DNS IP Changing

Norton 360 for Windows
1

I am having an issue where the IP address of the DNS server is changing to 149.112.112.254 as the primary DNS server which appears to be a valid server hosted by Quad9. That said that DNS is not responding for me. If I manually change the DNS to either automatic via DHCP or manually change it to 8.8.8.8 after a period of time it is reverting to the Quad9 server stated above. This last time it was after about 2 weeks. I have not tracked how long between reverts. I cannot figure out what may be doing this. We do not use the VPN aspect of Norton. Has anyone else seen this behavior? Can it be Norton that is “fixing” the DNS address when it senses that it was changed?

2

@bb613 If I read your post correctly you are saying that your DNS settings are changing to Quad 9 without any input nor changes on your part. First allow us to ask:

What is your OS, its version and build?

What is the version and build of your Norton 360 install?

Do you have your DNS settings within your router set to 8.8.8.8 AND your network adapter settings are the same?

Have you checked your Windows host file for possible entries that shouldn’t be there?

Here are some things you can consider to TS more on your side:

AI Overview

Your DNS keeps changing to Quad9 (9.9.9.9 or 149.112.112.112) usually because an app, security software, or your router’s DHCP settings are actively overriding your manual configurations.

Common Causes & Fixes

  • Security Software or Antivirus: Certain security programs or enterprise tools enforce secure or filtered DNS (like Quad9, which blocks malware by default) at the operating system level. Check your active antivirus or ESET-like security tools to see if a “secure DNS” or “web protection” feature is overriding your network adapter. [1, 2]

  • Router DHCP Settings: If your computer is set to obtain IP settings automatically (DHCP), your router assigns the DNS servers. If your router’s WAN or LAN settings are configured to use Quad9, every device connected to it will adopt Quad9 automatically. Log into your router admin panel to inspect the DNS configuration. [1, 2, 3]

  • Active VPN or Privacy Apps: Many VPN clients, proxy tools, or custom DNS apps (such as Quad9 Connect or NextDNS) inject their own profiles or override system network settings when active. Check if a background privacy utility is rewriting your adapter configurations. [1, 2]

  • Operating System Encrypted DNS Profiles: Windows, macOS, or mobile operating systems may have a pre-configured “Private DNS” or “DNS over HTTPS” template saved under active network profiles that forces a fallback to Quad9. [1, 2]

Further Exploration

  • Read about automated configurations on the ESET Support Forum to see similar reports of devices adopting Quad9 automatically.

  • Review protocol definitions on the Quad9 Documentation FAQ to check how your operating system handles encrypted queries

SA

3

Windows 11 professional all updates applied. Do not have access to that computer not but I am pretty certain that it too is fully up to date. Router is set to get the DNS from the ISP. I have tried setting windows to grab the DNS from the router via DHCP and have also tried to manually set it to 8.8.8.8 Both revert to the Quad9 DNS servers that are not working.

I have looked at all I found via AI and the only security software I see on the computer is Norton 360. Being that the DNS is switched to a Quad9 DNS would make me believe that this is not being caused by malware. This would not be an issue if the DNS servers were working.

4

Set up DNS on your router for 8.8.8.8 primary and 1.1.1.1 secondary, mirror the same on your network adapter and reboot the router and machine. Recheck and please advise if things change for you. Norton isn’t changing your DNS settings on either your router nor Windows.

AI Overview

No, standard Norton 360 installations do not automatically change your computer’s local TCP/IP DNS server configuration to a third-party or custom address.

How Norton Handles Network and DNS Traffic

  • Traffic Inspection: Instead of rewriting your operating system’s network adapter properties, Norton 360 uses its built-in Smart Firewall and Web Protection features to intercept and monitor web traffic dynamically.

  • VPN Services: If you turn on the Norton Secure VPN feature, your device routes web traffic through a virtual private network. This changes how DNS requests are resolved while the VPN is active, as queries go through Norton’s secure VPN DNS servers rather than your local provider.

  • Legacy Services: Historically, Norton offered an optional, discontinued content-filtering service called Norton ConnectSafe, which did require users to manually input specific DNS server IP addresses into their computer or router settings. It is no longer active or bundled as a default setting. [1, 2]

Troubleshooting DNS Issues

If you notice connection or name-resolution errors after a Norton update: [1]

  • It is usually caused by the Smart Firewall or Intrusion Prevention System over-filtering or temporarily blocking legitimate network packets.

  • You can clear local anomalies by flushing your system cache via the command prompt (ipconfig /flushdns) or resetting your network adapter settings.

SA

5

I do not have access to the computer now but this is what I got from AI last night. Gemini.

Yes, Norton 360 can change or interfere with your DNS settings even if you do not use its VPN feature.

Norton impacts your Windows 11 DNS settings through two primary features:

1. The Norton Driver Updater (Most Common Cause)

Norton 360 includes a built-in Driver Updater utility. If this feature runs automatically in the background, it can update your Wi-Fi or Ethernet network adapter drivers. When Windows installs a fresh network driver, it frequently resets the adapter’s properties back to factory defaults. This wipes out any manual DNS addresses you previously saved and forces the PC back to your router’s automatic choice.

2. Smart Firewall and Intrusion Prevention

The software includes an aggressive web protection system. In some instances, major background updates to the Norton antivirus definition database cause its firewall to misinterpret custom DNS traffic as a security risk. To prevent what it views as “suspicious activity,” Norton can intercept, block, or redirect your network’s DNS queries to default secure paths.

How to Stop It

  • Check Driver Updater: Open the Norton 360 dashboard, locate the Driver Updater tab, and turn off “Automatic Updates” so it stops altering your hardware settings without permission.

  • Exempt your Router: Go to Norton’s Firewall Settings and add your router’s local IP address (usually 192.168.1.1 or 192.168.0.1) to the Trusted Zone. This stops the firewall from meddling with the local network’s DNS handshakes.

Are you seeing your DNS change to automatic/blank, or is it switching to a specific set of numbers? Knowing this can help pinpoint exactly which Norton module or Windows setting is causing it.

6

Interesting!! Two conflicting AI entries. To date I haven’t have any issues with Norton 360 changing local adapter nor router DNS settings on any of my machines. Have you reviewed your Windows hosts file for entries that shouldn’t be there?

SA