How to Check Which DNS Server You Are Using

Why it matters

Your DNS server decides how every domain name you visit is translated into an address. It affects speed, privacy and security, and if you use a DNS firewall, it determines whether filtering actually happens. Yet many people have no idea which resolver their devices use. Settings can come from the router, the operating system, a VPN app, a browser or a security product, and they do not always agree.

Checking is quick. This article shows how to find the configured DNS server on each major platform, how to see which server actually answers your queries, and how to spot when something is bypassing the resolver you expect.

Configured versus actual DNS server

There is an important distinction between the DNS server a device is configured to use and the server that ultimately resolves your queries. Your laptop may be configured to use your router, for example 192.168.1.1, while the router forwards queries to your internet provider or to a DNS firewall. A browser may ignore the system settings entirely and send queries over DNS-over-HTTPS to its own provider. So check both the local setting and the upstream path.

• Configured server: what the device sends queries to
• Forwarder: a router or local DNS server passing queries upstream
• Upstream resolver: the service that resolves the name
• Browser or app resolver: may bypass all of the above

Windows

Open Command Prompt and run ipconfig /all. Under your active adapter, the DNS Servers line lists the configured servers. For a quick test of which server answers, run nslookup example.com; the first lines show the server that replied. In PowerShell, Get-DnsClientServerAddress lists servers per interface, and Resolve-DnsName example.com performs a lookup using the system resolver.

In Settings, go to Network & internet, select your connection and view its properties. The DNS server assignment section shows whether DNS is automatic or manual, and whether DNS encryption is enabled.

macOS

Open System Settings, select Network, choose your connection, select Details and open the DNS tab. Grey entries were assigned automatically; black entries were added manually. In Terminal, scutil --dns lists every resolver configuration, including those added by VPNs and profiles. Run scutil --dns | grep nameserver for a shorter view, and nslookup example.com or dig example.com to see which server answers.

If you have installed a DNS configuration profile, check System Settings > Privacy & Security > Profiles, because a profile can override the network settings.

Linux

On systems with systemd-resolved, run resolvectl status. It shows the current DNS server per interface and whether DNS-over-TLS is enabled. The file /etc/resolv.conf often points to 127.0.0.53, the local stub resolver, which forwards to the real servers shown by resolvectl. With NetworkManager, nmcli device show lists IP4.DNS entries. Use dig example.com and look at the SERVER line in the output.

iPhone and iPad

Go to Settings > Wi-Fi, tap the information button next to your network and scroll to DNS. If Configure DNS says Automatic, the servers come from the router. If it says Manual, you will see the servers entered. Also check Settings > General > VPN & Device Management for DNS profiles, which apply to all networks including mobile data. iCloud Private Relay can also affect how Safari resolves names.

Android

Open Settings > Network & internet > Private DNS. If a hostname is set, Android sends all lookups over DNS-over-TLS to that provider on every network. If it is set to Automatic or Off, the device uses the DNS servers provided by the Wi-Fi network or mobile carrier. Viewing those servers directly is not always possible in the standard interface; the network details screen sometimes shows them, depending on the manufacturer.

Your browser

Browsers can use their own encrypted DNS. In Chrome, Edge and Brave, look under Settings > Privacy and security > Security > Use secure DNS. In Firefox, open Settings > Privacy & Security and scroll to DNS over HTTPS. If secure DNS is on with a provider other than your chosen resolver, browser lookups bypass the system and router settings.

Your router

Log in to your router's web interface, usually at an address like 192.168.0.1 or 192.168.1.1, and look for WAN, Internet or DHCP settings. The WAN DNS setting shows which upstream servers the router uses. The DHCP DNS setting shows what the router tells devices to use: often the router itself, sometimes an external resolver directly. Our router guides show where these settings live on popular models.

Online tests and the query log

Some websites offer DNS leak tests that show which resolvers are contacted when you load the page. These tests are useful, but interpret them carefully: they show the resolver's outward-facing addresses, which may belong to a provider's infrastructure rather than the address you configured.

If you use FirewallDNS, the simplest check is the query log. Browse to a few sites and watch the log in your dashboard. If lookups appear within seconds, your traffic is reaching FirewallDNS. If nothing appears, either your public IP is not registered or something on the path is using a different resolver.

Signs that something is bypassing your resolver

If your filtering does not seem to work on one device, check for these common causes.

• A VPN app is active and uses its own DNS
• The browser has secure DNS enabled with another provider
• The device has manual DNS servers set
• IPv6 is active and DNS over IPv6 goes elsewhere
• A security or parental control app installs its own resolver
• The device is on mobile data rather than Wi-Fi

Making sure every device uses the right resolver

Once you know which DNS server each device uses, consistency is the next goal. Set the resolver on your router and DHCP server so new devices get it automatically, block outbound DNS to other servers at the firewall, and manage browser DoH settings by policy on managed devices. Our article on stopping devices from bypassing DNS filtering covers each technique in detail.

Checking DNS in a business network

In an office, the picture is more layered. Domain-joined Windows computers should use the domain controllers for DNS, and the domain controllers forward external lookups upstream. Check the forwarders on each domain controller with Get-DnsServerForwarder in PowerShell, or in the DNS Manager under the server's properties. Check the DHCP scope options to see which DNS servers clients receive. And check the firewall to see whether outbound DNS is restricted to your chosen resolver, which is the most reliable way to know that no device can quietly use something else.

For MSPs managing many sites, record the expected DNS configuration for each customer and compare it with reality during regular reviews. Configuration drift, such as a technician adding a public resolver as a quick fix, is common and easy to miss.

Summary

Checking your DNS server takes a minute per device: look at the configured servers, run a lookup to see which server answers, and check the browser and router. When you use a DNS firewall, the query log is the ultimate confirmation that lookups really reach it.