Every time someone types a web address, a quiet lookup happens in the background. A DNS resolver translates that human-friendly name into the numeric address computers actually use. When that resolver is slow, misconfigured, or controlled by an internet provider with a habit of redirecting mistyped URLs, the whole browsing experience suffers. That is why changing DNS settings on Windows is one of the highest-value, lowest-effort tweaks a PC user can make. (Domain Name System)
The good news: it takes about two minutes, requires no extra software, and is fully reversible. The less good news: Windows 10 and Windows 11 hide the controls in slightly different places, and a few common mistakes can leave a machine worse off than before. This guide walks through every reliable method, explains what actually changes, and flags the traps that trip people up.
Why Bother Changing DNS at All?
Most home networks use whatever resolver the internet service provider hands out automatically. That default is not always the fastest option, and it is rarely the most private. A third-party public resolver can shave noticeable time off page loads when the provider’s infrastructure is congested or geographically distant.
There is a privacy angle too. Some providers log queries or intercept failed lookups and redirect them to advertising pages. Switching to a resolver with a published, strict no-logging policy changes that dynamic. Then there is DNS-over-HTTPS (DoH), which encrypts lookups so they cannot be read by anyone sitting between the PC and the resolver. Windows 11 supports it natively, which is a genuine step forward.
It is worth being honest about the limits. Changing DNS will not make a slow connection fast, and it will not bypass every form of network blocking. What it can do is reduce lookup latency, improve reliability when a provider’s resolver stumbles, and give a user more control over who sees their browsing metadata.
Before Touching Anything: Two Habits That Save Headaches
First, note the current settings. Open Settings, find the active adapter, and write down whatever addresses are already listed. If something breaks, restoring the original numbers takes seconds. People who skip this step often end up hunting through old router documentation to recover an address they never recorded.
Second, decide which resolver to use. A few well-known options exist, and the right pick depends on priorities.
| Resolver | Strength | Consideration |
|---|---|---|
| Cloudflare (1.1.1.1) | Fast, strong privacy stance, wide reach | Some networks block it |
| Google (8.8.8.8) | Very reliable, excellent uptime | Query logging practices differ from privacy-first options |
| Quad9 (9.9.9.9) | Blocks known malicious domains | Blocking can occasionally catch legitimate sites |
| ISP default | Zero configuration | Speed and privacy vary widely |
The practical takeaway: try two resolvers on a real workload for a day rather than trusting a benchmark chart. Perceived speed depends heavily on geography and which content delivery networks a resolver steers toward.
Method One: Changing DNS Through Windows 11 Settings
Windows 11 moved DNS configuration into the modern Settings app, and the flow is genuinely clean.
- Open Settings and go to Network & internet.
- Choose the active connection type, either Wi-Fi or Ethernet.
- Click the network name to open its properties page.
- Find DNS server assignment and click Edit.
- Switch the dropdown from Automatic (DHCP) to Manual.
- Turn on IPv4, then enter a preferred and alternate address.
- Optionally repeat for IPv6, then save.
The IPv6 step matters more than it used to. Many modern networks prefer IPv6, and leaving it on automatic while forcing IPv4 to a custom resolver creates a split-brain setup where some queries go one way and some the other. Enter both, or deliberately disable IPv6 on that adapter.
Enabling Encrypted DNS in Windows 11
On builds that support it, the same properties page exposes an Encryption setting once a known resolver address is entered. Selecting “Encrypted only” forces DoH. If the option is greyed out, the resolver is not on the recognized list, or the build predates DoH support. In that case, the address still works, just unencrypted. Checking this is one of the more useful habits to build alongside other Windows keyboard shortcuts everyone should know, since quick navigation makes repeat configuration far less tedious.
Method Two: The Classic Control Panel Route
Windows 10 users, and anyone who prefers the older interface, should use Control Panel. This path works identically on both Windows 10 and 11.
- Press Win + R, type `ncpa.cpl`, and press Enter.
- Right-click the active adapter and choose Properties.
- Select Internet Protocol Version 4 (TCP/IPv4) and click Properties.
- Choose Use the following DNS server addresses.
- Enter preferred and alternate addresses.
- Repeat for TCP/IPv6 if the network uses it.
- Click OK on both dialogs to apply.
A frequent error here: people click OK on the inner dialog and assume the job is done, then close the outer window with the X. That usually cancels the change. Always confirm the adapter properties window closes via its own OK button.
Another common slip is editing the wrong adapter. A laptop with a VPN client installed may list several virtual adapters with confusing names. The active one shows a green indicator or a connected status. Editing a disconnected adapter does nothing visible and causes real confusion later.
Method Three: Command Line, for Speed and Scripting
For technicians, or anyone configuring several machines, the command line is faster and repeatable. The netsh utility has handled this for years.
- Open Terminal or Command Prompt as administrator.
- List interfaces with `netsh interface show interface`.
- Set IPv4 DNS with `netsh interface ip set dns “Wi-Fi” static 1.1.1.1`.
- Add an alternate with `netsh interface ip add dns “Wi-Fi” 1.0.0.1 index=2`.
- For IPv6, use `netsh interface ipv6 set dns “Wi-Fi” static
`.
PowerShell offers a cleaner alternative: `Set-DnsClientServerAddress -InterfaceAlias “Wi-Fi” -ServerAddresses (“1.1.1.1″,”1.0.0.1”)`. To revert, run the same command with `-ResetServerAddresses`. This is genuinely the tidiest undo in the whole process.
Flushing the Cache: The Step Everyone Forgets
After any DNS change, the old answers linger in the local resolver cache. Windows keeps those entries until they expire or something clears them. Skipping this step is the single most common reason people conclude “the new DNS didn’t work.” (DNS Server overview)
Open a terminal and run `ipconfig /flushdns`. The confirmation message appears instantly. Then run `ipconfig /displaydns` to inspect what is cached, or `nslookup example.com` to confirm which server is answering. If nslookup still reports the old server, the adapter change did not apply to the interface actually in use.
This mirrors a broader pattern in Windows troubleshooting: the visible setting and the effective setting are not always the same. The same principle applies when people wonder how to check for viruses on a Windows PC and find that a scan result depends on whether definitions actually updated. Verification beats assumption every time.
Router-Level vs. Device-Level: Which Should You Change?
Changing DNS on the router pushes the setting to every device on the network, including phones, consoles, and smart TVs. Changing it on one PC affects only that PC. The trade-off is control versus reach.
| Approach | Best for | Downside |
|---|---|---|
| Router-level | Whole-home consistency, IoT devices | Affects everyone, harder to test alternatives |
| Per-device | Testing, laptops that travel | Must repeat on each machine |
| Both | Maximum consistency | Redundant, can mask which layer failed |
A sensible middle path: test on one PC first, confirm the resolver behaves well with the sites actually used, then roll it out to the router. Laptops that move between networks benefit from per-device settings, since a router setting does not travel with the machine.
What Changing DNS Will Not Fix
Setting expectations prevents disappointment. A custom resolver does not repair a failing Wi-Fi signal, does not increase bandwidth, and does not defeat every network-level block. Some networks intercept DNS traffic on port 53 regardless of the configured address, which is precisely the scenario where encrypted DNS helps, and precisely why it is not a universal solution.
Nor is DNS a security silver bullet. A resolver that filters malicious domains adds a layer, but it does not replace antivirus software. Anyone tightening their setup should pair DNS changes with a look at the best free virus removal tools for Windows rather than treating one control as sufficient.
Troubleshooting When Pages Stop Loading
If browsing breaks after a change, work through this order:
- Revert to automatic DNS and confirm the connection recovers. This isolates the cause.
- Check for typos. A single wrong digit produces a resolver that never answers.
- Flush the cache again, then test with nslookup.
- Disable any VPN temporarily. VPN clients often override adapter DNS silently.
- Confirm the change applied to the interface actually carrying traffic.
Most failures trace back to step two or step five. Slow down and read the numbers back before saving; it saves an embarrassing amount of time.
A Note on Encrypted DNS and the Road Ahead
Encrypted resolution is moving from optional extra to default expectation. Browsers already ship with their own DoH settings, which can conflict with operating-system settings in ways that confuse users. When both layers are configured, the browser setting usually wins for browser traffic, while the OS setting governs everything else. Checking both is the only way to know what is really happening.
Longer term, the way names get resolved may shift substantially as new computing models mature, a theme explored in analyses of how quantum computing could change artificial intelligence. For now, the practical advice stays simple: know which resolver is answering, and verify rather than assume.
Conclusion
Changing DNS on Windows is a two-minute job with an outsized effect on how a machine feels day to day. The Settings app handles Windows 11 cleanly, Control Panel covers every version, and the command line scales to fleets. The details that separate a smooth change from a frustrating afternoon are unglamorous: record the original addresses, configure both IPv4 and IPv6, flush the cache, and verify with nslookup that the new resolver is genuinely answering. Do those four things and the switch is reliable. Skip them and the change may appear to work while quietly doing nothing at all.
Frequently Asked Questions
Does changing DNS actually make the internet faster?
Sometimes, modestly. It reduces lookup time, which is a small fraction of total page load. The gain is most noticeable on networks with a sluggish provider resolver. It will not increase raw bandwidth.
Is it safe to use a public DNS resolver?
Reputable public resolvers are widely used and generally safe. The real considerations are privacy policy and filtering behavior. Read the provider’s published policy before committing, and remember that lookups reveal which sites are visited.
Why did my DNS change stop working after a while?
Usually a VPN client, a network switch, or a Windows update reset the adapter. Laptops that join different networks pick up new DHCP settings. Reapply the configuration, or set it at the router level for consistency.
Do I need to change DNS on both IPv4 and IPv6?
If the network uses IPv6, yes. Leaving IPv6 on automatic while forcing IPv4 creates inconsistent routing. Either configure both or disable IPv6 deliberately on that adapter.
How do I undo a DNS change?
Set the adapter back to Obtain DNS server address automatically in Control Panel, or in Settings choose Automatic (DHCP). In PowerShell, run `Set-DnsClientServerAddress` with the reset switch. Then flush the cache.
What is DNS-over-HTTPS and do I need it?
DoH encrypts lookups between the PC and the resolver so they cannot be read in transit. Windows 11 supports it for recognized resolvers. It is a meaningful privacy improvement on untrusted networks, though not a complete anonymity tool.
