ZDNS.CO.ZA

ZDNS (Pty) Ltd · Reg. no. 2026/796623/07 · admin@zdns.co.za

ZDNS Router Setup Guides

Updated 18 October 2026

Protecting phones and laptops away from the office instead of an office router? Read our Phone and laptop setup guide (Android, iPhone/iPad, Mac & Windows 11) →

You do not need to be an IT specialist to set up ZDNS. All you are doing is telling your office router to send its address-book lookups (DNS) to our two South African security servers instead of your internet provider's default ones. Menu names vary between router models and firmware versions, so treat these steps as a guide and email us at admin@zdns.co.za if your screen looks different. Setup takes about 10 minutes, and because your account starts in shadow mode for the first 7 days, nothing can accidentally block your emails, calls or banking while you test.

Before you start: the two numbers you need

Write down or copy these two ZDNS addresses. Every router calls them Primary DNS (or DNS 1) and Secondary DNS (or DNS 2):

  • Primary DNS (Server 1): 139.84.232.67
  • Secondary DNS (Server 2): 34.35.85.199

Both servers check lookups in the exact same way, and they run at two separate hosting providers so your office internet keeps working smoothly even if one provider has maintenance.

  1. Check that your office is connected. On a computer connected to the office Wi-Fi or network cable (not mobile data or a VPN), log in to your ZDNS dashboard. The “Your office connection” card says whether the address you are browsing from is protected; if it isn't, press “Use this address”. You never need to type an address in: ZDNS registers the network you are on. ZDNS only accepts lookups from registered office addresses.
  2. Enter only the two ZDNS addresses. If your router has a third box (DNS 3), leave it blank. Do not put 8.8.8.8, 1.1.1.1 or your ISP's address in the backup slot—computers use all listed servers at random and would skip ZDNS part of the time.
  3. Have your router login handy. Look at the sticker on the underside or back of your office router. It usually shows a web address (such as 192.168.1.1 or 192.168.8.1) and an Admin username and password.

Huawei Routers (Vumatel, Openserve & ISP Fibre Routers)

Huawei routers (such as the EchoLife HG8145, EG8145V5, AX2, AX3 or B535/B612 LTE routers) are the most common boxes supplied with Vumatel, Openserve, MetroFibre, Afrihost, Webafrica and Telkom connections.

  1. Connect a computer to the office Wi-Fi or plug it into the router with a network cable.
  2. Open your web browser (Chrome or Edge), click the address bar at the very top (not the Google search box), type the address printed on the sticker under your router—usually http://192.168.8.1, http://192.168.18.1 or http://192.168.100.1—and press Enter.
  3. Sign in with the Admin username and password printed on the router's sticker.
  4. Look for the local network settings. Depending on your Huawei model, the menu may be called Advanced → LAN → DHCP Server, Network Settings → LAN → DHCP, or More Functions → LAN Settings.
  5. Find the fields for DNS servers. They may be called Primary DNS Server / Secondary DNS Server or DNS Server 1 / DNS Server 2. (If there is a tick-box or dropdown called "Set DNS manually" or "Custom DNS", switch it on first.)
  6. Enter 139.84.232.67 in the first box and 34.35.85.199 in the second box. Delete any other DNS addresses shown there.
  7. Click Apply or Save.
  8. Turn the Wi-Fi on your computer off and back on again (or restart the computer) so it picks up the new setting.

If the DNS boxes are greyed out: Some fibre providers lock the DNS setting on the white fibre box (ONT) they supply. If you cannot edit the boxes, email or WhatsApp your ISP's support desk and ask: "Please set our router's Primary and Secondary DHCP DNS servers to 139.84.232.67 and 34.35.85.199." They do this routinely in a couple of minutes.

TP-Link Routers (Archer, Deco Mesh & Omada)

TP-Link routers are managed either through a web browser (most Archer and TL-WR/ER office routers) or through the TP-Link Deco / Tether phone app.

In a web browser (Archer & standard TP-Link office routers):

  1. Open a browser on an office computer, go to http://tplinkwifi.net, http://192.168.0.1 or http://192.168.1.1, and log in with your router password.
  2. Click the Advanced tab at the top (if your model has Basic and Advanced tabs).
  3. Open the network menu on the left. The menu may be called Network → DHCP Server or Network → Internet on your model.
  4. Set both the DHCP Server DNS and Internet (WAN) DNS if both are shown:
    • Under Network → DHCP Server, put 139.84.232.67 in Primary DNS and 34.35.85.199 in Secondary DNS, then click Save.
    • Under Network → Internet, if there is an Advanced section or a choice between "Get Dynamically from ISP" and "Use the Following DNS Addresses", choose Use the Following DNS Addresses, enter 139.84.232.67 and 34.35.85.199, and click Save.
  5. Disconnect and reconnect your computer's Wi-Fi so it receives the new setting.

In the TP-Link Deco app (Deco mesh Wi-Fi systems):

  1. Open the Deco app on your phone and tap More (the grid icon at the bottom right), then tap Advanced.
  2. Tap DHCP Server (or IPv4 on some versions), change DNS from Automatic to Manual if prompted, and enter 139.84.232.67 as Primary DNS and 34.35.85.199 as Secondary DNS.
  3. Tap Save at the top right.

MikroTik RouterOS

Many South African offices and IT technicians use MikroTik routers (such as the hAP ac², hAP ax³ or RB4011). You can change the setting either through the visual menu (WebFig in your browser or WinBox) or by pasting two lines into the terminal.

Option A: Using the menu (WebFig or WinBox):

  1. Log into your MikroTik router (usually http://192.168.88.1 in a browser, or via WinBox).
  2. In the left-hand menu, click IP → DNS. In the Servers field, enter 139.84.232.67 and click the small down-arrow next to the box to add a second row with 34.35.85.199. Remove any other addresses listed there, make sure Allow Remote Requests is ticked, and click OK or Apply.
  3. In the left-hand menu, click IP → DHCP Server, open the Networks tab, and double-click your office network row. Set DNS Servers to 139.84.232.67 and 34.35.85.199, then click OK.

Option B: Copy-paste for your IT person (New Terminal):

/ip dns set servers=139.84.232.67,34.35.85.199 allow-remote-requests=yes
/ip dhcp-server network set [find] dns-server=139.84.232.67,34.35.85.199

The first line sets what the router itself uses and what devices get when they ask the router for DNS. The second hands the two addresses straight to computers on the network. Reconnect Wi-Fi or restart one computer to pick up the change.

Optional, stricter: your IT person can add a firewall filter rule that drops outbound port 53 (UDP and TCP) to every address except 139.84.232.67 and 34.35.85.199, so no device can bypass ZDNS by using its own hardcoded DNS.

Ubiquiti UniFi (UniFi Express, Dream Machine & Cloud Gateways)

  1. Sign into your UniFi Console (at https://unifi.ui.com or your gateway's local IP address), open the Network application, and click the Settings gear icon on the left.
  2. Click Internet, select your primary internet connection (the menu may be called WAN or Primary (WAN1) on your model), and scroll down to DNS Server.
  3. Untick Auto next to DNS Server (or switch from Auto to Manual), enter 139.84.232.67 in Primary Server and 34.35.85.199 in Secondary Server, and click Apply Changes.
  4. Next, still in Settings, click Networks and open your office network (usually called Default or LAN).
  5. Scroll to DHCP Service Management (the menu may be called Advanced → DHCP Name Server on older controllers), untick Auto next to DNS Server, and enter 139.84.232.67 and 34.35.85.199 in the first two boxes, leaving boxes 3 and 4 blank.
  6. Click Apply Changes, then disconnect and reconnect Wi-Fi on one computer.

If your UniFi gateway has "DNS Shield" (Encrypted DNS) or Content Filtering turned on, switch those off or tell us—they redirect DNS lookups away from your custom servers.

Any Other Router (Generic Step-by-Step Guide)

If your office uses D-Link, Asus, Netgear, Nokia, Zyxel, Totolink, Cudy or another brand, the steps follow the same pattern:

  1. Find the router's web address and password. Check the sticker on the underside or back of the router. Look for "Default Access", "Router IP" or "Gateway" (commonly 192.168.1.1, 192.168.0.1 or 10.0.0.2) and the Admin username and password.
  2. Sign in from an office computer. Type that address into your browser's top address bar and sign in.
  3. Find the DNS setting. Look for a menu that may be called Network, Internet (WAN), Local Network (LAN), or DHCP Server on your model. Often it sits under an Advanced tab.
  4. Switch DNS from Automatic to Manual. Change the option that says "Obtain DNS automatically from ISP" or "Use default DNS" to Manual, Static or Use these DNS servers.
  5. Type in the two ZDNS addresses. Enter 139.84.232.67 as the first (Primary) DNS server and 34.35.85.199 as the second (Secondary) DNS server. Remove any other DNS numbers.
  6. Save and reconnect. Click Save or Apply. Turn your computer's Wi-Fi off and on again (or unplug and replug its network cable) so it picks up the new address book immediately.

Fortinet FortiGate, pfSense, OPNsense, Sophos & SonicWall

Fortinet FortiGate. Go to Network → DNS, choose Specify, set Primary DNS Server to 139.84.232.67 and Secondary DNS Server to 34.35.85.199. Then go to Network → Interfaces, edit your LAN interface, and under DHCP Server set DNS Server to Specify with 139.84.232.67 and 34.35.85.199. (CLI: config system dns, set primary 139.84.232.67, set secondary 34.35.85.199, end.)

pfSense and OPNsense. In pfSense under System → General Setup (or OPNsense under System → Settings → General), add 139.84.232.67 and 34.35.85.199 and untick "Allow DNS server list to be overridden by DHCP/PPP on WAN". In Unbound DNS / DNS Resolver, enable Forwarding Mode so it asks ZDNS instead of resolving directly.

Sophos and SonicWall. Under Network → DNS, specify static IPv4 DNS servers 139.84.232.67 and 34.35.85.199 only, and set the same two addresses in your LAN DHCP Server scope.

Windows domain or an internal DNS server

If your office computers sign into a local Windows Server domain (Active Directory), do not change the DNS setting on the computers or DHCP—staff PCs must keep pointing at your Windows server so they can find internal shared drives and printers.

Instead, on the Windows Server open DNS Manager, right-click the server name, choose Properties → Forwarders, and set 139.84.232.67 and 34.35.85.199 as the only forwarders. Untick "Use root hints if no forwarders are available" so it never skips ZDNS.

How to check it is working (and what can bypass it)

Once you have saved the change and reconnected your Wi-Fi, open your ZDNS dashboard—within a minute or two you will see your office's lookup counter ticking up.

If you want to double-check from a Windows computer, open the Start menu, type cmd to open Command Prompt, and type nslookup google.com then press Enter. The "Server" or "Address" shown at the top of the answer should be 139.84.232.67, 34.35.85.199, or your office router's local address.

Three things that can skip ZDNS if you don't watch out for them:

  • Web browsers with "Secure DNS" (DNS-over-HTTPS) turned on: Chrome, Edge and Firefox can bypass your router and send lookups straight to Google or Cloudflare. In your browser's Settings, search for "Secure DNS" and either turn it off or set it to "Use your current service provider".
  • Individual computers or phones with a manual DNS set on the device: Make sure staff laptops have their Wi-Fi DNS setting left on "Automatic (DHCP)".
  • Separate guest Wi-Fi networks or LTE failover routers: If your office fails over to a backup LTE router during a fibre outage, open your ZDNS dashboard on a computer while the office is running on the backup router and press “Add as another office”, and set the two ZDNS addresses on the backup router too.

Stuck or not sure which box to fill in? Email a screenshot of your router screen or the model number on the sticker to admin@zdns.co.za and we will walk you through it.