy. Check the active adapter with ipconfig /all and test the normal resolver with nslookup example.com.

Does changing Windows DNS affect Chrome or Edge?

It affects software using the Windows DNS client, but Chrome and Edge can use their own Secure DNS or DoH settings. Check each browser’s security settings, and remember that a VPN can supersede both.

The Bottom Line

Bottom line: Use the Windows 11 DNS editor when it exposes DNS separately, or use the classic adapter Properties method on either Windows version. Change only DNS, configure IPv6 when appropriate, verify with ipconfig and nslookup, and return to Automatic/DHCP if the change affects VPNs, captive portals, internal networks, or connectivity.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.