← All setup help

Using MizpahGuard with Xfinity

If you went looking for the DNS setting on your Xfinity gateway and couldn’t find one you can change, you’re not missing something. It’s locked.

Why the usual steps don’t work

The gateway Xfinity provides (the xFi Gateway — models like the Technicolor XB6, and the XB7 and XB8) doesn’t let you enter your own DNS server when it’s running as your router. Many people also report that it redirects DNS requests from your devices to Xfinity’s own servers, so typing a DNS address into a laptop or phone may not take effect either. (We haven’t been able to confirm that second part from Xfinity’s own documentation, so treat it as likely rather than certain.)

The good news: you don’t need Xfinity to allow it. Pick whichever fits.

Option 1 — Whole home: use your own router (recommended)

This protects every device on your Wi-Fi. You’ll need a router or mesh system you own.

  1. Put the Xfinity gateway in bridge mode. Go to http://10.0.0.1 while connected to the gateway and sign in with your gateway’s admin login (Xfinity’s support pages explain how to find or reset it). Choose Gateway → At a Glance → Bridge Mode → Enable. The gateway’s own Wi-Fi turns off.
  2. Plug your router into the gateway and set up its Wi-Fi.
  3. Set DNS on your router to:74.208.171.84If the device also has an IPv6 DNS field, enter:2607:f1c0:f0da:1300::1
  4. Check your address in MizpahGuard. Go back to setup and let MizpahGuard re-detect your home’s address, then confirm it.

More detail (and what changes when the gateway steps aside) is in using your own router. If your Xfinity plan includes a home phone line, ask Xfinity whether it works in bridge mode first.

Option 2 — One device or browser at a time (no new hardware)

Protect a browser (Chrome, Edge, Firefox) with MizpahGuard’s secure-DNS address, or set DNS on a device: iPhone / iPad / Mac, Android, Windows, Chromebook, game consoles.

The browser option uses an encrypted connection, so the gateway can’t redirect it.

How to tell it’s working

The quick test: on the device you just set up, open example.com. On an unprotected device you see a plain page titled “Example Domain”. On a device protected by MizpahGuard you see our “It’s working” page instead — it is blocked on purpose, for every household, so you can tell at a glance. (Your browser may show a certificate warning first, as it does for any blocked site; continue past it.)

You can also open your home’s Activity tab in MizpahGuard and look for the device’s browsing within a minute. If the test page doesn’t appear, the device is still using another DNS server — recheck the steps, or contact support from your dashboard and tell us your device and internet provider.