Has your router’s DNS been changed?
Every time a device in your home visits a website, it first asks a DNS server for the site’s address, and it uses the DNS server your router tells it to. An attacker who changes that one router setting can quietly redirect the whole household, and most sites would keep working, so you might never notice. In this lesson you’ll check the settings attackers change, confirm who really answers your lookups, and learn what to do if something’s wrong.
In this lesson
- Find the two DNS settings in your router and read them
- Check from a computer which DNS server really answers
- Know exactly what to do if your router has been tampered with
You’ll need: your router’s admin page, and a computer for part 2. The lookup is the same one used in What Your Internet Provider Sees (Course 2), if you’ve done it already.
Why attackers go after router DNS
In April 2026 the FBI warned that hackers working for Russian military intelligence had taken over vulnerable home and small-office routers and changed exactly these settings, so that devices behind them sent their lookups to servers the attackers controlled. From there, a lookup for a real site can be answered with the address of a fake one. The router itself still works normally, which is what makes it hard to spot. The full story is in Has Your Router’s DNS Been Hijacked?
Try it yourself · part 1
Read the router’s DNS settings
Routers keep DNS settings in two places. Check both:
- The internet (WAN) settings: look under Internet, WAN or Broadband for DNS server. This is what the router itself uses. It’s normally set to automatic (your provider’s DNS) or to a service you chose.
- The local (DHCP or LAN) settings: look under LAN, DHCP or Local network for DNS server or Primary DNS. This is what the router tells your devices to use. It’s normally blank, the router’s own address (like
192.168.1.1), or a service you chose. - Write down any DNS addresses you see. If either place lists an address that you didn’t set and that isn’t your provider’s, treat the router as tampered with and go to the steps at the end of this lesson.
192.168.1.1). It’s the router’s own setting, and the test below, that tell you where lookups really go.Try it yourself · part 2
Check who really answers
The name whoami.akamai.net answers with the address of the DNS server that asked for it. Look it up from a computer on your home network, with any VPN switched off:
🪟 Windows
Open the Command Prompt (press Windows, type cmd, press Enter) and run:
nslookup whoami.akamai.netIgnore the first Server line, which is usually your router. Use the address at the bottom.
🍎 Mac or 🐧 Linux
Open Terminal and run:
dig +short whoami.akamai.netIt prints one address. On Ubuntu, if dig is missing, install it with sudo apt install bind9-dnsutils.
- Paste the address into the ASN lookup to see which network it belongs to.
- Compare it with what you found in part 1:
- Your internet provider, and the router is set to automatic: as expected.
- A service you chose, such as Cloudflare, Google or Quad9: as expected.
- A company you’ve never heard of, or a hosting company, when you never set one: a warning sign. Go to the steps below.
- For a final check, run the DNS Checker on a site you use often, like your bank, and compare its answers with what your computer gets (
nslookup yourbank.com). Big sites often give different addresses to different DNS servers, so if they differ, look each one up in the ASN lookup: they should belong to the same company or the network it uses to deliver its site.
Choosing a DNS service on purpose
Setting a DNS service in the router’s local settings changes it for every device in the house at once, including ones you can’t configure yourself. Common choices:
| Service | Addresses | Worth knowing |
|---|---|---|
| Your provider (automatic) | Set automatically | Works everywhere; your provider sees every site name you look up |
| Quad9 | 9.9.9.9, 149.112.112.112 | Blocks domains known to host malware and phishing |
| Cloudflare | 1.1.1.1, 1.0.0.1 | Fast, privacy-focused |
8.8.8.8, 8.8.4.4 | Fast and reliable |
Most routers still send these lookups unencrypted, so your provider can read them on the way. Encrypted DNS is a device or browser setting instead, which Course 2 covers.
If your router’s DNS has been changed
- Factory-reset the router, rather than just correcting the DNS field. Whoever changed it may have changed other settings too, or still have the password. The reset button is usually a small hole on the back; most routers need it held in for around ten seconds, but check your router’s manual.
- Update the firmware before reconnecting everything, if an update exists.
- Set a new admin password and turn off remote management, as in Lesson 2.
- Replace the router if it no longer gets updates; otherwise the same flaw can be used again.
- Change the passwords you used while it was compromised, starting with your email, and sign out of other sessions where the service allows it.
- Run part 2 again to confirm lookups now go where they should.
Key takeaways
- Routers keep DNS settings in two places: the internet (WAN) settings and the local (DHCP) settings.
- Devices listing the router as their DNS server is normal.
- The whoami.akamai.net lookup shows which server really answers; the ASN lookup shows whose it is.
- An unknown DNS server you didn’t set means: factory reset, update, new admin password, and replace if unsupported.
- Certificate warnings on familiar sites are the clearest outside sign that something’s redirecting you.
Check yourself
Three questions. Pick one answer each and you’ll see why.
1. Your laptop says its DNS server is 192.168.1.1. What does that mean?
2. You find a DNS server in your router’s settings that you never set, belonging to a company you don’t recognise. What should you do?
3. Why can a hijacked router’s DNS go unnoticed for a long time?
Want to check DNS on each of your devices too? How to Check Your DNS Settings on Any Device covers phones, tablets and computers.
This lesson is part of the free course Secure Your Home Network, licensed under CC BY-NC-SA 4.0: you may share and adapt it for non-commercial use, with credit to ExamineIP and a link to the original.