Can you change DNS on an Xfinity gateway?
On most Xfinity gateways the DNS setting is missing or greyed out, so you can't point your whole home at DNSAFE from the gateway itself. These three ways work instead:
Open my.dnsafe.net on the phone and tap Protect this phone. It's covered on Wi-Fi and mobile data. Computers have their own short guide.
Device guides →Whole homeUse your own routerAbout 20 minutesPlug a TP-Link, NETGEAR, ASUS, eero, Google Nest or Linksys router into the provider's box and set DNSAFE there. Every device on its Wi-Fi is covered.
How to →Already have one?Your router is behind theirs5 minutesIf your Wi-Fi comes from your own router plugged into the provider's box, change DNS on your router. That's all you need.
Pick your router →Before you start
- Make a free DNSAFE account at my.dnsafe.net. No card needed.
- Register your home connection. In the app, go to Devices›Add a home connection. Your home's internet address is filled in for you. DNSAFE uses it to know the lookups are yours, so do this from home.
- Keep these two addresses handy. They're the same for every brand of router.Your DNSAFE addressesPrimary DNS
3.12.124.91Secondary DNS3.11.62.44Use both DNSAFE addresses. Don't put your internet provider's DNS in the second box: lookups that go there aren't filtered.
Use your own router
Xfinity supports this: Bridge Mode turns off the gateway's router and Wi-Fi and leaves the modem on, so your own router takes over.
- Open the Admin Tool. On a device connected to the gateway, go to
10.0.0.1. Sign in with admin and the password on the sticker on the bottom of the gateway. (If it won't open, allow Admin Tool access in the Xfinity app first.) - Turn on Bridge Mode. Go to Gateway›At a Glance and click Enable next to Bridge Mode, then OK. The gateway may restart, and its Wi-Fi turns off.
- Plug in your router. Connect it to any Ethernet port on the gateway. Only one device can be connected in Bridge Mode.
- Set DNSAFE on your router. Follow the guide for your brand:
Bridge Mode not offered? Xfinity doesn't allow it with Xfinity WiFi Extenders or Xfinity CyberSecure. Your router still works plugged into the gateway without it: connect your devices to your router's Wi-Fi, not Xfinity's.
Already have your own router?
Change DNS on the router your devices connect to:
Menu names can change with updates. If yours look different, the provider's own page is linked under Sources.
Check it worked
- Open
blocktest.dnsafe.neton any device on your Wi-Fi. You should see the DNSAFE block page. That means filtering is on. - Or run the DNS leak test. It should show DNSAFE answering your lookups.
- Still seeing the normal page? Turn Wi-Fi off and on again on that device (it keeps the old settings for a while), then try again.
Stop IPv6 DNS from skipping DNSAFE
Many internet providers give homes IPv6 as well as IPv4. Your router can then hand devices a second DNS server, your provider's IPv6 one, and phones and laptops may use it instead of DNSAFE. Lookups that go there aren't filtered. Do this if the protection test says Partly protected, or the block test works on some devices and not others.
Xfinity's gateway doesn't let you change its DNS, so this applies when your devices use your own router.
The DNS your devices get comes from the router whose Wi-Fi they're on. If that's your own router (behind the provider's box), turn IPv6 off there. Pick your router:
Then turn Wi-Fi off and on on your phone and run the protection test. It should say Protected. Browsing, streaming and gaming keep working over IPv4. If you'd rather keep IPv6, protect each phone and computer with its own DNS ID instead: in the DNSAFE app, add the device. DNS IDs send every lookup to DNSAFE.
Not set up yet? DNSAFE Home is free: block malware, scams and adult sites on every device.
Start freeIf something's not right
Websites stopped loading after the change
DNSAFE doesn't recognise your home's internet address yet. Open my.dnsafe.net from home: it will offer to use the new address. Internet providers change it from time to time; here's how to keep it up to date automatically.
Some devices aren't filtered
Your internet provider's IPv6 DNS is the usual reason: see Stop IPv6 DNS from skipping DNSAFE. A device with its own DNS setting, a browser with “secure DNS” turned on, or a VPN can also go around your router: see how to stop DNS filtering bypass, or set DNSAFE up on that device too.
The block test works on my router's Wi-Fi but not on Xfinity's
Devices still on the Xfinity Wi-Fi aren't covered. Move them to your router's Wi-Fi, or turn the Xfinity box's Wi-Fi off so there's only one network.
Some devices still aren't filtered (IPv6)
Your provider's box may also hand out its own IPv6 DNS, which phones and computers can use instead. See Stop IPv6 DNS from skipping DNSAFE.
Frequently asked questions
Can I undo Bridge Mode?
Yes. In the Admin Tool go to Gateway › At a Glance and set Bridge Mode to Disable. Xfinity says the device you do this from must be connected to the gateway with an Ethernet cable.
Does this cover phones away from home?
The router way covers devices at home. For phones away from home, use Protect this phone: it works on mobile data too.
Does changing DNS slow down my internet?
Usually not. DNSAFE answers from the region nearest you. Pages load the same; blocked sites just don't open.
Do I still need antivirus?
Yes. DNS filtering stops bad sites before they load, but it doesn't scan files already on a device. Use both.