What are the best public DNS resolvers?
The best public DNS resolvers for most people are Cloudflare (1.1.1.1) for speed and privacy, Google Public DNS (8.8.8.8) for reliability and global reach, and Quad9 (9.9.9.9) for built-in malware blocking with strong privacy commitments. If you want ad and tracker blocking or parental controls, AdGuard DNS, OpenDNS and configurable services such as NextDNS and Control D are good options. All of them support encrypted DNS through DNS over HTTPS (DoH) and DNS over TLS (DoT), and all are free for personal use.
A public resolver is the server your device asks when it needs to turn a domain name into an IP address. Your internet provider gives you one by default, but you can choose another. This article explains what to look for in a resolver, compares the well-established public services, shows the exact addresses and encrypted endpoints to use, and walks through how to test them from your own network.
What a Public DNS Resolver Does
Every time you open a website, your device needs the IP address behind the name. It sends the question to a recursive resolver, which either answers from its cache or walks the DNS hierarchy (root, top-level domain and authoritative nameservers) to find the answer, then caches it for next time.
By default, your router hands out your ISP's resolver. A public resolver is one run by an independent organisation that anyone can use. People switch for a few reasons:
- Speed: A well-run resolver with a large cache and nearby servers can answer faster.
- Reliability: ISP resolvers sometimes fail or lag, while large public services rarely do.
- Privacy: Some public resolvers commit to strict logging limits and independent audits.
- Security: Many validate DNSSEC and some block known malicious domains.
- Filtering: Some block ads, trackers or adult content.
- No tampering: Some ISP resolvers redirect mistyped domains to search or advertising pages.
What to Look For
| Criterion | Why it matters |
|---|---|
| Anycast network size | More locations means lower latency and better resilience |
| DNSSEC validation | Rejects forged answers for signed domains |
| DoH and DoT support | Encrypts queries between your device and the resolver |
| Logging policy | Determines what is recorded about your browsing |
| Independent audit | Gives some assurance the policy is followed |
| Filtering options | Malware, phishing, ads or family filtering |
| ECS behaviour | EDNS Client Subnet can improve CDN routing but shares part of your IP address |
| Jurisdiction | Affects which laws apply to the operator |
The Best Public DNS Resolvers Compared
| Resolver | IPv4 | IPv6 (primary) | Filtering | DoH endpoint |
|---|---|---|---|---|
| Cloudflare | 1.1.1.1, 1.0.0.1 | 2606:4700:4700::1111 | None (optional variants) | https://cloudflare-dns.com/dns-query |
| Google Public DNS | 8.8.8.8, 8.8.4.4 | 2001:4860:4860::8888 | None | https://dns.google/dns-query |
| Quad9 | 9.9.9.9, 149.112.112.112 | 2620:fe::fe | Malware and phishing | https://dns.quad9.net/dns-query |
| OpenDNS (Cisco) | 208.67.222.222, 208.67.220.220 | 2620:119:35::35 | Phishing, optional content | https://doh.opendns.com/dns-query |
| AdGuard DNS | 94.140.14.14, 94.140.15.15 | 2a10:50c0::ad1:ff | Ads and trackers | https://dns.adguard-dns.com/dns-query |
Cloudflare 1.1.1.1
Cloudflare's resolver is consistently among the fastest in independent measurements, thanks to its very large anycast network. Its privacy commitments are strict: Cloudflare says it doesn't sell user data or use it for advertising, keeps only limited logs for a short period, and has its practices audited by an independent firm.
Cloudflare doesn't send EDNS Client Subnet information to authoritative servers, which is good for privacy but can occasionally mean a CDN picks a slightly less optimal server for you.
Filtering variants are available:
- 1.1.1.2 and 1.0.0.2: Block malware.
- 1.1.1.3 and 1.0.0.3: Block malware and adult content.
Google Public DNS (8.8.8.8)
Google Public DNS is one of the oldest and most widely used public resolvers. It's fast, extremely reliable and available almost everywhere. It validates DNSSEC and supports DoH and DoT.
Google keeps temporary logs, including the full IP address, for a short time for debugging and abuse prevention, and longer-term logs with location information at city or region level rather than full IP addresses. It doesn't filter any domains. It sends a truncated form of your IP address to authoritative servers using ECS when they support it, which can help CDNs route you to nearby servers.
Quad9 (9.9.9.9)
Quad9 is run by a Swiss-based non-profit foundation. Its main selling point is threat blocking: it uses threat intelligence feeds from many security partners to block domains associated with malware, phishing and botnets. It validates DNSSEC and doesn't log users' IP addresses.
Quad9 offers several service variants:
- 9.9.9.9 and 149.112.112.112: Malware blocking with DNSSEC validation, no ECS. This is the recommended default.
- 9.9.9.11 and 149.112.112.11: Malware blocking with ECS enabled.
- 9.9.9.10 and 149.112.112.10: No blocking, no DNSSEC validation, intended for troubleshooting.
Quad9 is a strong choice if you want security filtering without any account or setup.
OpenDNS (Cisco)
OpenDNS, now part of Cisco and the consumer face of Cisco Umbrella, has been around since 2006. The standard service blocks phishing domains. OpenDNS FamilyShield at 208.67.222.123 and 208.67.220.123 also blocks adult content, which makes it a simple option for families and schools. Free accounts let you configure category filtering for a home network.
AdGuard DNS
AdGuard DNS focuses on blocking ads, trackers and malicious domains at the DNS level. The default servers at 94.140.14.14 and 94.140.15.15 block ads and trackers, the "unfiltered" servers at 94.140.14.140 and 94.140.14.141 don't block anything, and family protection servers add adult content and safe search enforcement. A paid private tier lets you customise rules.
Configurable Resolvers: NextDNS and Control D
NextDNS and Control D take a different approach. You create a profile, choose which block lists and categories to apply, and get a unique DoH, DoT or DNS over QUIC endpoint tied to your configuration. Both offer free tiers with usage limits and paid plans for unlimited use. They're excellent when you want per-device control, logs you can see, and custom allow and block lists.
Encrypted DNS: DoH and DoT
Traditional DNS queries travel unencrypted over UDP port 53, so anyone on the network path can see and potentially alter them. All the resolvers above support encrypted transports:
- DNS over TLS (DoT) uses TCP port 853. Android's Private DNS setting uses DoT and expects a hostname, for example
one.one.one.one,dns.googleordns.quad9.net. - DNS over HTTPS (DoH) sends queries over HTTPS on port 443. Browsers such as Firefox, Chrome and Edge, and recent versions of Windows, macOS and iOS, support it.
You can make a DoH query from the command line with curl using the JSON API that Cloudflare and Google both offer:
curl -s -H "accept: application/dns-json" \
"https://cloudflare-dns.com/dns-query?name=example.com&type=A"
{
"Status": 0,
"TC": false,
"RD": true,
"RA": true,
"AD": true,
"CD": false,
"Question": [{ "name": "example.com", "type": 1 }],
"Answer": [
{ "name": "example.com", "type": 1, "TTL": 3600, "data": "192.0.2.10" }
]
}
With kdig from the Knot DNS utilities, you can test DoT and DoH using standard wire-format DNS:
kdig @1.1.1.1 +tls example.com A
kdig @dns.google +https example.com A
How to Test Which Resolver Is Fastest for You
The fastest resolver depends on your location and ISP. Testing takes a minute.
Quick Test with dig
Query each resolver a few times. The first query may be slower because of caching, so look at repeated results:
for r in 1.1.1.1 8.8.8.8 9.9.9.9 208.67.222.222 94.140.14.14; do
printf "%-16s" "$r"
for i in 1 2 3; do
dig @"$r" example.com A +tries=1 +time=2 | awk '/Query time/ {printf "%s ms ", $4}'
done
echo
done
1.1.1.1 9 ms 8 ms 8 ms
8.8.8.8 14 ms 12 ms 13 ms
9.9.9.9 11 ms 10 ms 10 ms
208.67.222.222 19 ms 17 ms 18 ms
94.140.14.14 23 ms 21 ms 22 ms
Your numbers will be different. Test with a mix of popular and less common domains, because popular names are almost always cached.
Check DNSSEC Validation
A validating resolver returns SERVFAIL for a deliberately broken signed domain. Test domains such as dnssec-failed.org exist for this purpose:
dig @9.9.9.9 dnssec-failed.org A | grep status
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 41377
Check Which Resolver You're Actually Using
Some networks intercept DNS and redirect it to their own resolver, regardless of your settings. Cloudflare offers a debug page at 1.1.1.1/help, and you can check from the command line using special TXT names that some resolvers answer:
dig @1.1.1.1 whoami.cloudflare TXT CH +short
dig o-o.myaddr.l.google.com TXT +short
How to Change Your Resolver
You can set a resolver in several places:
- Router: Changes DNS for every device on your network that uses DHCP settings.
- Operating system: Network settings on Windows, macOS, Linux, iOS and Android.
- Browser: Secure DNS settings in Firefox, Chrome and Edge, which use DoH regardless of system settings.
On a Linux system using systemd-resolved, you can set Quad9 with DoT in /etc/systemd/resolved.conf:
[Resolve]
DNS=9.9.9.9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net
DNSOverTLS=yes
DNSSEC=yes
Then restart the service and confirm the change:
sudo systemctl restart systemd-resolved
resolvectl status | grep -A3 "DNS Servers"
Which Resolver Should You Choose?
| Priority | Recommended resolver |
|---|---|
| Raw speed and privacy | Cloudflare 1.1.1.1 |
| Maximum reliability and compatibility | Google 8.8.8.8 |
| Security filtering with no setup | Quad9 9.9.9.9 or Cloudflare 1.1.1.2 |
| Family filtering | OpenDNS FamilyShield or Cloudflare 1.1.1.3 |
| Ad and tracker blocking | AdGuard DNS |
| Custom rules and per-device logs | NextDNS or Control D |
| Self-hosted control | Your own resolver, such as Unbound or Pi-hole |
Set a primary and a secondary from the same provider where possible, because operating systems may send queries to either. Mixing a filtering resolver with a non-filtering one means the filtering will be inconsistent.
FAQ: Public DNS Resolvers
In many locations Cloudflare's 1.1.1.1 is slightly faster, but results depend on your network and region. The difference is usually a few milliseconds. Test both from your own connection to see which performs better for you.
The major ones are run by reputable organisations with published privacy policies, and many are independently audited. Using encrypted DNS with them adds protection on untrusted networks such as public Wi-Fi.
It can make the first lookup for each site slightly faster, especially if your ISP's resolver is slow or overloaded. It won't increase your download speed, because DNS only affects how quickly names are resolved.
With unencrypted DNS, yes. With DoH or DoT, your ISP can't see the DNS queries themselves, but it can still see the IP addresses you connect to and, in many cases, the server name in the TLS handshake.
It's better not to, especially if one filters and the other doesn't. Devices may use either server at any time, which leads to inconsistent results. Use the primary and secondary addresses from the same service.
Cloudflare, Google, Quad9 and most other major public resolvers validate DNSSEC on their standard addresses. Quad9's 9.9.9.10 service is an exception, as it's intended for troubleshooting without validation.
Conclusion
Cloudflare, Google and Quad9 are the strongest general-purpose public resolvers, each with a slightly different emphasis: Cloudflare on speed and privacy, Google on reliability, and Quad9 on blocking threats. AdGuard, OpenDNS, NextDNS and Control D add filtering for ads, adult content and custom rules.
Pick the resolver that matches your priorities, enable DoH or DoT so your queries are encrypted, and test from your own network with dig to confirm it performs well. Changing your resolver takes a few minutes and is one of the easiest ways to make everyday browsing a little faster and safer.
