In short: the universal pick is Cloudflare 1.1.1.1 (secondary 1.0.0.1): in most regions it is the fastest public resolver and, per its policy, deletes query logs within 24 hours. Google 8.8.8.8 is the stability benchmark, Quad9 9.9.9.9 blocks malicious domains, AdGuard DNS strips ads and trackers, and Yandex.DNS keeps nodes across Russia and the CIS — often the fastest choice there. There is no single correct answer: latency depends on your ISP, so measure the candidates from your own network — we show how below.
What a public DNS is and why change it
DNS (Domain Name System) is the phone book of the internet: it turns a name like example.com into the IP address your browser actually connects to. When you open a new site, the device first asks a DNS resolver for the domain's address and only then loads the page. By default those queries go to your ISP's resolver, handed out with your DHCP settings.
A public DNS is a resolver openly operated by a large company or a non-profit: Cloudflare, Google, Quad9, AdGuard, Yandex. They run on distributed anycast infrastructure, so a query usually lands on the nearest point of presence.
Why replace it? Four reasons. Speed: ISP resolvers are often overloaded, and slow resolution shows on "cold" domains — a modern page touches dozens of them. Reliability: a DNS outage at the ISP looks like "the internet is down". Privacy: some ISPs log queries or replace NXDOMAIN responses with ad pages. Filtering: protective resolvers block phishing, malware and ads for every device at once, no software needed.
Changing DNS is the cheapest home-network optimization: two addresses in the router, zero installed software — and a new level of resolution speed, privacy and protection for every device.
Know the limits, though: DNS only translates names into addresses — it does not widen bandwidth or lower in-game ping (honestly covered in the FAQ). From a site owner's perspective, domain records are the other side of the same system — see our guide on connecting a domain to hosting.
The 2026 public DNS ranking
The order balances speed, privacy, filtering and stability; the final pick should come from your own measurement.
1. Cloudflare 1.1.1.1 — the best balance of speed and privacy
Addresses: 1.1.1.1 and 1.0.0.1. Filtered variants: 1.1.1.2 / 1.0.0.2 block malware domains, 1.1.1.3 / 1.0.0.3 also block adult content. In most regions its latency is among the lowest, and per the published policy query logs are deleted within 24 hours and never sold. Full DoH and DoT support.
Best for: the default choice for almost everyone — fast, private, encrypted out of the box.
Downsides: in some networks routing to the nearest node is suboptimal — compare against a local alternative; the free tier has no dashboard.
2. Google Public DNS 8.8.8.8 — the stability benchmark
Addresses: 8.8.8.8 and 8.8.4.4. The most famous public resolver: massive anycast infrastructure, years of near-perfect uptime, support for DoH, DoT and DNSSEC. Temporary logs with IPs are kept up to 48 hours; permanent statistics are anonymized.
Best for: anyone who values predictability: 8.8.8.8 "just works" for years in almost every country.
Downsides: no filtering at all — neither ads nor phishing; and it adds one more data channel into the Google ecosystem.
3. Quad9 9.9.9.9 — security by default
Addresses: 9.9.9.9 and 149.112.112.112; unfiltered — 9.9.9.10. A Swiss non-profit. Its signature feature is default-on blocking of phishing and malware domains via several threat feeds; the policy states user IPs are not stored. DoH and DoT are supported.
Best for: set-and-forget protection from malicious sites, no accounts or configuration.
Downsides: latency can be higher than Cloudflare or Google where its nodes sit further away; rare filter false positives cannot be whitelisted individually.
4. AdGuard DNS — ad blocking at the resolver level
Default addresses (ads and trackers blocked): 94.140.14.14 and 94.140.15.15; non-filtering: 94.140.14.140 and 94.140.14.141; family mode: 94.140.14.15 and 94.140.15.16. The only resolver here built to cut ads and tracking at DNS level: it works in every app and on devices where a blocker cannot go — TVs, set-top boxes, IoT. Supports DoH, DoT and DNS-over-QUIC.
Best for: fewer ads on every device at once, including Smart TVs.
Downsides: DNS-level blocking occasionally breaks affiliate links and widgets; per-domain whitelisting is only available in the paid tier.
5. Yandex.DNS — local nodes and three modes
Three modes: basic — 77.88.8.8 and 77.88.8.1; safe (blocks infected and fraudulent sites) — 77.88.8.88 and 77.88.8.2; family (adds adult-content blocking) — 77.88.8.7 and 77.88.8.3. Nodes sit in cities across Russia and the CIS, so on most local ISPs it delivers the lowest latency.
Best for: users in Russia and the CIS who want minimal latency plus ready-made protection modes.
Downsides: data handling follows Yandex's general privacy policy, without specific commitments like "logs deleted in 24 hours"; encrypted-protocol support is limited — check the docs.
6. OpenDNS — parental controls and flexible settings
Addresses: 208.67.222.222 and 208.67.220.220; the FamilyShield preset with adult-content blocking — 208.67.222.123 and 208.67.220.123. Owned by Cisco: a free account adds query statistics and filtering across dozens of categories — the closest thing to network-level parental control.
Best for: families and small offices that need category filtering and reports.
Downsides: latency from many regions is noticeably higher; the value unlocks after registration; queries are logged by design.
DoH and DoT: encrypting your DNS queries
Classic DNS travels in plain text. DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) encrypt the traffic all the way to the resolver. In Chrome and Edge turn on "Use secure DNS" under Privacy and security; in Firefox — "DNS over HTTPS". Windows 11 offers DoH next to the DNS fields in adapter properties; Android has a "Private DNS" option accepting a hostname such as one.one.one.one, dns.google or dns.adguard-dns.com; macOS and iOS use a configuration profile from the DNS provider.
Comparison table
| Server | Addresses (primary / secondary) | Filtering | DoH / DoT | Logging (per published policy) |
|---|---|---|---|---|
| Cloudflare | 1.1.1.1 / 1.0.0.1 | Optional: 1.1.1.2 (malware), 1.1.1.3 (family) | Yes / Yes | Query logs deleted within 24 h |
| Google Public DNS | 8.8.8.8 / 8.8.4.4 | None | Yes / Yes | Temporary logs up to 48 h, permanent stats anonymized |
| Quad9 | 9.9.9.9 / 149.112.112.112 | Malware and phishing (default) | Yes / Yes | States it does not store user IPs |
| AdGuard DNS | 94.140.14.14 / 94.140.15.15 | Ads and trackers; family mode | Yes / Yes (plus DoQ) | States it does not record user activity |
| Yandex.DNS | 77.88.8.8 / 77.88.8.1 (basic) | Modes: safe 77.88.8.88, family 77.88.8.7 | Limited | Yandex general privacy policy |
| OpenDNS | 208.67.222.222 / 208.67.220.220 | Account categories; FamilyShield 208.67.222.123 | Yes / No | Queries logged, dashboard statistics |
How to switch DNS: Windows, macOS, router
Changing DNS on a device affects that device only — handy for testing. On the router (DNS fields under WAN or DHCP) it covers every device — the place for a permanent setup. Always enter both addresses: the secondary takes over when the primary is unreachable.
# Windows 11 — PowerShell as administrator
Get-DnsClientServerAddress # show current servers
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses ("1.1.1.1","1.0.0.1")
ipconfig /flushdns # flush the cache
# macOS — Terminal
networksetup -listallnetworkservices # interface names
sudo networksetup -setdnsservers "Wi-Fi" 1.1.1.1 1.0.0.1
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder
# Revert to ISP defaults (values from DHCP)
sudo networksetup -setdnsservers "Wi-Fi" empty
GUI equivalents: Windows — Settings, Network and Internet, adapter properties, "DNS server assignment: Manual"; macOS — System Settings, Network, DNS. On a router look for "Primary / Secondary DNS" under WAN. Then flush the system DNS cache and restart the browser.
How to choose and measure it yourself
Third-party rankings are a hint, not the truth: latency is defined by the route from your ISP to the service's nearest node — a neighbor on another ISP can get numbers that differ by multiples. Measure the candidates from your network with dig (Linux/macOS) or nslookup (Windows):
# General form: dig @<resolver_address> domain
# The "Query time" field is the resolver latency in ms
dig @1.1.1.1 example.com | grep "Query time"
dig @8.8.8.8 example.com | grep "Query time"
dig @9.9.9.9 example.com | grep "Query time"
# A series of 5 runs — filters out random spikes
for i in 1 2 3 4 5; do dig @9.9.9.9 example.com +noall +stats | grep "Query time"; done
# Windows PowerShell — nslookup response time
Measure-Command { nslookup example.com 1.1.1.1 } | Select-Object TotalMilliseconds
Measure each server several times and at different hours: the first run is inflated by a cold cache. Prefer the browser? Our latency checker shows response time to any address, and the DNS checker shows how a specific domain resolves. More utilities — in our review of DNS lookup tools.
The rule is simple: among services whose policy and filtering suit you, pick the one with the lowest median latency. The gap between 5 and 40 ms per cold domain is a real difference on heavy pages.
Privacy and filtering
A resolver sees the domain of every site you open — sensitive data. Cloudflare promises to delete query logs within 24 hours, Quad9 states it does not store user IPs, Google keeps temporary logs up to 48 hours, AdGuard declares it does not record activity, Yandex follows its general privacy policy, and OpenDNS logs queries deliberately — its dashboard is built on them. These are the services' own statements — unverifiable by users, so it comes down to trust in the brand and jurisdiction.
DNS-level filtering is simple: if a domain is on an ad, phishing or malware list, the resolver returns an empty answer — the page, script or tracker never loads. A convenient first line of defense covering every device, no software needed.
A filtering DNS is neither an antivirus nor a full parental-control suite: it blocks by domain lists that can be bypassed and never sees page content. Treat it as the first layer of protection, not the last.
The takeaway: a DNS filter complements browser protections against phishing but does not replace them; for children's traffic, family modes of Cloudflare, Yandex.DNS or OpenDNS make a sensible base layer.
FAQ
Does DNS change your ping in games (Brawl Stars, CS2, Dota 2)?
Practically no. DNS is used once, at connection time, to turn the game server's name into an IP address. After that, traffic flows directly, and ping is defined by your ISP's route to the game server — not by the resolver. The "best DNS for Brawl Stars" speeds up the login screen by a fraction of a second at most — big games assign players to servers themselves. For lower ping look at your ISP and routing; measure latency to any server with our tool.
Which DNS server should I pick in my region?
By latency the winners are the services with nodes closest to you: Cloudflare and Google in most of the world, Yandex.DNS inside Russia and the CIS; for ad filtering — AdGuard DNS. Measure three or four candidates and let the numbers decide.
Can I mix the primary DNS from one service with a secondary from another?
Technically yes — 1.1.1.1 + 8.8.8.8 works. But the OS may query both addresses rather than strictly fail over, making filtering unpredictable: a query to the unfiltered server bypasses the blocks. If filtering matters, both addresses must come from one service and mode.
Will changing DNS make websites load faster?
Only the resolution step gets faster — tens of milliseconds per new domain; the effect shows on cold sites. Download and streaming speeds do not depend on DNS.
What happens if a public DNS server goes down?
The device switches to the secondary address — which is why you configure one. Full outages of major resolvers are rare but happen, so keep a backup service's addresses handy.
Checklist: migrate to a new DNS in 10 minutes
- Pick 2–3 candidates from the ranking for your goal: speed, privacy or filtering.
- Measure each one's latency from your network — dig/nslookup or the online latency checker; repeat in the evening.
- Use the DNS checker to confirm the domains you care about resolve correctly.
- Set the primary and secondary addresses of one service — device for testing, router for the whole network.
- Enable DoH or DoT in the browser or OS.
- Flush the system DNS cache and restart the browser.
- Observe for a couple of days: if a site stops opening due to the filter, change the mode or service.
Switching DNS is a rare case where five minutes of setup give a permanent effect for every device. Start with a measurement and choose by the numbers.