networksetup -setdnsservers Wi-Fi 1.1.1.1 1.0.0.1Use Cloudflare's resolvers on the Wi-Fi service.
When to use it
Change DNS servers when your ISP's DNS is slow or unreliable, to use a resolver with malware filtering or better privacy, or to fix DNS errors like DNS_PROBE_FINISHED_NXDOMAIN.
Steps
Open the DNS settings
System Settings › Network, select Wi-Fi (or Ethernet), click Details, then DNS.Add new servers
Click + under DNS Servers and add, for example,1.1.1.1and1.0.0.1. Add IPv6 ones too if you use IPv6 (2606:4700:4700::1111). Remove old entries with −. Click OK.Or use Terminal
networksetup changes the same setting. The service name must match System Settings (Wi-Fi, or your Ethernet adapter's name).networksetup -setdnsservers Wi-Fi 1.1.1.1 1.0.0.1Check what macOS uses
scutil --dns lists the resolvers in effect. VPNs and profiles can add their own resolvers for some domains.scutil --dns | grep nameserverFlush the cache
So old answers don't linger.sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder
Output explained
scutil --dns on a Mac using its router's DNS:
resolver #1
search domain[0] : local
nameserver[0] : 192.168.1.1
if_index : 14 (en0)
flags : Request A records, Request AAAA records
reach : 0x00020002 (Reachable,Directly Reachable Address)
After the change, nameserver[0] shows 1.1.1.1. Further resolvers listed below #1 handle special cases such as local (Bonjour) and reverse lookups.
networksetup -getdnsservers Wi-Fi prints There aren't any DNS Servers set on Wi-Fi. when the router's DNS is used.
Options and variations
| Flag | Meaning | Example |
|---|---|---|
| -setdnsservers SERVICE IP… | Set DNS servers for a service | networksetup -setdnsservers Wi-Fi 9.9.9.9 |
| -setdnsservers SERVICE empty | Clear manual servers (use DHCP) | networksetup -setdnsservers Wi-Fi empty |
| -getdnsservers SERVICE | Show manual DNS servers | networksetup -getdnsservers Wi-Fi |
| -listallnetworkservices | Service names to use | networksetup -listallnetworkservices |
| scutil --dns | Resolvers actually in effect | scutil --dns |
Common errors
| Error | Cause | Fix |
|---|---|---|
| ** Error: The parameters were not valid. | Wrong service name | Run networksetup -listallnetworkservices and copy the exact name. |
| Safari ignores the new DNS | iCloud Private Relay handles DNS for Safari | Expected with Private Relay on; turn it off for this network if needed. |
| Settings revert | A VPN or configuration profile manages DNS | Check System Settings › General › Device Management and the VPN app. |
Do it in the app
After switching, LightAtom's connections view shows domain names on connections as lookups go through the new server.
Frequently asked questions
How do I change DNS on a Mac?
System Settings › Network › your connection › Details › DNS: add the new servers with +, remove the old ones, click OK. Or run networksetup -setdnsservers Wi-Fi 1.1.1.1 1.0.0.1.
What DNS server should I use?
Cloudflare (1.1.1.1), Google (8.8.8.8) and Quad9 (9.9.9.9) are fast and reliable; Quad9 also blocks known malware domains. Run the DNS speed test to see which is fastest from your connection.
Can I use DNS over HTTPS on a Mac?
macOS supports encrypted DNS through configuration profiles or apps that install a DNS proxy. Browsers like Chrome and Firefox also have their own secure DNS settings, and iCloud Private Relay encrypts Safari's DNS.
Does changing DNS affect iCloud Private Relay?
Private Relay uses its own encrypted DNS for Safari traffic, so your setting doesn't apply there. Other apps use the DNS servers you set.