Best DNS Servers: Cloudflare, Google, Quad9, OpenDNS and AdGuard Compared

What a DNS server actually does (and why switching helps)

Every time you open a website, your device first has to translate the human-friendly name - say example.com - into the numeric IP address machines use to connect. The service that performs that translation is your DNS resolver. By default your device uses whatever resolver your internet service provider (ISP) hands out, and ISP resolvers are frequently slow, occasionally unreliable, and sometimes log or even monetise your browsing history. If you want the full background on the lookup process, read our companion guide on how DNS works.

Pointing your device at a dedicated public resolver run by Cloudflare, Google, Quad9 and others can deliver three concrete benefits:

• Speed. Large public resolvers run global anycast networks with heavily cached, frequently requested records, so the first connection to a site can complete a little faster than with a smaller ISP resolver.
• Privacy. The leading public resolvers publish clear no-selling, minimal-logging policies and support encrypted transport (DNS over HTTPS and DNS over TLS) so that others on your network cannot read your lookups.
• Filtering and safety. Some resolvers offer optional variants that block malware, phishing, adult content, or ads and trackers at the DNS layer - protecting every device on the network without installing software.

The major public DNS resolvers compared

Here are the addresses and the headline characteristics of the five resolvers most worth considering. All of them are free for personal use. Note that we deliberately do not quote invented "milliseconds faster" numbers - latency is location-dependent and any fixed figure would be misleading. Treat the speed column as the provider's design intent, then measure the real result yourself.

IPv6 resolver addresses

The addresses above are IPv4. If your connection has IPv6 (most modern home and mobile networks do), each provider also publishes IPv6 resolver addresses that map to the same service, so the filtering behaviour is identical. Enter the IPv6 primary and secondary in the same place you would enter IPv4.

Cloudflare (1.1.1.1)

Cloudflare's resolver is widely regarded as one of the fastest and most privacy-focused public options. The standard pair is 1.1.1.1 and 1.0.0.1, with full DNS over HTTPS and DNS over TLS support. Cloudflare commits to not selling user data and to wiping query logs quickly. If you want light filtering, two clean variants exist: 1.1.1.2 / 1.0.0.2 blocks known malware, and 1.1.1.3 / 1.0.0.3 blocks malware plus adult content. Choose Cloudflare if your priorities are raw speed and a minimal-logging privacy posture.

Google Public DNS (8.8.8.8)

Google's 8.8.8.8 (with 8.8.4.4 as the secondary) is the most recognisable public resolver in the world and an extremely reliable, well-distributed default. It supports encrypted DNS and has a long track record of high availability. It performs no content filtering, so it is a neutral, do-no-surprises choice. Pick Google if you want a rock-solid resolver that simply works everywhere, without filtering.

Quad9 (9.9.9.9)

Quad9, operated by a Swiss non-profit foundation, pairs good performance with security as its headline feature. Its default service at 9.9.9.9 / 149.112.112.112 actively blocks domains flagged as malicious - malware, phishing and command-and-control hosts - using aggregated threat intelligence, while maintaining a privacy-respecting, no-personal-data-logging stance. It does not block ads. Quad9 is the easiest way to add a layer of malware protection across an entire household with zero software to install.

OpenDNS (Cisco)

OpenDNS, now part of Cisco, has been offering public DNS since long before most rivals existed. The standard addresses are 208.67.222.222 and 208.67.220.220, with phishing and malware blocking built in. Its Family Shield variant (208.67.222.123 / 208.67.220.123) additionally blocks adult content, and a free OpenDNS Home account lets you customise category filtering. OpenDNS is the natural pick when content controls for a family are the main goal.

AdGuard DNS

AdGuard DNS is the standout choice if you want to block ads and trackers for every device on your network at the DNS layer. The default servers are 94.140.14.14 and 94.140.15.15. A Family variant (94.140.14.15 / 94.140.15.16) adds adult-content filtering and safe search, while a non-filtering variant (94.140.14.140 / 94.140.14.141) gives you a plain, fast resolver with no blocking at all. Be aware that aggressive ad filtering can occasionally break a site element; the non-filtering pair is the easy fallback if that happens.

How to choose the right DNS for you

Rather than chasing a universal "best", match the resolver to your actual goal:

• I just want it fast and private. Start with Cloudflare 1.1.1.1 or Google 8.8.8.8. Both are neutral and quick almost everywhere.
• I want safer browsing without thinking about it. Use Quad9 9.9.9.9 for automatic blocking of malicious domains, or Cloudflare's 1.1.1.2 malware-blocking variant.
• I have kids on the network. Use OpenDNS Family Shield or Cloudflare 1.1.1.3 to filter adult content network-wide.
• I want fewer ads and trackers everywhere. Use AdGuard DNS default servers, with the non-filtering pair on standby in case something breaks.
• I want the genuinely fastest option for my line. Measure it. Speed varies by location and ISP, so the only honest way to know is to test the candidates from your own connection.

A note on encrypted DNS (DoH and DoT)

Classic DNS over port 53 travels in plaintext, so anyone between you and your resolver - on shared Wi-Fi, for example - can read which sites you look up. Every provider above supports modern encrypted transports that fix this:

• DNS over HTTPS (DoH) wraps lookups inside ordinary HTTPS traffic, defined in RFC 8484. Most major browsers can enable it directly.
• DNS over TLS (DoT) sends lookups over a dedicated TLS connection, defined in RFC 7858, and is commonly configured at the operating-system or router level.

Enabling encrypted DNS is a meaningful privacy upgrade, but remember the limit noted earlier: it hides the content of your lookups from eavesdroppers, not your public IP address. If you suspect your queries are leaking outside an encrypted tunnel - for instance while using a VPN - you can verify with our DNS Leak Test.

How to change your DNS server, device by device

Changing DNS is reversible and safe. You can set it on a single device, or - better - on your router so every device inherits it. In each case you enter a Primary and a Secondary address (for example 1.1.1.1 and 1.0.0.1) from the table above.

On your router (covers the whole network)

1. Open your router's admin page in a browser (commonly 192.168.1.1 or 192.168.0.1) and sign in.
2. Find the DNS settings, usually under Internet, WAN, or DHCP.
3. Replace the automatic DNS with your chosen primary and secondary addresses, save, and reboot the router.

Windows 11 and 10

1. Open Settings, then Network & internet, and select your Wi-Fi or Ethernet connection.
2. Find DNS server assignment and choose Edit, then switch from Automatic to Manual.
3. Turn on IPv4, enter your Preferred and Alternate DNS, and save.

macOS

1. Open System Settings, then Network, and select your active connection.
2. Click Details, then the DNS tab.
3. Use the plus button to add your DNS server addresses, then click OK and Apply.

iPhone and iPad (iOS)

1. Open Settings, then Wi-Fi, and tap the information icon next to your network.
2. Tap Configure DNS and switch to Manual.
3. Remove the existing servers, add your chosen addresses, and tap Save.

Android

1. Open Settings, then Network & internet, then look for Private DNS.
2. Choose the hostname option and enter the provider's DoT hostname (for example a Cloudflare or AdGuard private-DNS hostname), then save.
3. Per-Wi-Fi numeric DNS can also be set by editing the saved network's IP settings to Static.

PlayStation 5 and consoles

1. Go to Settings, Network, Settings, then Set Up Internet Connection.
2. Select your network, choose Advanced or Custom settings, and set DNS to Manual.
3. Enter your Primary and Secondary DNS - for example 1.1.1.1 and 1.0.0.1 - then save and test the connection.

Common myths about changing DNS

• "A faster DNS makes my whole internet faster." DNS only affects the brief lookup before a connection starts. It can make sites feel snappier on first visit, but it does not increase your bandwidth or lower your in-game ping once connected.
• "Changing DNS hides me from my ISP." Your ISP still routes all your traffic and can see the IPs you connect to. Encrypted DNS hides the lookups themselves, not your destinations or your IP.
• "The same DNS is fastest for everyone." Performance is governed by physical distance and routing to each provider's nearest server, which differs by location. That is precisely why benchmarking from your own line beats any published ranking.
• "Public DNS is unsafe." Reputable resolvers from Cloudflare, Google, Quad9, OpenDNS and AdGuard are safe and reversible. The real risk is configuring an unknown resolver, which could redirect you to fraudulent sites.

Related tools & reading

• DNS Benchmark — measure which public resolver is fastest from your own connection.
• DNS Lookup — query A, AAAA, MX, TXT, NS and SOA records for any domain.
• DNS Health Check — audit a domain's DNS configuration for problems.
• DNS Propagation Checker — see whether a DNS change has rolled out worldwide.
• DNS Leak Test — confirm your lookups are not leaking outside an encrypted tunnel.
• IP Lookup — check what your public IP address reveals.
• MAC Address Lookup — identify the hardware vendor behind a device on your network.
• How DNS Works — the full resolver, root, TLD and authoritative-server lookup flow.
• Back to the Learning Center