Switch your office to safer DNS

Last updated 2026-10-15 · Written with AI assistance, reviewed by a person

Before anyone in your office can open a website, their computer asks a DNS service where that site lives. DNS is the internet's phone book. Right now, that question most likely goes to your internet provider, which answers it for any site, including ones known to steal passwords or spread ransomware.

A protective DNS service refuses to look those sites up. Point your router at one, and every device on the office network is covered at once: computers, phones, the printer, a visitor's laptop. There's nothing to install, nothing to pay, no new password to manage. It takes about ten minutes, and it's easy to undo.

Our pick is Quad9, a nonprofit based in Switzerland. It's free for everyone, businesses included. It blocks sites that appear on threat lists from many security companies, without keeping personal data about who looked up what. If you'd rather use a big company, Cloudflare for Families works the same way. We don't get paid by either of them.

What it won't do. It won't stop a convincing email asking for money, or a brand-new scam site nobody has reported yet. It's one layer, alongside updates, backups plus two-step sign-in. For ten minutes' work, it's one of the best layers there is.

Before you start

Find who can sign in to the router. That might be you, a staff member or your IT provider. If someone else looks after it, send them this page.
Pick a quiet moment. The internet may drop for a minute or two while the router restarts.
Take a photo of the DNS settings before you change anything. That photo is your undo button.
Do your computers sign in to an office server (a Windows domain, where people sign in as OFFICE\name)? Then leave the router alone. Send whoever runs IT to the section for them.

Set Quad9 on the router

Open the router's settings. Use its phone app, or type its address into a web browser. The address is often printed on a sticker on the router, along with the admin password.
Find the DNS setting. It's usually under Internet, WAN or Network, sometimes inside an Advanced section. Look for "DNS server" or "DNS mode". If it says Automatic, change it to Manual or Custom.
Enter Quad9's addresses: 9.9.9.9 as the primary (or first) DNS server, 149.112.112.112 as the secondary.
Fill in IPv6 too, if there's a box for it: 2620:fe::fe first, then 2620:fe::9. Otherwise some devices can keep asking your provider, skipping Quad9.
Save. Restart the router if it asks.
Restart a computer, or switch a phone's Wi-Fi off then on, so it picks up the change straight away. Other devices catch up on their own, usually within a day.

Two DNS sections? Some routers have one under Internet or WAN, plus another under LAN or DHCP. Set the Internet one. Then look at the LAN one: if it lists your provider's addresses, change them to Quad9's too. If it's empty, or shows the router's own address, leave it alone.

Don't keep a backup from another service. Leave out your provider's addresses, or Google's 8.8.8.8. Devices use both servers they're given, so some lookups would quietly skip the protection.

Check it's working

Visit Quad9's check page on an office computer: on.quad9.net. It should say Yes. Check one phone on the office Wi-Fi too.
Open the sites you use every day: email, Microsoft 365 or Google, the bank, your accounting software. They should load just as before.
Says No? Restart that device, then try again. Still No? It's usually Firefox, a VPN or a device with its own DNS setting: see For whoever runs IT.

What a blocked site looks like. There's no warning page. The browser says it can't find the site, as if it doesn't exist. Tell your team, so they report it to you instead of trying again on their phone's mobile data.

Wondering about one site? Quad9's blocked domain search tells you whether it's blocked. Never test by visiting a real malicious site.

If it blocks something you need

Now and then a legitimate site ends up on a threat list. Look it up in Quad9's blocked domain search. If it's wrongly blocked, tell Quad9 through its support page. If work can't wait, undo the change (next) until it's fixed, then switch back.

How to undo it

Open the router's settings again.
Put back what's in your photo, or set DNS to Automatic.
Save, then restart the router if it asks.

That's all. Nothing else changes. Nothing is lost.

If your provider's router won't let you change DNS

Some internet providers lock this setting on the box they rent you. There are three ways round it, from quickest to most complete:

Set it on each computer or phone. It takes a few minutes per device (see the table). On laptops it has a bonus: the protection goes with them, to home or a hotel.
Ask your provider. Some will change it for you, or switch their box to "bridge mode" or "IP passthrough", so a router you own can take over.
Add your own router behind the provider's box, with the box in bridge mode or passthrough. Then set Quad9 on your router as above. Home defense has what to look for when buying; the same advice fits a small office.

Device	Where to set it
Windows 11	Settings > Network & internet > Wi-Fi (then Hardware properties) or Ethernet. Select Edit next to DNS server assignment, choose Manual, turn on IPv4. Preferred DNS `9.9.9.9`, alternate `149.112.112.112`, each with DNS over HTTPS set to On (automatic template). Save.
Mac	System Settings > Network > Wi-Fi > Details > DNS, for the network you're on. Add `9.9.9.9`, then `149.112.112.112`. For every network at once, Quad9's macOS guide installs an encrypted profile.
iPhone, iPad	Quad9's iOS guide installs a profile that works on every network.
Android	Settings > Network & internet > Private DNS (the menu varies by maker: search Settings for "Private DNS"). Choose the hostname option, then enter `dns.quad9.net`. It covers Wi-Fi plus mobile data.

Microsoft 365 and Google Workspace keep working

Yes, they do. Quad9 refuses only names on its threat lists. The addresses Microsoft or Google use for sign-in, mail, Teams, Meet or file storage aren't on them. Your other everyday services work as before too.

Email delivery doesn't change. The records that route your mail (MX, SPF, DKIM, DMARC) are published by whoever hosts your domain name. Changing how your office looks things up doesn't touch them.

Sign-in rules keep working. Rules based on the office's internet address, such as Microsoft's Conditional Access named locations, look at where traffic comes from. DNS doesn't change that.

The alternative: Cloudflare for Families

Cloudflare for Families is free, fast, from one of the internet's biggest companies. It's a good choice if you'd rather use a large company than a nonprofit, or want the office network to block adult content as well. Follow the same steps with these addresses instead:

What it blocks	IPv4	IPv6	Android Private DNS
Malware	`1.1.1.2`, `1.0.0.2`	`2606:4700:4700::1112`, `2606:4700:4700::1002`	`security.cloudflare-dns.com`
Malware plus adult content	`1.1.1.3`, `1.0.0.3`	`2606:4700:4700::1113`, `2606:4700:4700::1003`	`family.cloudflare-dns.com`

Make sure the address ends in 2 or 3. Plain 1.1.1.1 is Cloudflare's public DNS, with no blocking.
To check it, visit malware.testcategory.com, Cloudflare's test address. It should fail to load.
Keep both addresses from the same service, so what gets blocked stays predictable.

For whoever runs IT

Active Directory? Leave clients pointed at your domain controllers. Set Quad9 as the forwarder on each DNS server instead (DNS Manager > the server > Properties > Forwarders), replacing your provider's addresses. If "Use root hints if no forwarders are available" is ticked, lookups go around Quad9 whenever it doesn't answer.
Firefox. In the US, Firefox may send lookups over its own encrypted DNS to Cloudflare's unfiltered service, going straight past yours. Check Settings > Privacy & Security > DNS over HTTPS: choose Off, or Max Protection with the custom provider https://dns.quad9.net/dns-query. Across many computers, use the DNSOverHTTPS enterprise policy. Chrome, Edge plus Safari follow the system's DNS.
IPv6. Some routers advertise the provider's IPv6 DNS servers with no way to change them. Test on.quad9.net from a device with an IPv6 address. If it says No, set DNS on the devices.
VPNs. Most VPN clients bring their own DNS, which bypasses the router. Use the client's custom DNS setting, or set Quad9 as the forwarder on the VPN's own DNS server.
Stop devices going around it. On the firewall, block outbound DNS (TCP plus UDP port 53) and DNS over TLS (port 853) from everything except the router or your DNS servers. Details are in How to block.
Laptops that travel. Set Quad9 on the laptop itself (the Windows row above). For laptops that join networks blocking encrypted DNS, Quad9 suggests turning on Fallback to plaintext. To confirm encryption, run Resolve-DnsName -Type TXT proto.on.quad9.net in PowerShell: the NameHost column should show doh.
Content loading from far away? Quad9's standard service doesn't pass a location hint (EDNS Client Subnet) to content networks. If a streaming or download service seems to pick distant servers, try 9.9.9.11 with 149.112.112.11 (IPv6 2620:fe::11, 2620:fe::fe:11): the same blocking, plus the hint.
Want our lists, or blocks of your own? Quad9 doesn't take custom lists. Run your own DNS filter (Pi-hole, AdGuard Home or Unbound) with Quad9 as its upstream, then load our daily lists: How to block.

Sources

Checked October 15, 2026. Menus change: if a provider's current instructions differ from ours, follow theirs.

Quad9: FAQ, setup guides, Windows 11 encrypted setup
Cloudflare: 1.1.1.1 for Families, Android setup
Mozilla: Firefox DNS over HTTPS
CISA: Joint NSA and CISA guidance on protective DNS (2021), on why it's worth having

This guide is general advice, not professional advice for your situation: see our Terms. Share it with anyone who looks after an office network.