How to Check if Malware Changed Router DNS Settings (September 2026) Full Guide

If your browser keeps sending you to the wrong websites or your antivirus keeps flashing DNS warnings, your router may have been compromised. Learning how to check if malware changed your router’s DNS settings is one of the most valuable skills a home user can pick up, because DNS hijacking silently affects every device on your network.

I wrote this guide after helping three friends in the last year diagnose the same problem. Each one noticed strange redirects or sluggish connections before realizing their router was the culprit. In this article, I’ll walk you through what DNS hijacking is, how to spot the warning signs, the exact steps to verify your router’s DNS, and how to restore and protect your network.

What Is DNS Hijacking and How Does Malware Affect Your Router?

DNS hijacking is a type of cyberattack where malware changes the DNS (Domain Name System) settings on your router so that your internet traffic gets routed through attacker-controlled servers. Instead of typing a web address and reaching the legitimate site, your browser ends up at a lookalike page designed to steal credentials, inject ads, or push more malware.

The Domain Name System works like the phonebook of the internet. When you type “google.com,” your device asks a DNS server for the IP address that maps to that name. If the DNS server is malicious, it can return any IP address it wants. Attackers exploit this by replacing legitimate entries with phishing sites or tracker-heavy domains.

Your router is a prime target because it hands out DNS settings to every device that joins your network through DHCP. Once the router is compromised, every phone, laptop, smart TV, and IoT gadget inherits the malicious DNS automatically. Malware typically gets onto a router by exploiting outdated firmware, using the default admin password, or abusing exposed remote management ports.

The infamous DNSChanger malware from the early 2010s infected millions of routers worldwide, and similar families like GhostDNS and Malsmoke continue to circulate. According to Fortinet and Norton security research cited in 2026, DNS hijacking remains one of the most common home network threats because the symptoms are subtle and the fix is rarely obvious.

Warning Signs Your Router DNS May Be Compromised

Before you log into your router, there are a few red flags that strongly suggest DNS tampering. I always tell people to look for these symptoms first because they confirm the problem is at the router level rather than on a single device.

• You type a familiar website address and end up on a completely different domain, especially one with strange spelling or a different top-level domain.

• Search results redirect through unfamiliar “click trackers” or suspicious “virus found” pop-ups before reaching the real site.

• Multiple devices on your home network show the same unusual behavior at the same time.

• Your antivirus or browser flags a “DNS hijacking” or “DNS changer” warning.

• Your router’s admin password suddenly stops working, or the username reverts to “admin” after you changed it.

• You notice unfamiliar devices in your router’s connected clients list, or activity logs showing logins at odd hours.

If two or more of these match your situation, you have strong reason to suspect DNS hijacking. The next step is to look directly at your router settings to confirm.

Step-by-Step: How to Check Your Router’s DNS Settings

Checking your router’s DNS settings only takes a few minutes, even if you’ve never touched your router’s admin page before. Here’s the exact process I walk people through.

Step 1: Find Your Router’s IP Address

Most routers use 192.168.0.1, 192.168.1.1, or 192.168.1.254 as their default gateway. You can find yours by opening a command prompt on Windows (type ipconfig and look for “Default Gateway”) or by checking Network Settings on macOS, iOS, or Android. The default gateway is your router’s address.

Step 2: Log Into the Admin Page

Open a browser and type the gateway IP into the address bar. You’ll see a login screen asking for a username and password. If you’ve never changed them, common defaults include “admin/admin” or “admin/password.” Look up your specific router model online if those don’t work.

Step 3: Locate the DNS Settings

Once logged in, look under sections labeled “Internet,” “WAN,” “Network,” or “DHCP.” On TP-Link routers, it’s under Advanced > Network > Internet. On Netgear, it’s under Basic > Internet. On Asus, it’s under WAN > Internet Connection. Most routers list two DNS fields: a primary and a secondary server.

Step 4: Compare Against Trusted DNS Servers

Write down the values you see. Trusted public DNS providers include Google (8.8.8.8 and 8.8.4.4), Cloudflare (1.1.1.1 and 1.0.0.1), and Quad9 (9.9.9.9 and 149.112.112.112). If your router’s DNS field is set to a random-looking IP address or an unfamiliar provider you didn’t choose, that’s a strong sign of hijacking.

If the field is set to “Obtain DNS automatically,” that’s also worth checking, because the upstream ISP-provided DNS could itself be compromised, or your router could be receiving tampered values from a man-in-the-middle.

How to Verify DNS Hijacking Using Command-Line Tools?

Most competitor guides stop at the router admin page, but command-line verification gives you rock-solid proof. If you want to be certain, run a quick test from any computer on the network.

On Windows, open Command Prompt and type nslookup google.com. The “Server” line shows which DNS server is actually answering your queries. If it shows anything other than what your router’s settings claim, you have DNS hijacking. You can also try nslookup with a specific server to compare results.

On macOS or Linux, open Terminal and use dig google.com or nslookup -type=ns google.com. The output will list the DNS server your system is using and the IP address it returned. Compare the IP against Google’s actual IP (142.250.x.x). If they don’t match, your DNS is being tampered with.

You can also use tracert (Windows) or traceroute (Mac/Linux) to see the network path to a known DNS server. If the route goes through an unfamiliar IP before reaching a legitimate DNS provider, that’s another warning sign. Combining these commands gives you evidence you can share with your ISP or security team.

Online DNS Leak Tests and Verification Tools

If you’d rather not use the command line, several free online services will tell you exactly which DNS servers your connection is using. These are especially useful if you suspect a leak but want a second opinion.

BrowserLeaks DNS Leak Test, DNSLeakTest.com, and ipleak.net are three popular options. Visit any of them and click the “Start Test” button. Within a few seconds, you’ll see a list of DNS servers your connection is using. The page also often shows your detected geographic location, which should match your actual region.

If you see DNS servers from countries you’ve never visited, or addresses that don’t match any known provider, that’s a clear sign of hijacking. Note the IPs, then compare them with the legitimate DNS list maintained by public DNS providers. Tools like the Quad9 DNS Checker can also confirm whether a specific resolver is responding properly.

For ongoing protection, security experts like those on Reddit’s r/techsupport often recommend enabling DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) in your router if it supports it. These protocols encrypt DNS queries so attackers can’t tamper with them at the network level.

How to Check DNS Settings on Mobile Devices?

Most competitor guides focus only on computers, but phones are just as vulnerable. If your router DNS is hijacked, your phone will inherit the same malicious settings unless you have mobile-specific protections enabled.

On Android, open Settings > Network & Internet > Wi-Fi, tap your connected network, and look for “Advanced” or “IP settings.” If it says DHCP, your phone is pulling DNS from the router automatically. Switch to “Static” temporarily to see what DNS values are being assigned. On iOS, go to Settings > Wi-Fi, tap the “i” icon next to your network, then scroll down to “Configure DNS” to view or change the values.

If your phone shows unfamiliar DNS servers when connected to home Wi-Fi but uses a normal provider (like your carrier’s default) on cellular data, the problem is definitely your router. This is one of the cleanest diagnostic tests you can run. Many users on community forums like Spiceworks have used this exact comparison to confirm router-level compromise.

How to Restore Your Router’s DNS Settings After Malware?

If you’ve confirmed the hijacking, it’s time to clean things up. Follow these steps in order to restore safe DNS and remove the malware foothold.

Step 1: Change DNS to a Trusted Provider

Back in your router’s admin page, replace any unfamiliar DNS values with trusted ones like Cloudflare’s 1.1.1.1 and 1.0.0.1, or Quad9’s 9.9.9.9 and 149.112.112.112. These providers filter known malicious domains at the resolver level, giving you a layer of protection even if other malware tries to phone home.

Step 2: Update the Admin Password

Change your router’s admin password to a long, unique string. Default passwords are how most router malware spreads in the first place. While you’re there, change the Wi-Fi password too, since the attacker may already have it.

Step 3: Update Firmware

Check your router manufacturer’s website for the latest firmware version. Firmware updates patch the specific vulnerabilities that router-targeting malware exploits. If your router is no longer supported by the manufacturer and cannot receive updates, that’s a strong argument for replacing it.

Step 4: Factory Reset if Necessary

If symptoms persist after the above steps, perform a factory reset. Hold the small reset button on the back of the router for 10-30 seconds while it’s powered on. This wipes all settings and removes most router-level malware, but you’ll need to reconfigure your network from scratch.

Step 5: Scan All Devices

After restoring the router, run a full malware scan on every device that connected to it during the compromise period. Tools like Malwarebytes, Bitdefender, or Windows Defender can detect DNS-changing trojans that may have been installed on individual devices. Disconnect devices from the network until they’re confirmed clean.

Prevention: How to Protect Your Router From Future DNS Hijacking?

Prevention is far easier than cleanup. After you’ve finished restoring your network, take these steps to keep it safe going forward.

First, never leave your router’s default credentials in place. The admin username and password should both be changed the moment you set up the router. Disable remote management unless you genuinely need it, because open admin pages on the public internet are a top attack vector.

Second, enable automatic firmware updates if your router supports them. Manufacturers regularly release patches for newly discovered vulnerabilities, and automatic updates ensure you’re protected without remembering to check manually.

Third, consider using a router with built-in security features like automatic malicious DNS filtering. Brands like Asus (with AiProtection) and Netgear (with Armor) include subscription or free threat intelligence that blocks connections to known bad domains.

Finally, periodically revisit the steps in this article. Check your router’s DNS settings every few months, run a DNS leak test, and review the connected devices list for anything unfamiliar. Community recommendations on forums like Reddit’s r/homelab consistently emphasize that consistent monitoring catches hijacking attempts long before they cause real damage.

Frequently Asked Questions

Final Thoughts

Learning how to check if malware changed your router’s DNS settings gives you control over a threat that quietly affects millions of networks. The steps are simple: log into your router, verify the DNS fields, cross-check with command-line tools and online leak tests, and replace anything suspicious with trusted providers like Cloudflare or Quad9.

Take 15 minutes today to walk through this guide on your own router. Change the default admin password, update the firmware, and set DNS to a provider you trust. If something looks off, follow the restoration steps methodically and scan every connected device. A little prevention now saves hours of troubleshooting later, and keeps every device on your home network safe in 2026.