By default your device uses the DNS server your internet provider gives it, which means your provider sees every site name you look up. Switching to a different DNS service can add encryption, speed and fewer blocks, but it moves trust to another company. Pick deliberately.
Popular public DNS services
| Provider | IPv4 addresses | Private DNS / DoH hostname |
|---|---|---|
| Cloudflare | 1.1.1.1 and 1.0.0.1 | one.one.one.one |
| Google Public DNS | 8.8.8.8 and 8.8.4.4 | dns.google |
| Quad9 (blocks known malicious domains) | 9.9.9.9 and 149.112.112.112 | dns.quad9.net |
All three publish privacy policies and support encrypted DNS. Read them, since policies change.
Windows 11
- Open Settings → Network & internet, choose Wi-Fi or Ethernet, then your network's Properties.
- Next to DNS server assignment, choose Edit → Manual and turn on IPv4.
- Enter a preferred and alternate address from the table, and set DNS over HTTPS to On (automatic template) if it is offered.
macOS
Open System Settings → Network, select your connection, click Details → DNS, and use the + button to add the addresses. Remove old entries you do not want.
Android (9 and later)
Open Settings → Network & internet → Private DNS, choose Private DNS provider hostname and enter a hostname such as one.one.one.one, dns.google or dns.quad9.net. This encrypts DNS for the whole phone on every network. Menu names vary a little between manufacturers.
iPhone and iPad
Open Settings → Wi-Fi, tap the (i) beside your network, choose Configure DNS → Manual, remove existing servers and add the new ones. This applies per Wi-Fi network. For encrypted DNS on all networks, use a DNS provider's configuration profile or app.
Your router
Changing the DNS server in your router's admin page, usually under WAN or Internet settings, applies to every device on your network. Some routers reset this when the provider reconnects, and some ISP-supplied routers do not let you change it.
Check it worked
Run the DNS leak test. It should show your chosen provider instead of your internet provider. If you also use a VPN, note that the VPN normally sets its own DNS. Overriding it with a public one is not a leak of your IP, but that provider will then see your lookups. See do VPNs leak DNS?
The trade-off
Encrypted DNS hides your lookups from your local network and provider. It does not hide the sites you connect to, because your provider still sees the destination IP addresses, and it does not make you anonymous.