Can you change DNS on an AT&T gateway?
AT&T's gateways (such as the BGW210 and BGW320) don't let you change the DNS servers they give your devices. These three ways work instead:
Open my.dnsafe.net on the phone and tap Protect this phone. It's covered on Wi-Fi and mobile data. Computers have their own short guide.
Device guides →Whole homeUse your own routerAbout 20 minutesPlug a TP-Link, NETGEAR, ASUS, eero, Google Nest or Linksys router into the provider's box and set DNSAFE there. Every device on its Wi-Fi is covered.
How to →Already have one?Your router is behind theirs5 minutesIf your Wi-Fi comes from your own router plugged into the provider's box, change DNS on your router. That's all you need.
Pick your router →Before you start
- Make a free DNSAFE account at my.dnsafe.net. No card needed.
- Register your home connection. In the app, go to Devices›Add a home connection. Your home's internet address is filled in for you. DNSAFE uses it to know the lookups are yours, so do this from home.
- Keep these two addresses handy. They're the same for every brand of router.Your DNSAFE addressesPrimary DNS
3.12.124.91Secondary DNS3.11.62.44Use both DNSAFE addresses. Don't put your internet provider's DNS in the second box: lookups that go there aren't filtered.
Use your own router
AT&T calls this IP Passthrough: the gateway hands its internet address to your router, and your router runs your home network. AT&T doesn't support third-party routers, so keep the gateway's settings as they are apart from this.
- Plug in your router. Connect your router's internet (WAN) port to a LAN port on the AT&T gateway and turn it on.
- Open the gateway's settings. On a device connected to the gateway, go to
192.168.1.254. When asked, enter the Device Access Code printed on the gateway's sticker. - Turn on IP Passthrough. Go to Firewall›IP Passthrough. Set Allocation Mode to Passthrough and Passthrough Mode to DHCPS-fixed, choose your router in the device list, and click Save.
- Restart your router so it picks up the new address, then set DNSAFE on it:
Connect your devices to your router's Wi-Fi. You can turn the gateway's own Wi-Fi off in its settings so there's only one network.
Already have your own router?
Change DNS on the router your devices connect to:
Menu names can change with updates. If yours look different, the provider's own page is linked under Sources.
Check it worked
- Open
blocktest.dnsafe.neton any device on your Wi-Fi. You should see the DNSAFE block page. That means filtering is on. - Or run the DNS leak test. It should show DNSAFE answering your lookups.
- Still seeing the normal page? Turn Wi-Fi off and on again on that device (it keeps the old settings for a while), then try again.
Stop IPv6 DNS from skipping DNSAFE
Many internet providers give homes IPv6 as well as IPv4. Your router can then hand devices a second DNS server, your provider's IPv6 one, and phones and laptops may use it instead of DNSAFE. Lookups that go there aren't filtered. Do this if the protection test says Partly protected, or the block test works on some devices and not others.
AT&T's gateway doesn't let you change the DNS it hands out, so this applies when your devices use your own router.
The DNS your devices get comes from the router whose Wi-Fi they're on. If that's your own router (behind the provider's box), turn IPv6 off there. Pick your router:
Then turn Wi-Fi off and on on your phone and run the protection test. It should say Protected. Browsing, streaming and gaming keep working over IPv4. If you'd rather keep IPv6, protect each phone and computer with its own DNS ID instead: in the DNSAFE app, add the device. DNS IDs send every lookup to DNSAFE.
Not set up yet? DNSAFE Home is free: block malware, scams and adult sites on every device.
Start freeIf something's not right
Websites stopped loading after the change
DNSAFE doesn't recognise your home's internet address yet. Open my.dnsafe.net from home: it will offer to use the new address. Internet providers change it from time to time; here's how to keep it up to date automatically.
Some devices aren't filtered
Your internet provider's IPv6 DNS is the usual reason: see Stop IPv6 DNS from skipping DNSAFE. A device with its own DNS setting, a browser with “secure DNS” turned on, or a VPN can also go around your router: see how to stop DNS filtering bypass, or set DNSAFE up on that device too.
The block test works on my router's Wi-Fi but not on AT&T's
Devices still on the AT&T Wi-Fi aren't covered. Move them to your router's Wi-Fi, or turn the AT&T box's Wi-Fi off so there's only one network.
Some devices still aren't filtered (IPv6)
Your provider's box may also hand out its own IPv6 DNS, which phones and computers can use instead. See Stop IPv6 DNS from skipping DNSAFE.
Frequently asked questions
Can I undo IP Passthrough?
Yes. In the gateway's settings, go back to Firewall › IP Passthrough, set Allocation Mode back to its default and save.
Does this cover phones away from home?
The router way covers devices at home. For phones away from home, use Protect this phone: it works on mobile data too.
Does changing DNS slow down my internet?
Usually not. DNSAFE answers from the region nearest you. Pages load the same; blocked sites just don't open.
Do I still need antivirus?
Yes. DNS filtering stops bad sites before they load, but it doesn't scan files already on a device. Use both.