Will a DHCP lease renewal replace my manual DNS addresses?

No. Manually configured DNS server addresses take precedence over DNS addresses supplied by DHCP for that interface. Renewing the IP lease alone does not switch DNS assignment back to automatic.

Can an IPv4 DNS server return IPv6 addresses?

Yes. A DNS query sent over IPv4 can retrieve an AAAA record containing an IPv6 address. The protocol used to reach the resolver does not restrict the address records it can return.

Does flushing the Windows DNS cache clear the provider's cache?

No. Running ipconfig /flushdns clears dynamically cached results in the Windows DNS client, not the remote resolver's cache. An upstream server can still return a result it has retained.

Will changing DNS override entries in the Windows Hosts file?

No. Changing DNS server addresses leaves the Hosts file unchanged. Applications using the Windows resolver can still receive an address from a matching local Hosts entry before a DNS server is queried.

Will Windows try the alternate server after an NXDOMAIN answer?

A valid NXDOMAIN response tells the Windows DNS client that the requested name does not exist, so the client does not retry another server on that adapter merely to seek a different answer. Alternate-server retries address failures such as an unanswered query, rather than correcting a returned name error.

Does enabling DoH also enable DNSSEC validation?

No. DoH protects the connection to the resolver, while DNSSEC validation checks signatures on DNS data. Selecting DoH does not by itself establish whether the resolver validates those signatures.

What does a non-authoritative answer in nslookup mean?

A non-authoritative answer comes from a server that is not authoritative for the queried zone, such as a recursive resolver returning a cached result. That label alone does not indicate a lookup failure.

What is the connection-specific DNS suffix?

A connection-specific DNS suffix is a domain name Windows can append to a short name when trying to resolve it. The suffix helps form the name being queried; it is separate from the DNS server address and normally does not need changing when you select a different resolver.

Why can ping fail even when the DNS server answers queries?

Ping sends ICMP echo requests, which a network or server may filter or limit separately from DNS traffic. A missing ping reply therefore does not by itself show that the DNS service is unavailable.

Do I need to change the network profile from Public to Private?

No. The Public or Private profile affects settings such as network discovery and sharing, rather than selecting DNS servers. Changing the profile is not a prerequisite for editing DNS addresses.

How to Change DNS Servers on Windows

Windows lets you change DNS servers in the network settings for the connection you want to edit. Choosing manual DNS addresses changes how that connection looks up names; it does not require assigning the computer a static IP address. Before editing the setting, note the existing DNS addresses and whether they were obtained automatically. That record makes rollback straightforward if a new provider cannot resolve a site you need.

Windows 11 offers DNS over HTTPS (DoH) controls for supported resolvers, so the server address and encryption behavior need separate attention. Windows 10's adapter properties let you change DNS addresses but do not offer those Windows 11 DoH controls. The steps depend on which version you use.

Identify the Adapter and Record Its DNS Settings

Open Settings and go to Network & internet. Identify the active Wi-Fi or Ethernet connection and choose the one whose DNS settings you intend to change. Record its preferred, alternate, and any additional DNS server addresses, including IPv6 entries. Note whether DNS is automatic or manual for each protocol. A VPN or managed policy may supply another DNS path; ask the administrator before changing a managed device.

Choose a resolver whose policy and privacy terms fit your use. Cloudflare's standard IPv4 pair, for example, is 1.1.1.1 and 1.0.0.1; Google's is 8.8.8.8 and 8.8.4.4. Use addresses published by the provider you actually select. Do not assume that a provider's security or family-filtering addresses behave like its standard resolver.

Set DNS on the Selected Windows 11 Connection

In Windows 11, open Settings, then Network & internet. For Wi-Fi, open the properties of the connected network; for Ethernet, open the active Ethernet connection. Find DNS server assignment and choose Edit. Select Manual to edit DNS addresses. If the connection uses IPv4, turn on IPv4 and enter the provider's addresses in the Preferred DNS and Alternate DNS fields.

If your connection uses IPv6 and the chosen service provides IPv6 resolvers, turn on IPv6 in the DNS editor and enter the corresponding addresses. For example, Cloudflare's standard IPv6 pair is 2606:4700:4700::1111 and 2606:4700:4700::1001. Keep the separate IP assignment setting unchanged, whether your computer already uses an automatic or a manually assigned IP address. Set the encryption options described below, then select Save.

Use another address from the same resolver service as the alternate, unless you deliberately want a resolver with a different policy. Mixing a filtering resolver with an unfiltered alternate can produce inconsistent outcomes when Windows switches servers. If a corporate network needs its own resolver for internal names, replacing it with a public server can make those names stop resolving.

Choose Windows 11 DoH and Fallback Behavior

Entering DNS IP addresses and enabling DNS over HTTPS are separate decisions. In the Windows 11 DNS editor, Off leaves requests to the specified server unencrypted. On (automatic template) lets Windows obtain the HTTPS template for a supported server. On (manual template) requires you to enter the provider's correct HTTPS endpoint in the DNS over HTTPS template field.

Check the encryption choice for each preferred and alternate address you entered. If Windows supplies an automatic template for your chosen server, use that option when you want DoH. For manual configuration, Cloudflare's standard resolver uses https://cloudflare-dns.com/dns-query; a provider's ordinary website address is not a substitute for a DoH endpoint. The endpoint must match the selected resolver service, including any filtering policy.

Fallback to plaintext controls what happens when a query cannot be sent over HTTPS. With fallback enabled, Windows can send that query unencrypted; with fallback disabled, Windows does not retry that server using plaintext. A lookup may fail if no configured server can answer using its allowed settings. Choose this behavior for each relevant address before saving, and record your choices to help diagnose problems later.

Change DNS Servers in Windows 10

On Windows 10, open Settings, then Network & Internet, and select Change adapter options. Right-click the active connection and open Properties. For IPv4 DNS, select Internet Protocol Version 4 (TCP/IPv4); for IPv6 DNS, select Internet Protocol Version 6 (TCP/IPv6). Choose Properties to open the selected protocol's settings.

Select Use the following DNS server addresses and enter the provider's preferred and alternate addresses for that protocol. Keep the separate IP address settings unchanged. If additional servers remain under Advanced, then DNS, compare them with the list you recorded before editing. Remove any old server you do not intend to keep.

Confirm the dialogs with OK. Repeat for the other protocol if the connection uses it and you want to set its DNS addresses too. Keep IPv4 addresses in the IPv4 settings and IPv6 addresses in the IPv6 settings.

This Windows 10 interface does not provide the automatic template, manual template, or plaintext fallback controls described for Windows 11. A browser or another application may offer encrypted DNS independently. Its setting does not establish that the Windows 10 adapter itself is using DoH.

Verify the Saved Settings

Reopen the DNS settings for the same connection and confirm the saved IPv4 and IPv6 addresses. On Windows 11, also confirm the DoH and fallback choices for the servers you configured. In Command Prompt, ipconfig /all displays the network configuration, including DNS servers for each adapter. Read the entry for the connection you changed; a disconnected adapter's addresses do not confirm the active connection's configuration.

Run nslookup example.com to check a public name, then check a name important to your work. Compare the server address shown by the command with the intended resolver. The result describes that command's lookup, not the DNS transport used by every Windows application. A browser with its own secure DNS setting or a connected VPN may use another resolver.

A successful lookup or page load alone does not prove DoH encryption or a performance improvement. Caches can supply results without a new DNS exchange, and download speed depends on more than DNS. Proving the transport requires evidence of the actual DNS exchange, such as an appropriately captured network trace. If internal names stop resolving after the change, check whether the previous network resolver was required.

Restore the Previous DNS Configuration

If the new settings cause problems, return to the same connection's DNS controls. For a previously automatic setup, choose Automatic (DHCP) under Windows 11 DNS server assignment. In Windows 10's TCP/IPv4 or TCP/IPv6 Properties, select Obtain DNS server address automatically for each protocol whose DNS settings you changed. Save or confirm the dialogs.

If the previous configuration was manual, restore the exact addresses you recorded, including any additional server list you changed. On Windows 11, restore the earlier encryption and fallback choices too. Check the affected names again after saving; if they still fail with the original configuration, the DNS change may not be the cause.