Setup guide

Change DNS servers on macOS

Through System Settings or networksetup, with the verification step and the exact command to undo it.

Before you change anything

Record your current servers first: networksetup -getdnsservers Wi-Fi. If it replies “There aren’t any DNS Servers set”, your Mac is using the ones supplied by DHCP — that is the state to return to.
On a work, school or campus network, a custom resolver commonly breaks internal hostnames, intranet sites and VPN resources that depend on split DNS. If anything internal stops resolving, that is the cause — revert first, investigate second.
Captive portals on hotel and airport Wi-Fi often will not appear until you go back to the network’s own DNS.
Changing resolver changes what is filtered. Moving to an unfiltered resolver switches off malware or adult-content blocking you may currently rely on; moving to a filtering one can block sites that used to work.
Your chosen resolver can see every domain your device looks up. Changing DNS moves that visibility from your ISP to the new provider. It does not make your lookups invisible, and it does not hide which sites you visit from anything else on the path.

System Settings

Open System Settings → Network.
Select your active service (Wi-Fi or Ethernet) and choose Details….
Select DNS in the sidebar.
Under DNS Servers, use + to add each address. Remove any greyed-out entries only if you intend to stop using the DHCP-supplied servers entirely — on macOS those grey entries are the ones your network handed you.
Add IPv6 addresses too if your network uses IPv6.
Choose OK, then Apply.

Settings are per network service. If you use both Wi-Fi and Ethernet, repeat for each, or your results will change depending on how you happen to be connected.

Terminal

networksetup -listallnetworkservices
networksetup -getdnsservers Wi-Fi          # record this first

sudo networksetup -setdnsservers Wi-Fi 1.1.1.1 1.0.0.1

Use the exact service name from the first command — it is often Wi-Fi but can differ, and adapters appear under their own names.

Clear the cache and check it worked

sudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder

networksetup -getdnsservers Wi-Fi
dig dnsbenchmarkpro.com +short

Both flush commands are needed: the first clears the directory-services cache, the second restarts the responder that actually performs lookups. Run them together.

dig should return an address. Note that dig queries the resolver directly and will not reflect settings applied only to a different network service.

A note on iCloud Private Relay and VPNs

With iCloud Private Relay enabled, Safari’s name resolution is handled through Apple’s relay rather than your configured resolver, so a change here may appear to have no effect in Safari while working normally elsewhere. Most VPN clients also install their own DNS settings that override yours while connected. Neither is a fault in your configuration.

Reverting

System Settings: Network → your service → Details… → DNS, select each address you added and remove it with –, then OK → Apply. The greyed-out DHCP servers return on their own.
Terminal: sudo networksetup -setdnsservers Wi-Fi Empty — the literal word Empty clears manual servers and hands control back to DHCP.
Flush again: sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder.

Last reviewed 2026-08-15. Provider configuration comes from RESOLVER-REGISTRY.json, which records the official source and verification date for every entry.