DNS¶
Note: The content on this page was first introduced in firmware v4.11.
If your device is running a different firmware version, use the selector below to switch to the corresponding guide.
On the left side of the web Admin Panel, go to DNS.
The DNS settings on your router control how domain names are translated into IP addresses. This page allows you to use the DNS server(s) automatically obtained from upstream devices, or set custom ones. You can also configure DNS options and edit static host rules.
By default, DNS queries for traffic matching the VPN policy use the DNS server(s) provided by the VPN tunnel. Non-VPN DNS queries use the DNS server(s) obtained from the active WAN interface. If you set custom DNS server(s), you can apply them to VPN tunnels, the router itself, or both. When these options are enabled, DNS queries within the selected scope are resolved through the specified one(s), instead of those obtained from the relevant network interfaces. If no custom DNS server(s) are set, the router uses the DNS server(s) obtained from the relevant network interfaces.
WAN DNS¶
The WAN DNS displays DNS servers retrieved from each WAN uplink, including Ethernet, Repeater, Tethering and Cellular.
If a WAN uplink is active, its DNS server addresses are displayed on the right, as shown below.
VPN DNS¶
The VPN DNS shows DNS servers obtained from each active VPN tunnel.
If a VPN tunnel is running, DNS queries from VPN traffic will follow the VPN DNS configuration, as shown below.
Manual DNS¶
Manual DNS supports two configuration types: Static DNS and Encrypted DNS.
-
Apply Manual DNS to VPN tunnels: If this option is enabled, custom Manual DNS will be used for packets through the VPN tunnel instead of the VPN's DNS settings.
-
Apply Manual DNS to Router Itself: This option is enabled by default. When it is turned on, the router's built-in services (such as GoodCloud) will apply the custom manual DNS settings.
Static DNS¶
Static DNS allows you to manually enter IPv4 or IPv6 DNS server addresses. You can either input addresses directly or select preset public DNS servers from the drop-down list to set up your router's DNS servers.
You can enter up to four DNS server addresses. Click Apply to save the changes.
Encrypted DNS¶
Encrypted DNS mode supports multiple DNS providers, including Control D, NextDNS, Quad9, CleanBrowsing, Cloudflare, AdGuard DNS, Google DNS, and OpenDNS. You can also specify an encrypted DNS server manually as needed.
Select the DNS Provider first. The remaining options will change according to your selection.
-
If you select a specific DNS provider (e.g., NextDNS), please choose an encryption type from DNS over TLS (DoT), DNS over HTTPS (DoH), and DNS over QUIC (DoQ). Note that the DNS over QUIC (DoQ) was introduced in firmware v4.9 and is only available when using Control D, NextDNS, or AdGuard DNS as the DNS provider.
-
If you select Manual as the DNS provider, please choose an encryption type from DNS over TLS (DoT), DNS over HTTPS (DoH), DNS over QUIC (DoQ), Oblivious DNS over HTTPS, and DNSCrypt.
Next, click Add a Server to add at least one DNS server. You can directly enter the URL or stamp format of the encrypted DNS. For a list of public servers, please refer to https://dnscrypt.info/public-servers.
Encryption Type Comparison
-
DNS over TLS (DoT)
Encrypts DNS queries via a dedicated TLS port. It isolates DNS traffic from regular web traffic and is easy to identify by network operators.
-
DNS over HTTPS (DoH)
Transmits DNS data inside standard HTTPS traffic. It blends DNS requests with normal web traffic for strong privacy and bypasses simple traffic filtering.
-
DNS over QUIC (DoQ)
Encapsulates DNS over the QUIC protocol. It features low latency, fast reconnection and stable performance on unstable networks.
-
Oblivious DNS over HTTPS (ODoH)
An enhanced version of DoH. It separates user IP from DNS queries, preventing both server and network providers from tracking your browsing activity.
-
DNSCrypt
A mature encryption protocol for DNS. It authenticates and encrypts DNS traffic, focusing on anti-tampering and compatibility with legacy network environments.
DNS Options¶
Click Options in the upper-right corner to configure advanced DNS settings.
You can toggle these options on or off as needed.
-
DNS Rebinding Attack Protection: Turning this option on may cause private DNS lookup failure. If your network has a captive portal, please disable this option.
-
Override DNS Settings of All Clients: If this option is enabled, the router overrides unencrypted DNS settings for all clients.
Edit Hosts¶
You can click the Edit Hosts button at the top right to customize static host rules.
The router prioritizes these host rules when resolving requests from connected clients.
Still have questions? Visit our Community Forum or Contact us.