How to Fix DNS Issues: Slow Browsing, DNS Leaks and DoH Setup

Key takeaways

• Test by IP first. If ping 8.8.8.8 works but ping google.com fails, the problem is DNS.
• dig shows the query time and which server answered, so use it to compare resolvers.
• Flushing the cache fixes stale answers, but not a bad resolver.
• DNS over HTTPS encrypts lookups. It does not hide the sites you visit from the destination or your resolver.

Step 1: Confirm it is DNS

Run two tests.

ping 8.8.8.8
ping google.com

If the first works and the second says the name cannot be resolved, your connection is fine and DNS is failing. If both fail, the problem is the network, not DNS. For that, follow the network troubleshooting guide.

Step 2: See which resolver you are using

# Windows
ipconfig /all

# Linux (systemd-resolved)
resolvectl status

# macOS
scutil --dns | head -20

Look for "DNS Servers". Usually this is your router's address, which forwards to your ISP's resolver.

Step 3: Measure it

dig example.com
dig @1.1.1.1 example.com
dig @8.8.8.8 example.com

In the output, find the line Query time: 23 msec and the SERVER: line. Run each twice, because the second answer may come from cache. If your router's query time is much slower than a public resolver on repeated tests, the router or ISP resolver is the weak point. On Windows without dig, use nslookup example.com 1.1.1.1.

dig also helps with other symptoms: dig +short example.com returns just the IP; a SERVFAIL status means the resolver could not get an answer; NXDOMAIN means the name does not exist.

Step 4: Flush the cache

Stale or wrong cached answers cause "site works for others but not me". Clear the local cache.

# Windows (run as administrator)
ipconfig /flushdns

# Linux with systemd-resolved
sudo resolvectl flush-caches

# macOS
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

Browsers keep their own DNS cache too. Restarting the browser clears it. Also check the hosts file for old manual entries that override DNS.

Step 5: Change resolver

If Step 3 showed slow or failing lookups, set a different resolver on your device or router. Common public resolvers include Cloudflare (1.1.1.1), Google (8.8.8.8) and Quad9 (9.9.9.9). Check each provider's privacy policy, because your resolver sees every domain you look up. A company or school network may require its own resolver for internal names, so do not change it there without permission.

On Linux with systemd-resolved, you can set DNS= in /etc/systemd/resolved.conf and restart the service. On Windows and macOS use the adapter's network settings.

Step 6: Understand and enable DNS over HTTPS (DoH)

Ordinary DNS is sent in clear text, so anyone on the path can see which domains you ask for and may alter answers. DNS over HTTPS wraps the query in HTTPS, as defined in RFC 8484. Firefox and Chrome both have a "secure DNS" setting, and recent Windows and Android versions can use it system-wide.

What DoH does: stops local eavesdropping and tampering with the lookup. What it does not do: hide the IP addresses you connect to, or hide your history from the resolver you chose. Some corporate filters and parental controls depend on plain DNS and may break with DoH.

Step 7: Check for DNS leaks

A DNS leak happens when you use a VPN but your lookups still go to your ISP's resolver, so your ISP can still see the sites you visit.

1. Connect to your VPN.
2. Run resolvectl status or ipconfig /all and see which DNS servers are active.
3. Use a reputable DNS leak test site, and see whose servers answer. If they belong to your ISP while the VPN is on, you have a leak.

Fixes: use a VPN client that sets its own DNS and blocks leaks, make sure IPv6 is handled by the VPN, and do not hard-code ISP resolvers in the adapter.

What are the common mistakes?

• Changing resolver when the real problem is Wi-Fi signal.
• Flushing the cache repeatedly without testing a second resolver.
• Assuming DoH hides your browsing from everyone.
• Leaving a hard-coded DNS on a laptop that later joins an office network.

Next steps

To see what happens inside a lookup, read the life of a DNS query. For the command-line toolkit, see essential Linux networking commands. If you want to work in networking professionally, the CCNA 200-301 course covers DNS as part of IP services.

Related reading

• Top VPNs for Online Privacy and Security | Features, Comparisons, and Best Picks for Safe Browsing