Status dnsafe.net ↗ Log in
Guides
Docs homeHome & PersonalMSP & BusinessAPI reference
Popular
Router setupEncrypted DNSTroubleshooting
Search docsLog in
Docs / Home & Personal

Home & Personal

Set up DNSAFE on your devices and router, turn on encrypted DNS, and manage rules.

Last updated September 2026

DNS Resolver Addresses#

Point your device or router to the following addresses to start filtering DNS with DNSAFE. All plans use the same resolver — your filtering policy is applied based on your registered account IPs.

Standard DNS (port 53)

Primary 3.12.124.91

Encrypted DNS

DoH https://dns.dnsafe.net/dns-query
DoT hostname dns.dnsafe.net
DoT port 853
ⓘ
Register your IP first. Filtering only applies to IPs registered in your account. Log in to my.dnsafe.net → Devices to add your device or network IP before configuring DNS.

Quick Start Guide#

Get DNSAFE filtering active on your device in under three minutes.

  1. 1
    Create a free accountGo to my.dnsafe.net and sign up. No payment required for the Free plan.
  2. 2
    Register your device IPIn the portal, go to Devices and click + Add Device. Your current public IP is shown — click “Use my current IP” to add it in one step.
  3. 3
    Configure DNS on your deviceChange your DNS server to 3.12.124.91. See the platform guides below for step-by-step instructions for your device.
  4. 4
    Verify filtering is workingRun the DNS leak test — it should show DNSAFE as your resolver once filtering is active.
💡
For whole-home protection, configure DNS on your router rather than individual devices. One change protects every device on your network. See the Router guide below.

Platform Setup Guides#

Choose your platform for step-by-step DNS configuration instructions.

Windows 11 / 10

  1. Open Settings → Network & Internet
  2. Click your active connection (Wi-Fi or Ethernet)
  3. Scroll down to DNS server assignment and click Edit
  4. Change from Automatic to Manual
  5. Toggle on IPv4 and enter 3.12.124.91 as the Preferred DNS
  6. Click Save
💡
For DNS-over-HTTPS on Windows 11, set DNS server to 3.12.124.91 then toggle the DNS over HTTPS dropdown to “On (automatic template)” if prompted.

macOS

  1. Open System Settings (or System Preferences on older macOS)
  2. Click Network, then select your active connection
  3. Click Details… (macOS Ventura+) or Advanced…
  4. Click the DNS tab
  5. Click + and add 3.12.124.91
  6. Click OK then Apply

iPhone & iPad (iOS / iPadOS)

Set DNSAFE on each Wi-Fi network you want protected (home, office):

  1. Go to Settings → Wi-Fi
  2. Tap the ⓘ icon next to your network
  3. Scroll down to Configure DNS and tap it
  4. Select Manual, tap + and add 3.12.124.91
  5. Tap Save
⚠️
This only applies to that one Wi-Fi network. To protect the iPhone everywhere (mobile data, school, public Wi-Fi): in my.dnsafe.net → Devices, choose Add a phone, tablet or laptop, pick iPhone / iPad and open the setup link on the phone. It installs a DNSAFE profile with the device’s own encrypted DNS address.

Android

Option 1 — Private DNS (DNS-over-TLS, Android 9+) — recommended

  1. Open Settings → Network & internet (or Connections on Samsung)
  2. Tap Private DNS
  3. Select Private DNS provider hostname
  4. Enter your device’s own hostname and tap Save. To get it: my.dnsafe.net → Devices → Add a phone, tablet or laptop → Android. It looks like k7f3q9x2.dns.dnsafe.net.

This sends your phone’s DNS to DNSAFE encrypted, on any network, including mobile data. Your rules and Kids settings for that device apply wherever it is.

Option 2 — Per-Wi-Fi (standard DNS)

  1. Go to Settings → Wi-Fi
  2. Long-press your network and tap Modify network or tap the gear icon
  3. Under IP settings, select Static
  4. Enter 3.12.124.91 in the DNS 1 field
  5. Tap Save

Router / Network-wide

Configuring DNS on your router protects every device on your home network automatically — no per-device setup needed.

RouterWhere to find DNS settings
Most home routersLog in to your router (usually 192.168.1.1 or 192.168.0.1) → WAN / Internet settings → DNS
TP-LinkAdvanced → Network → Internet → DNS settings (or DHCP settings for LAN DNS)
ASUSWAN → Internet Connection → WAN DNS Setting
NetgearAdvanced → Setup → Internet Setup → Domain Name Server (DNS) Address
Eeroeero app → Network settings → DNS
UniFiSettings → Networks → LAN → DHCP Name Server (Manual)
pfSense / OPNsenseSystem → General Setup → DNS Servers

Set the Primary DNS to 3.12.124.91. Leave the secondary blank or use your ISP's DNS as a fallback (note: fallback DNS bypasses DNSAFE filtering).

ⓘ
Register your router's WAN IP. Your router's WAN (public) IP is what DNSAFE sees. Go to my.dnsafe.net → Devices and register it. Many internet providers change it from time to time; see When your IP changes.

When your IP changes

If your internet provider gives your home a new address, DNSAFE no longer recognises it and websites stop loading at home. You can always still open my.dnsafe.net from that network to fix it:

  • One click: sign in from home. DNSAFE notices the new address and asks “Are you at home right now?”. Click Use … for Home Wi-Fi and confirm. You're protected again within about a minute.
  • By hand: Devices → Change IP on your home connection. It keeps its name, Kids profile and schedules.
  • Automatically: Devices → Auto-update → Turn on. You get a private link to put in your router's Dynamic DNS setting (if it allows a custom update URL), or in a scheduled task on a computer that's always on. The portal shows the exact command for Windows, Mac and Linux, and when the link last ran.

Treat the auto-update link like a password. If it's ever shared by mistake, click New link: the old one stops working at once. Phones and laptops added as devices (with their own DNSAFE setup) don't depend on your home IP at all.

DNS-over-HTTPS (DoH)#

DNS-over-HTTPS encrypts your DNS queries, preventing ISPs and network observers from seeing which domains you're looking up. DNSAFE supports DoH for all plans.

DoH URL https://dns.dnsafe.net/dns-query

Browser Configuration

BrowserHow to configure DoH
Chrome / Edge / BraveSettings → Privacy and Security → Security → Use secure DNS → Custom → paste the DoH URL
FirefoxSettings → Privacy & Security → DNS over HTTPS → Max Protection → Custom → paste the DoH URL
Safari (macOS)Safari uses your Mac’s DNS — set 3.12.124.91 in System Settings (see the macOS guide above)
💡
Browser-level DoH only encrypts DNS for that browser. For system-wide encrypted DNS on a phone, use Android’s Private DNS feature.

DNS-over-TLS (DoT)#

DNS-over-TLS provides encrypted DNS on port 853. It's ideal for routers and operating systems that support it natively.

Hostname dns.dnsafe.net
Port 853

Supported Platforms

PlatformDoT SupportHow to configure
Android 9+✅ NativeSettings → Network → Private DNS → enter dns.dnsafe.net
pfSense / OPNsense✅ SupportedSystem → General Setup → DNS → enable TLS → enter hostname
Windows 11✅ SupportedNetwork → DNS settings → DNS over HTTPS → custom provider
Linux (systemd-resolved)✅ SupportedEdit /etc/systemd/resolved.conf → set DNS=3.12.124.91 and DNSOverTLS=yes
iOS / macOSNot built inUse standard DNS 3.12.124.91 (see the iPhone and macOS guides)

Custom Allow & Block Rules#

In addition to the default DNSAFE filtering, you can create your own rules to block or allow specific domains. Custom rules apply to all registered devices on your account.

Adding a Rule

  1. 1
    Go to RulesLog in to my.dnsafe.net and click Rules in the left sidebar.
  2. 2
    Click + Add RuleEnter the domain and select Block or Allow.
  3. 3
    Wait for propagationRules take effect within 5 minutes. Flush your DNS cache if you need it immediately.

Block Rules

A block rule prevents any device on your account from resolving the domain. Enter just the bare domain — no http:// prefix or path:

  • ✓ tiktok.com — blocks the domain and all its subdomains
  • ✓ ads.example.com — blocks only this subdomain
  • ✗ https://tiktok.com/for-you — paths are ignored; enter domain only

Allow Rules

Allow rules let you whitelist a domain that would otherwise be blocked by DNSAFE's default filtering. This is useful if a legitimate site you use has been incorrectly flagged.

Flushing Your DNS Cache

After adding a rule, you may need to flush your device's DNS cache before the change takes effect:

PlatformCommand / Method
Windowsipconfig /flushdns in Command Prompt
macOSsudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder
Chrome browserVisit chrome://net-internals/#dns and click Clear host cache
iOS / AndroidToggle Airplane Mode on then off, or restart the device

Plans & Add-ons#

DNSAFE offers four consumer plans based on the number of devices you need to protect.

Free
Free
$0/mo
1 device
Personal
Personal
$2.99/mo
Up to 5 devices
Most popular
Family
$7.99/mo
Unlimited devices · parental controls
Pro
Pro
$12.99/mo
Up to 25 devices · API access

Full plan comparison: dnsafe.net/pricing.

What's included on all plans

  • ThreatGrid protection — blocks about 2.5 million malware, phishing, and threat domains
  • DNS-over-HTTPS and DNS-over-TLS support
  • Custom block and allow rules
  • Query logs (30 days)
  • Devices dashboard

Add-ons

Optional packs add extra categories on top of your plan. Prices are shown in your dashboard before you buy.

Add-onWhat it adds
Adult ContentAdult and explicit sites
GamblingBetting, casino and sportsbook sites
Crypto MiningCryptojacking scripts and mining pools
Social MediaFacebook, Instagram, TikTok, X, Snapchat and similar
StreamingVideo and music streaming services
DNS ShieldWireGuard tunnel that keeps DNSAFE filtering on devices away from home

Managing add-ons

Go to my.dnsafe.net → Account → Add-ons to enable or disable any pack. Changes are reflected in your next billing cycle.

Upgrading or downgrading

Go to my.dnsafe.net → Account → Plan and select a new plan. Upgrades take effect immediately. Downgrades take effect at the end of your current billing period.

Referral Programme#

Earn account credit by referring friends and family to DNSAFE. For every person who signs up using your referral link and subscribes to a paid plan, you receive one month free added to your account.

How it works

  1. 1
    Get your referral linkLog in to my.dnsafe.net and go to Account → Referrals. Your unique referral link is shown there — copy it to share.
  2. 2
    Share the linkSend it to anyone who might benefit from DNS filtering. When they click your link and sign up, they're automatically credited to your account.
  3. 3
    Earn creditOnce your referral subscribes to a paid plan, one free month is added to your account automatically. There's no limit to how many referrals you can make.
ⓘ
Credit is applied automatically. You don't need to do anything — the credit appears on your account page once the referral's first payment clears. Credits stack and are applied before any card charges.

Referral FAQ

QuestionAnswer
How long does a referral credit take to apply?Within 24 hours of the referred user's first successful payment
Do I earn credit for Free plan signups?No — credit is only earned when the referral subscribes to a paid plan
Can I refer someone who already has an account?No — referral credit only applies to new accounts
Is there a maximum number of referrals?No limit

Troubleshooting#

DNS check shows “Not protected”

Your device is either not using the DNSAFE resolver, or your IP isn't registered. Check both:

  1. Confirm DNS is set to 3.12.124.91 on your device (see the platform guides above)
  2. Log in to my.dnsafe.net → Devices and check that your current public IP is listed. If not, add it.

A site I blocked is still loading

  1. Check the rule exists in my.dnsafe.net → Rules
  2. Wait up to 5 minutes for the rule to propagate
  3. Flush your DNS cache (see the table in the Custom Rules section)
  4. Try opening the site in a private/incognito browser window

A legitimate site is being blocked

The site may be flagged in DNSAFE's ThreatGrid blocklist. To allow it:

  1. Go to my.dnsafe.net → Rules → + Add Rule
  2. Enter the domain and select Allow
  3. The site should be accessible within 5 minutes

If you believe a domain is incorrectly flagged, email support@dnsafe.net so we can review it.

My IP address changed

If your ISP issued you a new IP address, filtering will stop working until you update your registered IP. Log in to my.dnsafe.net → Devices, remove the old IP, and add your current one. Your current public IP is shown automatically on that page.

Filtering stopped working after a router restart

Some routers reset DNS settings on reboot. Check that your router still has 3.12.124.91 configured as the DNS server after restarting. If this keeps happening, check your router's DNS settings persistence and save the configuration.

Still need help?

Open a support ticket directly from the portal: my.dnsafe.net → Support → New Ticket. Or email us at support@dnsafe.net. We aim to respond within one business day.

Was this page helpful?Still stuck? Contact support