What Is DNS?
DNS (Domain Name System) translates human-readable domain names (like google.com) into the IP addresses (like 142.250.80.46) that computers actually use to communicate. It is one of the most fundamental systems of the internet — without it, you would need to memorize a numerical address for every website you visit.
How DNS Works — Step by Step
When you type a URL into your browser, a sequence of lookups happens in milliseconds:
- Browser cache check — Has it looked up this domain before? If so, use the cached IP and skip everything below
- OS DNS cache — Check the operating system's local DNS cache
- Recursive resolver query — Ask your configured DNS server (your ISP's, or Cloudflare/Google if you changed it). "What is the IP for google.com?"
- Root server lookup — If the resolver does not know, it asks a root nameserver: "Who manages .com domains?"
- TLD nameserver — The root server points to the .com TLD nameserver: "Ask Verisign"
- Authoritative nameserver — The TLD server points to Google's authoritative DNS: "Ask Google's nameserver"
- Answer returned — Google's nameserver returns the IP address. The resolver caches it (for the TTL duration) and passes it back to your browser
- Connection made — Your browser connects to the returned IP
This entire sequence takes 20–150ms on first lookup. Subsequent lookups hit the cache and take under 1ms.
Your ISP's DNS vs Public DNS
By default, your devices use your ISP's DNS servers. ISP DNS has some notable downsides:
- Speed: ISP DNS servers vary widely in speed and reliability. In the US, ISP DNS averages 30–70ms response time; Cloudflare typically responds in 10–20ms
- Privacy: Most ISPs log DNS queries and use that data for targeted advertising or sell it to data brokers. Every website you visit is recorded
- Censorship: Some ISPs (and some countries) use DNS to block access to certain domains. Changing DNS servers bypasses this
- Reliability: ISP DNS servers occasionally fail. When they go down, websites seem unreachable even though your internet connection is fine
Best Public DNS Servers (2026)
| Provider | Primary | Secondary | Speed | Privacy | Features |
|---|---|---|---|---|---|
| Cloudflare | 1.1.1.1 | 1.0.0.1 | ⭐⭐⭐⭐⭐ | ⭐⭐⭐⭐⭐ | No query logging; optional malware/adult filtering |
| Google Public DNS | 8.8.8.8 | 8.8.4.4 | ⭐⭐⭐⭐⭐ | ⭐⭐⭐ | Massive cache; Google does log queries |
| Quad9 | 9.9.9.9 | 149.112.112.112 | ⭐⭐⭐⭐ | ⭐⭐⭐⭐⭐ | Blocks malicious domains; Swiss privacy law |
| OpenDNS (Cisco) | 208.67.222.222 | 208.67.220.220 | ⭐⭐⭐⭐ | ⭐⭐⭐ | Customizable blocking; parental controls |
| AdGuard DNS | 94.140.14.14 | 94.140.15.15 | ⭐⭐⭐⭐ | ⭐⭐⭐⭐⭐ | Blocks ads + trackers at DNS level |
| NextDNS | Varies by account | Varies | ⭐⭐⭐⭐ | ⭐⭐⭐⭐⭐ | Custom filtering, analytics, free tier available |
How to Change DNS on Your Router (All Devices)
Changing DNS in your router applies to every device on your network automatically — no changes needed on individual phones or laptops.
| Brand | Location |
|---|---|
| NETGEAR | Advanced → Setup → Internet Setup → Domain Name Server (DNS) Address |
| TP-Link | Advanced → Network → Internet → DNS (under IPv4) |
| ASUS | WAN → Internet Connection → WAN DNS Setting → DNS Server 1 / 2 |
| Linksys | Connectivity → Internet Settings → DNS |
| D-Link | Setup → Internet → Static DNS |
| Xfinity | Connection → Local IP Network → IPv4 → DNS |
Enter Cloudflare's addresses: Primary DNS 1.1.1.1, Secondary DNS 1.0.0.1. Click Save and clear your browser cache to see the effect immediately.
How to Change DNS on Individual Devices
Windows: Settings → Network & Internet → WiFi (or Ethernet) → Hardware Properties → DNS server assignment → Manual → enter IP addresses
Mac: System Settings → Network → select connection → Details → DNS → click + and add server addresses
iPhone/iPad: Settings → Wi-Fi → tap (i) next to network → Configure DNS → Manual → add servers
Android: Settings → Network & Internet → Private DNS → select "Private DNS provider hostname" → enter 1dot1dot1dot1.cloudflare-dns.com for Cloudflare DoH
DNS over HTTPS (DoH) and DNS over TLS (DoT)
Traditional DNS queries are unencrypted — your ISP and anyone on the network path can see which domains you are looking up. DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt these queries, preventing snooping.
- Cloudflare DoH:
https://cloudflare-dns.com/dns-query - Google DoH:
https://dns.google/dns-query - Quad9 DoT:
tls://dns.quad9.net
Firefox and Chrome support DoH natively (Settings → Privacy → DNS over HTTPS). Android 9+ supports Private DNS with DoT. Some routers (ASUS, FRITZ!Box, pfSense) support DoH/DoT at the router level for whole-network encryption.
DNS and Pi-hole
Pi-hole is a self-hosted DNS server that blocks ads and trackers network-wide by intercepting DNS requests and refusing to resolve advertising and tracking domains. Run on a Raspberry Pi or any Linux device, pointed at as your router's DNS server — every device on your network benefits. See the Pi-hole setup guide.
DNS Troubleshooting
Websites not loading but internet is connected: DNS failure is the most common cause. Test by pinging an IP directly: ping 8.8.8.8. If that works but ping google.com fails, DNS is broken. Change to a public DNS server or power cycle your router.
Slow page load (fast after first visit): First-visit DNS lookup is slow. Subsequent visits use cache. If consistently slow, your ISP's DNS may be slow — switch to Cloudflare (1.1.1.1).
DNS leak: When using a VPN, your DNS queries may still go to your ISP instead of through the VPN tunnel. Test at dnsleaktest.com — if it shows your ISP's servers instead of your VPN provider's, configure DNS leak protection in your VPN client settings.