Best DNS for Streaming: What It Fixes, What It Doesn’t, How to Set It

The best DNS for streaming is a fast, reliable resolver close to you: your internet provider’s own DNS, Cloudflare (1.1.1.1), Google Public DNS (8.8.8.8), Quad9 (9.9.9.9) or CIRA Canadian Shield all work well. DNS only finds the address of a server; it doesn’t add bandwidth or stop buffering. Change it when channels fail to start, not when they freeze.

What DNS does when you press play

Your player knows the server by name, but the internet routes data by number. The Domain Name System is the directory that turns one into the other. When you open a playlist or a channel, the player asks a DNS resolver for the address behind the server name, gets an answer, then connects to that address to download the video.

A lookup usually takes a few milliseconds to a few tens of milliseconds, and the answer is kept in a cache for a while, so the next request skips it. Once the stream is playing, DNS is out of the picture. The video itself never passes through the resolver.

Your devices get their resolver automatically from the router, which normally hands out the one your internet provider runs. A public resolver is simply another directory you can choose instead, and it is free.

What changing DNS will not do

This is where much of the advice online goes wrong. A different resolver cannot make your connection faster, because it isn’t in the path of the video. It doesn’t change your Mbps, your Wi-Fi signal, the congestion in your area or the load on the stream’s server.

• It won’t stop buffering in the middle of a program. That is a bandwidth, Wi-Fi or stability problem; start with our nine buffering fixes.
• It won’t lower ping to the stream. Ping depends on the route to the server, not on who looked up its address. Our guide to ping, jitter and packet loss covers what does.
• It won’t fix evening slowdowns. Peak-hour congestion happens on the line, not in the directory; see IPTV buffering in the evening.
• It won’t fix a rejected login. If the app says the username or password is invalid, the server was found and answered. Our login error guide covers that case.

If anyone promises that a DNS change will double your speed or end buffering for good, they are describing something DNS doesn’t do.

When changing DNS does help

DNS matters at the moment a connection starts. So a better resolver helps with problems that show up before the first frame, not after it.

• “Server not found” or “unable to resolve host” errors. If the player can’t turn the server name into an address, nothing loads. A resolver that is down, overloaded or returning bad answers causes exactly this.
• Slow starts everywhere. If every website and every app takes a second or two before anything happens, while pages load quickly once they begin, a slow resolver is a likely cause.
• Intermittent failures. Apps that sometimes connect and sometimes don’t, with nothing else wrong, can point to an unreliable resolver.
• Filtering. Some public resolvers block known malware and phishing domains, and family versions block adult content for the whole home. Our parental controls guide shows how that fits with app and device locks.
• Privacy. Encrypted DNS hides which names you look up from others on the network, and some resolvers make strong commitments about logging.

If the error message names an HTTP code such as 403 or 404 rather than a lookup failure, the server answered and DNS is not the issue. Our list of IPTV error codes explains each one.

The catch: the nearest server depends on the answer

Many large streaming and web services run on content delivery networks with servers in many cities. When your resolver asks for an address, the service often picks a server near the resolver, assuming you are close to it. With your provider’s DNS that is usually true. With a public resolver it usually is too, because the big ones answer from many locations, but not always.

Some resolvers send a shortened version of your network address along with the question so the service can pick a server near you. This is called EDNS Client Subnet (ECS), and Google Public DNS uses it.

Cloudflare’s 1.1.1.1 does not send ECS, as a privacy choice. Quad9 sends it only on a separate address, 9.9.9.11, and not on its main 9.9.9.9 service.

The practical lesson is simple. After a switch, check that channels and on-demand titles start as quickly as before. If they start more slowly, try another resolver or go back to automatic; the fastest directory is not always the one that gives the best directions.

Cloudflare and Google Public DNS

Cloudflare 1.1.1.1

Cloudflare’s resolver uses 1.1.1.1 and 1.0.0.1, with 2606:4700:4700::1111 and 2606:4700:4700::1001 for IPv6. The standard service does no filtering. Two variants add it: 1.1.1.2 and 1.0.0.2 block malware, and 1.1.1.3 and 1.0.0.3 block malware and adult content. All are listed on Cloudflare’s 1.1.1.1 address page.

For encrypted DNS on Android, the hostname is one.one.one.one. Cloudflare says it doesn’t write your IP address to permanent storage, deletes the shortened IP address it does keep within 25 hours, and has its practices audited by an outside accounting firm.

Google Public DNS

Google’s resolver uses 8.8.8.8 and 8.8.4.4, with 2001:4860:4860::8888 and 2001:4860:4860::8844 for IPv6, as shown on Google’s Public DNS setup page. The encrypted hostname for Android is dns.google.

Google Public DNS doesn’t filter content. It uses ECS to help services choose a nearby server. Its privacy page says the temporary logs that hold your full IP address are deleted within 24 to 48 hours.

Quad9 and CIRA Canadian Shield

Quad9

Quad9 is run by a Swiss-based non-profit foundation. Its main addresses, 9.9.9.9 and 149.112.112.112, with 2620:fe::fe and 2620:fe::9 for IPv6, block domains known to spread malware or phishing. Quad9 states that it doesn’t log your IP address.

The encrypted hostname is dns.quad9.net. If you need a version with no malware blocking, Quad9 offers 9.9.9.10 and 149.112.112.10, and the ECS version mentioned earlier is 9.9.9.11 and 149.112.112.11. The full list is on Quad9’s service addresses page.

CIRA Canadian Shield

CIRA, the not-for-profit organization that manages the .ca domain, runs Canadian Shield, a free resolver with three levels. Private does plain lookups, Protected adds malware and phishing blocking, and Family also blocks pornographic content. CIRA says it will never sell your personal data or use it for ads, and that your data stays in Canada.

The addresses follow one pattern: 149.112.121 and 149.112.122, ending in .10 for Private, .20 for Protected and .30 for Family. The encrypted hostnames are private, protected or family, followed by .canadianshield.cira.ca. The CIRA Canadian Shield address summary lists every address, including IPv6.

Side-by-side comparison

All four are free and fast enough for streaming in Canada. They differ in what they filter, what they log and how they help services find a nearby server. The first table gives the addresses to type; the second compares the services.

Which one should you choose?

For most homes, the honest answer is that any of them will do, and your provider’s own DNS is often just as quick. Choose by what matters to you beyond speed:

• You want plain, quick lookups and strong privacy: Cloudflare 1.1.1.1 or CIRA Canadian Shield Private.
• You want malware and phishing blocking for every device: Quad9 9.9.9.9, Cloudflare 1.1.1.2 or Canadian Shield Protected.
• You have children at home: Canadian Shield Family or Cloudflare 1.1.1.3, set on the router.
• You want a non-profit in Canada handling your lookups: CIRA Canadian Shield.
• Streams start more slowly after switching: try Google Public DNS, which sends ECS, or go back to your provider’s DNS.

Whichever you choose, set both the main and the backup address, and use the IPv6 addresses too if your network has IPv6. Otherwise devices may keep using your provider’s resolver over IPv6 without telling you.

Encrypted DNS: what it hides and what it doesn’t

Classic DNS travels unencrypted, so anyone who can see your traffic, such as others on a public Wi-Fi network, can read which names you look up. Encrypted DNS wraps those lookups. Android’s Private DNS uses DNS over TLS, and Windows 11 and many browsers use DNS over HTTPS.

All four resolvers in this guide support encryption, which is why each one has a hostname as well as numeric addresses. On a phone that joins hotel or café Wi-Fi, turning it on is a sensible privacy step.

Be clear about its limits. Encrypted DNS hides the lookup, not the connection that follows it, so your internet provider still sees which server addresses you connect to. It doesn’t make anything faster either. And because it can bypass the router’s DNS setting, a phone or browser with its own encrypted DNS will ignore a family filter you set on the router.

Test a resolver before you switch

You can ask a specific resolver for an answer without changing any settings. That shows whether it responds, and roughly how fast, from your home.

1. On Windows, open Command Prompt and type nslookup example.com 1.1.1.1. The second address is the resolver to ask; swap in 8.8.8.8, 9.9.9.9 or 149.112.121.10 to compare. A list of addresses means it works; a timeout means it doesn’t from your network.
2. To time it on Windows, open PowerShell and type Measure-Command { Resolve-DnsName example.com -Server 1.1.1.1 }. Read the TotalMilliseconds line, and run it a few times for each resolver.
3. On a Mac or Linux computer, open Terminal and type dig example.com @1.1.1.1. The result ends with a Query time line in milliseconds.
4. Test your provider’s resolver the same way by leaving out the address, so you have a baseline to compare against.

Run each test two or three times, because the first answer may need a full lookup and the next ones come from the resolver’s cache. A few milliseconds of difference won’t change anything you can see; a resolver that times out or takes hundreds of milliseconds will.

Change DNS on the router: once for every device

The router is the best place to change DNS, because every TV, stick, phone and console in the home picks it up automatically. It also covers streaming devices that make DNS awkward to change on their own.

1. Open the router’s settings page in a browser, using the address on its label (often 192.168.0.1 or 192.168.1.1), or open the router’s or mesh system’s app.
2. Look for DNS in the internet or WAN settings, or in the LAN or DHCP settings. Some routers have both; the LAN or DHCP one decides what your devices are told to use.
3. Switch from automatic to manual, enter the main and backup addresses, and the IPv6 pair if there is an IPv6 section.
4. Save, then restart your streaming devices or turn their Wi-Fi off and on so they pick up the new setting.

Some gateways supplied by internet providers don’t let you change DNS. In that case, set it on each device as shown below, or use your own router behind the gateway. Our router settings guide covers gateway modes and other options worth checking while you are there.

Change DNS on a Fire TV device

Fire TV has no stand-alone DNS setting. DNS can only be typed in when you join a Wi-Fi network with manual network settings, which also means entering a fixed IP address, the router’s address and a network prefix length yourself.

That works, but a mistake there takes the device offline, and a fixed address can clash with another device later. For most people, changing DNS on the router is the better choice for a Fire TV Stick or Fire TV Cube.

If you do want to set it on the device, first note its current details: open Settings → Network and press Play/Pause on the remote to see the network status. Then forget the network, join it again, and look for the advanced or manual option after the password screen, where you can fill in the two DNS fields. If anything stops working, forget the network and join it normally to go back to automatic settings.

Change DNS on Android TV and Google TV

On Android TV and Google TV devices, including TVs from several brands and set-top boxes, network options live under Settings → Network & Internet. Select your Wi-Fi network or Ethernet connection and look for IP settings.

As on Fire TV, the DNS fields usually appear only when you switch IP settings from automatic (DHCP) to static, which means entering the IP address, gateway and prefix length too. Menu names vary between brands and Android versions, so follow what your screen shows.

The same advice applies: the router is the safer place to make the change. If you set a static address on the TV, pick one outside the range your router hands out automatically, so two devices never end up with the same address.

Change DNS on Android phones and tablets: Private DNS

Android phones have a cleaner option called Private DNS, which sends lookups encrypted to the resolver you name. It works on Wi-Fi and mobile data alike. On most phones it is at Settings → Network & internet → Private DNS; on Samsung phones, open Settings → Connections → More connection settings → Private DNS.

1. Choose Private DNS provider hostname.
2. Type one hostname: one.one.one.one, dns.google, dns.quad9.net or private.canadianshield.cira.ca.
3. Tap Save, then open a website to confirm everything still loads.

Private DNS takes a hostname, not an IP address, so typing 1.1.1.1 in that field won’t work. The default, Automatic, uses encryption when your current network’s resolver supports it. If you mistype the hostname, apps may lose their connection; set it back to Automatic to undo.

Change DNS on iPhone, iPad and Apple TV

On iPhone and iPad, DNS is set per Wi-Fi network. Open Settings → Wi-Fi, tap the i button next to your network, then tap Configure DNS.

1. Change it from Automatic to Manual.
2. Tap Add Server and enter the main address, then add the backup.
3. Remove the old entries with the red minus button, then tap Save.

The setting applies only to that Wi-Fi network, so repeat it at the cottage or office if you want it there too. On Apple TV, open Settings → Network, select Wi-Fi or Ethernet, then select your current network for more configuration options; look for the DNS setting there and switch it to manual. Apple’s own setup tips for live TV are in our Apple TV IPTV guide.

Change DNS on Windows 11

Windows 11 lets you set DNS per connection and can encrypt it with DNS over HTTPS.

1. Open Start → Settings → Network & internet, then select Wi-Fi or Ethernet. For Wi-Fi, open your network’s properties.
2. Next to DNS server assignment, select Edit. On some versions the same fields appear under IP assignment → Edit.
3. Choose Manual, turn on IPv4, and enter the addresses in Preferred DNS and Alternate DNS. Turn on IPv6 and do the same if you use it.
4. Under DNS over HTTPS, On (automatic template) works with the well-known public resolvers. Leave Fallback to plaintext on if you would rather keep working than lose DNS when encryption fails.
5. Select Save.

Windows 10 has the manual DNS fields but not the DNS over HTTPS option in Settings.

Change DNS on a Mac

On a Mac running a recent version of macOS, open Apple menu → System Settings → Network, click your connection (Wi-Fi or Ethernet), click Details, then click DNS.

Under DNS Servers, click the + button and type the main address, then add the backup. Select your provider’s addresses and remove them with the − button if you want only the new ones used, then click OK. The change applies to that connection right away.

If you later want to check which resolver your Mac or any device is using with Cloudflare, Cloudflare’s help page at one.one.one.one/help shows whether your lookups reach 1.1.1.1.

Problems after changing DNS

Most changes go smoothly. When they don’t, the symptom usually tells you the cause:

• No internet at all: an address was mistyped, or a static IP clashes with another device. Set the connection back to automatic and try again.
• Some sites or apps blocked: you chose a filtering version, such as Quad9 9.9.9.9, Cloudflare 1.1.1.3 or Canadian Shield Family. Switch to the unfiltered version if the block is wrong.
• Channels start more slowly: the new resolver may be pointing you to more distant servers. Try another resolver or go back to your provider’s DNS.
• The change seems to do nothing: devices keep old answers in their cache, and browsers may use their own encrypted DNS. Restart the device; our guide to restarting the router and clearing the DNS cache shows how on each system.
• Family filter bypassed on one device: that device or browser uses its own DNS setting or a VPN. Check its settings, and see our post on VPNs and IPTV for how a VPN changes DNS.

For a wider look at keeping your home network safe, our guide to streaming privacy and security covers router passwords, firmware and app permissions.

Still can’t load channels?

If the playlist or channels still fail to load on two different resolvers, DNS isn’t the problem. Check that the server address in your player matches your welcome message exactly, and try the same login on another device.

Then message our Online Support chat with your device, your player app, the exact error on screen and which DNS you tried. We can check the server side and your account in a few minutes. That kind of help is included with every plan of our Canadian IPTV service.

Questions people ask