Most devices use the DNS resolver provided by their internet service provider by default. ISP resolvers are often slow, log your queries, and lack security features. Switching to a public DNS provider can improve browsing speed, protect your privacy, and block malicious domains — all without any cost.
What to Look for in a DNS Provider
Before comparing providers, it helps to understand the key criteria that differentiate them:
- Speed — how fast the resolver responds to queries, measured in milliseconds.
- Privacy — whether the provider logs your queries, for how long, and whether they share data.
- Security — whether the resolver blocks known malicious domains, supports DNSSEC, or encrypts DNS queries (DoH/DoT).
- Reliability — uptime, anycast coverage, and resilience to DDoS attacks.
- Filtering — optional content filtering for families, schools, or workplaces.
1. Cloudflare DNS — 1.1.1.1
Cloudflare's public resolver is consistently the fastest public DNS provider in independent benchmarks. It operates one of the largest anycast networks in the world, meaning queries are answered from a server physically close to you.
- Primary:
1.1.1.1| Secondary:1.0.0.1 - IPv6:
2606:4700:4700::1111 - Privacy: Logs are purged within 25 hours; independently audited by KPMG.
- Security: DNSSEC validation, DNS over HTTPS (
https://cloudflare-dns.com/dns-query), DNS over TLS. - Filtering variant:
1.1.1.2blocks malware;1.1.1.3blocks malware and adult content.
2. Google Public DNS — 8.8.8.8
Google's public resolver has been available since 2009 and remains one of the most widely used in the world. It offers strong reliability and speed backed by Google's global infrastructure.
- Primary:
8.8.8.8| Secondary:8.8.4.4 - IPv6:
2001:4860:4860::8888 - Privacy: Logs queries for 24–48 hours; longer-term anonymised logs kept for abuse and security analysis.
- Security: DNSSEC validation, DNS over HTTPS and TLS supported.
namebench or dnsbench to compare response times from your network before committing to a specific provider.3. Quad9 — 9.9.9.9
Quad9 is a non-profit resolver operated by a Swiss foundation. Its key differentiator is threat intelligence blocking — it refuses to resolve domains associated with malware, phishing, and botnets, using threat feeds from more than 20 security partners.
- Primary:
9.9.9.9| Secondary:149.112.112.112 - IPv6:
2620:fe::fe - Privacy: No IP address logging; operated as a non-profit with a strong privacy policy.
- Security: DNSSEC validation, malicious domain blocking, DNS over HTTPS and TLS.
- Unfiltered variant:
9.9.9.10for those who want speed without filtering.
4. OpenDNS — 208.67.222.222
OpenDNS (now owned by Cisco) has been a popular DNS provider since 2006. It offers robust phishing protection and customisable content filtering, making it a common choice for families and schools.
- Primary:
208.67.222.222| Secondary:208.67.220.220 - Privacy: Free tier logs queries; FamilyShield and Umbrella have stronger controls.
- Security: Phishing and botnet domain blocking; custom allow/block lists via a dashboard.
- FamilyShield:
208.67.222.123blocks adult content automatically.
5. NextDNS
NextDNS is a highly customisable DNS resolver that lets you build your own filtering profile. You can choose from multiple blocklists, log queries with full detail, and whitelist or blacklist specific domains through a web dashboard.
- DNS Servers: Assigned individually per profile (available at nextdns.io).
- Privacy: You control what is logged; logs can be stored in a region of your choice or disabled entirely.
- Security: DNSSEC, AI-powered threat intelligence, DoH and DoT support.
- Pricing: Free up to 300,000 queries/month; paid plans for heavier use.
6. AdGuard DNS
AdGuard DNS blocks not just malicious domains but also advertising and tracking domains. It is a good choice for users who want a network-level ad blocker without installing browser extensions.
- Default (ad blocking):
94.140.14.14|94.140.15.15 - Family Protection:
94.140.14.15|94.140.15.16 - Non-filtering:
94.140.14.140|94.140.14.141 - Privacy: No query logs on the default server; anonymised logs for debugging only.
- Security: DNS over HTTPS, DNS over TLS, DNSCrypt.
7. Comodo Secure DNS
Comodo Secure DNS is a free resolver that blocks access to malicious domains using Comodo's threat intelligence database. It requires no software installation and works on any device.
- Primary:
8.26.56.26| Secondary:8.20.247.20 - Security: Malware, phishing, and spyware domain blocking.
8. Verisign Public DNS
Verisign operates one of the most stable DNS infrastructure networks in the world as the registry for .com and .net. Their public resolver emphasises stability and privacy — no query data is sold or shared with third parties.
- Primary:
64.6.64.6| Secondary:64.6.65.6 - Privacy: No personal data sold; no query redirection.
- Security: DNSSEC validation.
9. CleanBrowsing DNS
CleanBrowsing offers three filtering profiles specifically designed for families and educational environments. Each profile has different blocking levels, from basic adult content filtering to strict safe-search enforcement.
- Family Filter:
185.228.168.168|185.228.169.168 - Adult Filter:
185.228.168.10|185.228.169.11 - Security Filter:
185.228.168.9|185.228.169.9 - Security: DNS over HTTPS and TLS supported.
10. Control D
Control D is a modern, configurable DNS resolver with an emphasis on privacy and customisation. Like NextDNS, it allows you to build filtering profiles, block specific categories, and route queries through different exit points.
- DNS Servers: Profile-specific endpoints at controld.com.
- Privacy: Configurable log retention; no default logging on free tier.
- Security: DoH, DoT, DoQ, and Legacy DNS supported; hundreds of filtering categories.
- Pricing: Free tier available; paid plans unlock advanced routing and analytics.
Quick Comparison
| Provider | Primary IP | Privacy | Malware Blocking | DoH / DoT |
|---|---|---|---|---|
| Cloudflare | 1.1.1.1 | Strong (audited) | Optional (1.1.1.2) | Yes |
8.8.8.8 | Moderate | No | Yes | |
| Quad9 | 9.9.9.9 | Strong (non-profit) | Yes (default) | Yes |
| OpenDNS | 208.67.222.222 | Moderate | Yes | Partial |
| NextDNS | Profile-based | Configurable | Configurable | Yes |
| AdGuard DNS | 94.140.14.14 | Strong | Yes + ad blocking | Yes |
How to Change Your DNS Provider
You can change your DNS resolver at the device level (affects only that device) or at the router level (affects all devices on your network).
# Query using Cloudflare's resolver to see what it returns
dig example.com A @1.1.1.1
# Query using Google's resolver
dig example.com A @8.8.8.8
# Query using Quad9
dig example.com A @9.9.9.9
# Measure response time
dig example.com A @1.1.1.1 | grep "Query time"
dig example.com A @8.8.8.8 | grep "Query time"After switching, verify the resolver is working correctly using the DNS Lookup tool to confirm queries are resolving as expected.
Frequently Asked Questions
Will changing my DNS provider make the internet faster?
It can. DNS lookup time is only one component of page load, but a slow resolver adds latency to every new connection. Switching from a slow ISP resolver to a fast public resolver like Cloudflare or Google can noticeably reduce first-connection delays, especially for sites you haven't visited recently.
Is it safe to use a public DNS provider?
Major providers like Cloudflare, Google, and Quad9 are reputable and widely trusted. However, your DNS queries reveal which websites you visit — always check the provider's privacy policy. For maximum privacy, use a provider that supports DNS over HTTPS (DoH) or DNS over TLS (DoT) to encrypt your queries.
Does changing DNS bypass my ISP's content filtering?
It depends. DNS-based filtering can be bypassed by switching resolvers, but some ISPs use transparent DNS proxying that intercepts all DNS traffic regardless of the resolver you specify. ISPs can also block access at the IP level, which DNS cannot bypass.
What is the difference between DNS over HTTPS (DoH) and DNS over TLS (DoT)?
Both encrypt DNS queries to prevent interception. DoH uses port 443 (the same as HTTPS) and blends in with regular web traffic, making it harder to block. DoT uses a dedicated port (853) and is easier for network administrators to identify and manage. Most providers now support both.