How to Change Your DNS on a Chromebook (ChromeOS)

Why change DNS on ChromeOS

By default a Chromebook uses whatever DNS server the network hands out over DHCP — usually your internet provider’s. Public resolvers are often faster to respond and, with Secure DNS turned on, encrypt your lookups so the network operator can’t read or log them. Switching takes a couple of minutes, costs nothing, and is fully reversible.

To be clear about what this does and doesn’t do: a quicker resolver shortens the lookup delay before a page starts loading. It does not increase your bandwidth or download speed — those are set by your connection, not your DNS.

Before you start, run the DNS speed test from your Chromebook to see which resolver responds fastest on your connection, then use that one in the steps above. You can also browse the public DNS servers page to compare resolvers on privacy and filtering as well as speed. The steps use Cloudflare’s 1.1.1.1 / 1.0.0.1 as an example — substitute whichever won your test.

Chromebook and ChromeOS version differences

The two methods above cover the same setting in different places, and the exact wording depends on your ChromeOS version and how the device is managed:

• Secure DNS vs. plain name servers. “Use secure DNS” under Security and Privacy is device-wide and encrypted (DoH). “Custom name servers” under a network’s details is plain, unencrypted DNS and applies only to that one Wi-Fi network. You generally want Secure DNS; the per-network name servers are a fallback for networks or resolvers that don’t offer a DoH endpoint.
• Older ChromeOS. On older versions the Secure DNS control may sit under Settings → Privacy and security (slightly different label) rather than “Security and Privacy”. The toggle and the “With Custom” option work the same way.
• School- and work-managed Chromebooks. If your Chromebook is enrolled by a school or employer, an administrator can lock or force the DNS mode by policy. In that case “Use secure DNS” and the name-server fields may be greyed out or reset on their own — that is expected, and it isn’t something you can override from the device. Check with whoever manages the device.
• Ethernet and USB adapters. The per-network name-server method also appears under a wired connection’s details if you use an Ethernet adapter, under the same “Network → Name servers” path.

Encrypted DNS (DoH/DoT)

ChromeOS supports encrypted DNS natively, and it’s the recommended path here. The “Use secure DNS” toggle enables DNS-over-HTTPS (DoH) — that is what “secure DNS” means on ChromeOS. It does not offer DNS-over-TLS (DoT) as a separate option, so if a resolver only publishes a DoT hostname you’ll need its DoH template URL instead.

To fill in the “With Custom” field you need your resolver’s DoH template — for example Cloudflare’s is https://cloudflare-dns.com/dns-query. Our encrypted DNS setup helper generates the correct DoH URL for the resolver you choose, ready to paste into ChromeOS.

Note that the plain “Custom name servers” method is not encrypted. If privacy from the local network is a goal, use the Secure DNS toggle rather than (or in addition to) custom name servers.

Verify it worked

First, confirm resolution still works: open any website you don’t have cached. Then check which resolver is actually in use.

• Secure DNS check. Visit your resolver’s own diagnostic page — for Cloudflare, 1.1.1.1/help reports whether “Using DNS over HTTPS (DoH)” shows Yes and which resolver you’re connected to.
• Speed check. Reload this site and run the DNS speed test again; the resolver you set should be the one responding, and ideally the fastest on your connection.

For the per-network plain DNS method, you can also reopen Settings → Network → your Wi-Fi → Network → Name servers and confirm your custom addresses are still listed.

Troubleshooting

• “Use secure DNS” is greyed out or won’t stay on. The device is almost certainly managed by a school or employer whose policy controls DNS. You can’t change it locally — contact the administrator.
• Some sites won’t load after switching. Try a different resolver from the public DNS servers page. If a captive portal (hotel or airport Wi-Fi) won’t open, temporarily switch Secure DNS to “With your current service provider” or off, sign in, then turn it back on.
• Custom name servers seem ignored. The per-network setting only applies to that specific Wi-Fi network and takes effect on reconnect — forget and rejoin the network, or toggle Wi-Fi off and on.
• DoH works but feels slow. DoH adds a small handshake cost on the first request to a resolver; that’s normal. Pick the resolver that won your speed test rather than the one nearest alphabetically.
• Can’t find “Security and Privacy”. On older ChromeOS it may be labelled “Privacy and security” — the Secure DNS control lives in the same section.

Revert to your old settings

To undo Secure DNS: Settings → Security and Privacy → Use secure DNS, and either switch it off or set it back to “With your current service provider”. To undo plain custom name servers: open Settings → Network → your Wi-Fi → Network → Name servers and change it back to “Automatic name servers”. Either change restores the DNS your network hands out by default, and takes effect immediately (reconnect to Wi-Fi if it doesn’t).