Why the router
Every device asks the router for DNS by default. Change the router once and phones, laptops, TVs, consoles and smart plugs are all filtered, with no software on any of them. It is the setup we recommend for a household or a small office, and it takes about five minutes.
The steps
- Sign in to the dnsdome panel, open your profile and add your network's public IP to the allowlist. The panel shows the IP you are connecting from; on a home connection that is the router's WAN address.
- Open the router's admin page, usually
192.168.0.1,192.168.1.1or the address printed on the router. Find the Internet, WAN or Network settings. - Change the DNS setting from Automatic or from ISP to Manual, and set the primary DNS to
87.244.198.165. Leave the secondary empty or set it to the same address. A different secondary is a leak, not a backup: routers use it whenever it answers first. - If the router has a separate DHCP or LAN DNS field that hands servers to clients, either leave it pointed at the router itself, or set it to
87.244.198.165too. Either way all queries end up at dnsdome. - Save and reboot the router. Devices pick up the change when their DHCP lease renews; reconnect Wi-Fi on a phone to hurry it along.
- Verify: on any device, load a website, then look at the panel's query log. Entries appear within a minute. With Ads & Tracking on, visiting
doubleclick.netshows as blocked.
Where the setting hides, by brand
| Router | Path |
|---|---|
| TP-Link | Advanced → Network → Internet → Advanced settings → Use the following DNS addresses. DHCP hand-out under Advanced → Network → DHCP Server. |
| ASUS | WAN → Internet Connection → WAN DNS Setting → Connect to DNS server automatically: No. Newer firmware also offers DNS-over-TLS under WAN → DNS Privacy Protocol; use your profile hostname <token>.dns.dnsdome.com there. |
| Netgear | Internet → Domain Name Server (DNS) Address → Use These DNS Servers. |
| Linksys | Connectivity → Local Network → DHCP Server → Static DNS 1. |
| Google Wifi / Nest Wifi | Google Home app → Wi-Fi → Settings → Advanced networking → DNS → Custom. |
| Amazon eero | eero app → Settings → Network settings → DNS → Customized DNS. |
| Huawei / ZTE ISP boxes | Network → LAN → DHCP Server → Primary DNS. WAN DNS is often locked by the ISP; the LAN DHCP field is what matters. |
| Telekom / Orange / O2 ISP routers | Same idea: the DHCP DNS field under LAN settings. If everything is locked, put your own router behind the ISP box and set DNS there. |
Have a MikroTik, OpenWrt, pfSense, UniFi or Fritz!Box? Those have their own guides in Docs, including encrypted upstream that does not depend on your public IP.
Three ways queries still leak
- IPv6. If your ISP hands out an IPv6 DNS server through router advertisements, dual-stack devices may prefer it. Disable IPv6 DNS advertisement on the router or set it to the same policy.
- Hard-coded DNS. Chromecasts, some TVs and a few apps ask 8.8.8.8 directly. Routers that can redirect port 53 fix this (see the MikroTik and OpenWrt guides); consumer routers usually cannot.
- Browser DoH. Firefox uses its own encrypted resolver by default in some countries. Point it at dnsdome or turn its DoH off, see browsers.
My public IP changes
Plain DNS identifies your network by IP. When your ISP gives you a new one, dnsdome refuses your queries until you update the allowlist, and devices see "no internet" for DNS. Options: a router that supports DNS-over-TLS or DNS-over-HTTPS upstream (the token identifies you instead), a static IP from your ISP, or simply re-adding the IP in the panel when it happens. Home connections in most of Europe keep an IP for weeks between changes.