How to check which DNS server you use, and change it

What a DNS resolver does

Before your browser can connect to a website, it needs the site’s IP address. It asks a recursive resolver, which looks the name up in the global DNS, keeps the answer for the time the record allows (its TTL) and returns it. The resolver therefore sees every name your device looks up, and it decides how fast and how reliably names resolve.

Changing the resolver does not change your public IP address, and it does not hide which sites you connect to from your internet provider. Encrypted DNS (DNS over HTTPS or DNS over TLS) only hides the lookups themselves on the way to the resolver.

Where the resolver is set, and which setting wins

When a device joins a network, the router normally assigns its DNS servers together with its local IP address. A manual setting in the operating system replaces the router’s choice for that device. A browser with secure DNS turned on can bypass the operating system for its own lookups, and a VPN app usually pushes its own resolver while it is connected.

• Router: one change affects every device that takes its settings automatically. Some provider routers do not allow it.
• Operating system: affects all apps on that device, unless a browser or VPN overrides it.
• Browser secure DNS: affects only that browser. Chrome, Edge and Firefox each have their own switch.
• VPN app: usually replaces the resolver while connected, so that lookups go through the tunnel.

Check the resolver your device is set to use

These commands show the configured resolver. Treat the result as the starting point: the next section shows how to see which resolver actually answers.

• Windows: run nslookup example.com in Command Prompt. The first two lines, Server and Address, name the default resolver. ipconfig /all lists the DNS Servers for every adapter.
• macOS: run scutil --dns and look at the nameserver lines of the first resolver, or open System Settings, Network, your connection, Details, DNS.
• Linux with systemd-resolved: run resolvectl status. A nameserver of 127.0.0.53 in /etc/resolv.conf is a local stub that forwards to the servers listed by resolvectl.
• iPhone and iPad: Settings, Wi-Fi, the ⓘ next to your network, Configure DNS. The setting is per Wi-Fi network and does not apply to mobile data.
• Android 9 or later: Settings, Network & internet, Private DNS. Automatic means the network’s resolver or opportunistic encryption; a hostname means that encrypted resolver is used on Wi-Fi and mobile data.

Confirm which resolver actually answers

Some names are built to reply with the address of whoever asked. Google’s authoritative servers answer a TXT query for o-o.myaddr.l.google.com with the address of the resolver that contacted them, and Akamai’s whoami.akamai.net does the same as an A record. Run nslookup -type=txt o-o.myaddr.l.google.com, then look the returned address up to see which organization it belongs to.

Large resolvers send their queries from outgoing addresses that differ from the address you configured, so expect a different number from the same provider, not the configured address itself. Cloudflare also offers a check page at one.one.one.one/help that reports whether you are using 1.1.1.1 and whether the connection is encrypted.

Observed example, 2 November 2026, on a Windows PC with home broadband in Bangkok: nslookup listed the default server as dnscon1.v6.trueinternet.co.th at 2001:fb0:100::207:29, the provider’s resolver. The TXT query returned 2001:fb0:100:dd::104, another address in the same provider’s network, which is the resolver’s outgoing address. The same query sent through Cloudflare’s DNS over HTTPS returned 172.68.44.76, an address on Cloudflare’s network. IPNixa recorded these values from a single run; your provider’s addresses will differ.

Change your DNS server

Pick the place that matches what you want to cover: the router for the whole home, the operating system for one device, the browser for one app. Enter both a primary and a secondary address from the same provider, and add the IPv6 addresses if your connection has IPv6, otherwise IPv6 lookups may still go to the old resolver.

1. Windows 11: Settings, Network & internet, Wi-Fi or Ethernet, Hardware properties, then Edit next to DNS server assignment. Choose Manual, turn on IPv4 and IPv6, enter the addresses and, where offered, set DNS over HTTPS to On.
2. macOS: System Settings, Network, your connection, Details, DNS. Add the new servers with the + button and remove the old ones, then click OK.
3. iPhone and iPad: Settings, Wi-Fi, ⓘ, Configure DNS, Manual. Delete the existing servers and add the new ones. Repeat for each Wi-Fi network you use.
4. Android: Settings, Network & internet, Private DNS, Private DNS provider hostname, then enter one.one.one.one, dns.google or dns.quad9.net.
5. Router: open its admin page, find the DHCP, LAN or internet DNS setting, enter the new addresses and save. Devices pick up the change when they reconnect or renew their address.
6. Browser: Chrome, Settings, Privacy and security, Security, Use secure DNS. Edge, Settings, Privacy, search and services, Use secure DNS. Firefox, Settings, Privacy & Security, DNS over HTTPS.

Why the change did not take effect

If the confirmation query still shows the old provider, work through the layers from the most specific to the least specific.

• A VPN is connected and supplies its own resolver. Check again with the VPN off, or change the DNS setting inside the VPN app.
• The browser uses secure DNS with its own provider, so the browser and the command line disagree. Both can be correct for their own lookups.
• Only IPv4 was changed. The device still receives an IPv6 resolver from the router and uses it for some queries.
• Cached answers are still being used. Run ipconfig /flushdns on Windows, sudo dscacheutil -flushcache followed by sudo killall -HUP mDNSResponder on macOS, and clear the browser’s host cache or restart the browser.
• The network intercepts DNS. Some routers, public Wi-Fi networks and providers redirect all port 53 traffic to their own resolver; encrypted DNS avoids this, plain DNS does not.
• The router change has not reached the device yet. Reconnect to the network or restart the device to receive the new settings.

Checking a domain after changing a record

Changing your own resolver and changing a domain’s records are different tasks. If you edited a record at your DNS host and the old value still appears, the problem is caching along the way, not your resolver setting. The IPNixa DNS lookup asks Cloudflare and Google for the same record so you can see whether the new value has reached both, and how long each will keep the old one.