Change your DNS resolver: how to switch safely

Every device on a network asks a resolver - a phonebook service - for the IP address behind every domain name. On most networks that resolver belongs to your ISP, your school or your employer, and it is the single cheapest place for them to filter: one answer of "does not exist" and the site is gone for you, while the site itself is fine. Swapping the resolver for an independent public one removes that filter from the equation in minutes, without installing anything [1][3].

This is the classic first fix for a reason: it is free, fast and reversible. It is also over-hyped - it only fixes blocks that live at the DNS layer. This guide shows the exact steps for every platform, the cache flushes that people forget, and how to know when your block needs a stronger tool.

The 60-second test: will a resolver change help?

Do this before touching settings, so you know whether the change is worth making:

1. Open dns.google in your browser and resolve the blocked domain [10]. If it returns an address, the site is up and reachable - your network is the difference.
2. Temporarily set one device to a public resolver (Windows or macOS steps below use 8.8.8.8 or 9.9.9.9) [1][3].
3. Flush the DNS cache (commands at the end of this guide) and reload the blocked site.
4. If the site now opens: your block was DNS-layer, and making the change permanent on the router (below) finishes the job. If it still fails: the block is deeper - jump to [when a resolver change is not enough](#when-a-resolver-change-is-not-enough).

The public resolvers worth using

Pick two addresses (primary and alternate) from one provider. All of these are run as serious infrastructure with published policies [1][3][5][6]:

Each provider also offers encrypted variants - DoH and DoT endpoints for every one of these [5]. The encrypted setup is the one that survives hostile networks; the plain-IP change below is the quick test and the honest baseline.

Per platform: the exact clicks

Windows 10 and 11

1. Settings, Network and internet, Wi-Fi (or Ethernet), your connection, DNS server assignment, Edit.
2. Switch from Automatic (DHCP) to Manual, enable IPv4.
3. Preferred DNS: 1.1.1.1, Alternate: 1.0.0.1 (or any pair from the table) [2].
4. Save, then repeat for IPv6 if your network uses it (2606:4700:4700::1111 for Cloudflare) [2].
5. Open Command Prompt and run ipconfig /flushdns.

macOS

1. System Settings, Network, your connection, Details, DNS.
2. Remove any listed servers, or add the public pair above with the + button [2].
3. OK, Apply. macOS flushes its cache on apply; if not, sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder in Terminal.

iOS and iPadOS

1. Settings, Wi-Fi, the (i) next to your network.
2. Configure DNS, Manual.
3. Remove the existing servers, add the public pair [2].
4. Save. Back out and toggle Wi-Fi off/on to be safe.

Android

On Wi-Fi: Settings, Network and internet, your network, edit (pencil), Advanced, IP settings Static, then fill the DNS fields. For the whole phone, use Private DNS with a hostname such as one.one.one.one - that is the encrypted DoT variant, covered in our encrypted DNS guide.

Linux

With systemd-resolved (most modern distros): edit DNS servers per connection in your network manager (GNOME: Settings, Network, gear icon, IPv4, disable Automatic DNS, add servers), then resolvectl flush-caches. The classic nameserver lines in /etc/resolv.conf work too, but a local stub usually manages that file - change it through your network manager instead.

The router: one change, whole household

Set the resolver once in the router's WAN or DHCP/DNS settings and every device behind it - phones, TVs, consoles - inherits it. Cloudflare and Quad9 keep router-by-router instructions [2][3]. Two caveats: a router change is invisible to devices using their own override (Android Private DNS, a browser with DoH), and on a shared network it is a change other people will notice - make it openly.

Flush the caches (the forgotten half)

After a resolver change you are still asking cached answers on three levels. If the block page survives the change, clear in this order:

1. Browser cache: chrome://net-internals/#dns has a "Clear host cache" button; in Firefox it is about:networking#dns. Or simply restart the browser.
2. OS cache: ipconfig /flushdns on Windows, sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder on macOS, resolvectl flush-caches on Linux.
3. The resolver's own cache: if the wrong answer is already cached at the public resolver, the provider cache-flush pages help (Google and Cloudflare both offer one) [1][2].

How to verify the change took

Three independent checks, thirty seconds:

1. Quad9's on.quad9.net or the 1.1.1.1 help page tells you which resolver your connection is actually using [8].
2. Reload the blocked site in a fresh private window (skips the browser cache).
3. For proof rather than symptoms, run the site through OONI Probe - it compares your resolver's answer against a control server and flags DNS tampering specifically [9].

When a resolver change is not enough

Honest limits, in the order people hit them:

• The network intercepts port 53 anyway. Some ISP and enterprise networks quietly redirect any plain-DNS traffic - to any resolver - back to their own servers, so your careful 8.8.8.8 setting is ignored without any error. This interception is a documented, measured behavior of real networks, not a rumor [7]. The fix is encrypted DNS: the same providers with their DoH/DoT endpoints, which interception cannot quietly rewrite [5]. Our DoH setup guide has the per-platform steps.
• The block is not at the DNS layer. If the name resolves but the page hangs on https:// or the connection never establishes, the filter works on the connection or the IP address, and no resolver helps. Diagnose with the symptom table in our general unblock guide, then use ECH, WARP, Psiphon or the Tor Browser.
• The block is on the site. Geo, age and account walls live on the operator's side. Resolver settings do not touch them.