How to Change DNS on an ASUS Router (ASUSWRT)

Why change DNS on an ASUS router

Setting DNS on the router applies it to every device that connects — phones, laptops, smart TVs, consoles, and IoT gadgets — without touching each one individually. ASUSWRT (the firmware on ASUS and ROG routers) puts this control in a single, well-labelled spot: the router itself queries your chosen resolver, then hands that resolver out to every device over DHCP.

A faster resolver shortens the lookup delay before a page starts loading — the moment where your device asks “what IP is this domain?” and waits for an answer. It does not increase your bandwidth or download speed; a 500 Mbps line stays 500 Mbps. What you feel is snappier first-connection time, especially on pages that pull from many domains.

Before you start, run the DNS speed test on a device connected to this router to see which resolver responds fastest from your location, then use its addresses in the steps above. You can also browse the public DNS servers list if you want to weigh privacy or filtering alongside speed. The examples below use Cloudflare (1.1.1.1 / 1.0.0.1) purely as placeholders.

Stock ASUSWRT vs Asuswrt-Merlin

The manual-DNS steps above are the same across virtually all modern ASUS routers, but there are two firmware families worth knowing about:

• Stock ASUSWRT ships on the router from the factory. Recent versions (firmware 384/386/388 and later) include the WAN → Internet Connection → WAN DNS Setting fields and, on most current models, the DNS Privacy Protocol dropdown for DNS-over-TLS. Older or entry-level firmware may not show the DoT dropdown at all — if you don’t see it, your build simply doesn’t expose it, and plain DNS is still worth setting.
• Asuswrt-Merlin is a popular third-party firmware (community-maintained, based on ASUS’s own source) available for many ASUS models. It keeps the same WAN DNS layout, so these steps still apply, but adds more control — stricter DoT validation, per-client DNS routing (DNSFilter), and hooks for add-ons. Native DNS-over-HTTPS (DoH) is not in the stock or Merlin GUI; on Merlin it’s typically achieved by installing a helper like dnscrypt-proxy through community scripts, which is an advanced, unsupported-by-ASUS path.

If you’re unsure which you have, check Administration → Firmware Upgrade; Merlin builds identify themselves in the version string.

Encrypted DNS (DoH/DoT)

ASUSWRT does support encrypted DNS natively, but only DNS-over-TLS (DoT), not DNS-over-HTTPS (DoH), through the GUI. On firmware that includes it, the DNS Privacy Protocol dropdown sits directly beneath the manual DNS fields on the same WAN page you’re already editing. Set it to DNS-over-TLS (DoT), then in the DNS-over-TLS Server List, add your resolver’s IP and its TLS hostname:

• Cloudflare: 1.1.1.1 / 1.0.0.1, TLS hostname cloudflare-dns.com
• Because the router is the DNS server for your whole LAN, enabling DoT here encrypts upstream lookups for every device behind it — not just the router.

To get the exact DoT server and hostname for whichever resolver won your speed test, use our encrypted DNS setup helper and paste the values into the DNS-over-TLS Server List. If your firmware has no DNS Privacy Protocol dropdown, you can’t do encrypted DNS at the router — set plain DNS here, and add encryption per device using the platform guides instead.

Note that DoH configured inside a browser (Firefox, Chrome) will bypass the router’s DNS entirely, encrypted or not. That’s fine, but it means the browser won’t use the resolver you set here.

Verify it worked

First, confirm the router accepted the change: the WAN status on the ASUSWRT dashboard (Network Map) should stay “Connected.” Then check a device.

On Windows:

ipconfig /all

On macOS or Linux:

scutil --dns

resolvectl status

The DNS server listed should match the router’s LAN IP (usually 192.168.1.1, though many current RT-AX and ZenWiFi models default to 192.168.50.1) — clients query the router, and the router forwards to your chosen resolver. That’s expected and correct; you won’t see 1.1.1.1 directly on the client. To confirm the upstream is actually your resolver, reload this site and run the DNS speed test again — the resolver you configured should show up as the one answering.

If you enabled DoT, you can sanity-check encryption at Cloudflare’s encryption checker from a device on the network (only meaningful if you chose Cloudflare).

Troubleshooting

• Devices still show the old DNS after Apply. Router DNS changes only reach a device on its next DHCP lease. Reboot the device, or disconnect and reconnect Wi-Fi, to force a fresh lease.
• No “DNS Privacy Protocol” dropdown. Your firmware version doesn’t expose DoT. Update firmware under Administration → Firmware Upgrade if a newer build exists, or accept plain DNS at the router and encrypt per device.
• Internet works but some sites fail after enabling DoT. The DoT hostname must exactly match the resolver’s certificate. A wrong or blank hostname makes TLS validation fail and lookups stop. Re-check the TLS hostname, or temporarily set DNS Privacy Protocol back to None to isolate the problem.
• A single device ignores the router’s DNS. That device likely has its own manual DNS set, which always overrides what the router hands out. Check its network settings (see the per-device guides).
• Admin page won’t load. Confirm you’re on this router’s network (not a guest SSID or mesh node’s separate network) and try 192.168.1.1 directly if router.asus.com doesn’t resolve.
• DNS Rebind / DNSSEC warnings. If enabling a strict resolver breaks local device discovery, check that “Enable DNS Rebind protection” isn’t blocking a local service; leave DNSSEC on unless a specific resolver misbehaves with it.

Revert to your old settings

Go back to WAN → Internet Connection → WAN DNS Setting, set Connect to DNS Server automatically back to Yes, and (if you changed it) set DNS Privacy Protocol back to None. Click Apply. This restores your ISP’s default DNS for the whole network. Any device that still has its own manual DNS set will keep using that until you revert it separately.