Best Public DNS Servers 2026: Fastest, Safest, IPv4 & IPv6

The best public DNS servers in 2026 are Cloudflare 1.1.1.1 for speed and privacy, Google Public DNS 8.8.8.8 for stability, Quad9 9.9.9.9 for built-in malware blocking, OpenDNS for parental controls and AdGuard DNS for ad blocking. All of them are free; choose by the latency you measure from your own network, not by someone else's ranking.

Quick picks: the best DNS server for each goal

"Best" depends on what you want the resolver to do. Most people want speed first, but a family network, a small office and a privacy-minded user end up with different answers. Start from the goal, then confirm with a latency test.

What a public DNS server is and why change it

DNS (Domain Name System) is the phone book of the internet: it turns a name like example.com into the IP address your browser actually connects to. When you open a new site, the device first asks a DNS resolver for the domain's address and only then loads the page. By default those queries go to your ISP's resolver, handed out with your DHCP settings.

A public DNS server is a recursive resolver that a large company or a non-profit operates openly for anyone: Cloudflare, Google, Quad9, Cisco (OpenDNS), AdGuard. They run on distributed anycast infrastructure, so the same address — say, 1.1.1.1 — is announced from many data centers and your query usually lands on the nearest point of presence.

Why replace it? Four reasons. Speed: ISP resolvers are often overloaded, and slow resolution shows on "cold" domains — a modern page touches dozens of them. Reliability: a DNS outage at the ISP looks like "the internet is down". Privacy: some ISPs log queries or replace NXDOMAIN responses with ad pages. Filtering: protective resolvers block phishing, malware and ads for every device at once, no software needed.

Changing DNS is the cheapest home-network optimization: two addresses in the router, zero installed software — and a new level of resolution speed, privacy and protection for every device.

Know the limits, though: DNS only translates names into addresses — it does not widen bandwidth, speed up downloads or change the latency of an established connection. From a site owner's perspective, domain records are the other side of the same system — see our guide on connecting a domain to hosting.

Should I use my ISP's DNS or a public DNS?

Your ISP's resolver has one real advantage: it sits inside the ISP's network, so on a well-run provider it can be the lowest-latency option, and some CDNs route you to a nearby edge based on the resolver's location. Against it: you cannot see its logging policy, some ISPs redirect mistyped domains (NXDOMAIN) to search or ad pages, and when it fails, every device on the network loses name resolution at once.

A practical rule: measure your ISP resolver alongside two or three public ones (commands below). If the ISP is within a few milliseconds and you have no privacy or filtering needs, keeping it is fine. If it is slower, hijacks errors, or you want encrypted DNS, switch to a public resolver.

The best public DNS servers ranked

The order balances speed, privacy, filtering and stability; the final pick should come from your own measurement.

1. Cloudflare 1.1.1.1 — the best balance of speed and privacy

Addresses: 1.1.1.1 and 1.0.0.1; IPv6 2606:4700:4700::1111 and 2606:4700:4700::1001. Filtered variants: 1.1.1.2 / 1.0.0.2 block malware domains, 1.1.1.3 / 1.0.0.3 also block adult content ("1.1.1.1 for Families"). In most regions its latency is among the lowest, and per the published policy query logs are deleted within 25 hours and never sold. Full DoH and DoT support; the DoT hostname is one.one.one.one. Details are in our Cloudflare DNS guide and in the official 1.1.1.1 documentation.

Best for: the default choice for almost everyone — fast, private, encrypted out of the box.

Downsides: in some networks routing to the nearest node is suboptimal — compare against a local alternative; 1.1.1.1 is also used as a fake address inside some routers and captive portals, which occasionally conflicts; the free tier has no dashboard.

2. Google Public DNS 8.8.8.8 — the stability benchmark

Addresses: 8.8.8.8 and 8.8.4.4; IPv6 2001:4860:4860::8888 and 2001:4860:4860::8844. The most famous public resolver: massive anycast infrastructure, years of near-perfect uptime, support for DoH, DoT and DNSSEC validation (DoT/DoH hostname: dns.google). Temporary logs with IPs are kept up to 48 hours; permanent statistics are anonymized, as described in Google Public DNS privacy.

Best for: anyone who values predictability: 8.8.8.8 "just works" for years in almost every country, and it does not rewrite answers.

Downsides: no filtering at all — neither ads nor phishing; and it adds one more data channel into the Google ecosystem.

3. Quad9 9.9.9.9 — security by default

Addresses: 9.9.9.9 and 149.112.112.112; IPv6 2620:fe::fe and 2620:fe::9. Unfiltered: 9.9.9.10 / 149.112.112.10; with EDNS Client Subnet (can give better CDN routing): 9.9.9.11 / 149.112.112.11. A Swiss non-profit. Its signature feature is default-on blocking of phishing and malware domains via several threat feeds; the policy states user IPs are not stored. DoH and DoT are supported via dns.quad9.net. More in our Quad9 review.

Best for: set-and-forget protection from malicious sites, no accounts or configuration.

Downsides: latency can be higher than Cloudflare or Google where its nodes sit further away; rare filter false positives cannot be whitelisted individually.

4. OpenDNS — parental controls and flexible settings

Addresses: 208.67.222.222 and 208.67.220.220; IPv6 2620:119:35::35 and 2620:119:53::53. The FamilyShield preset with adult-content blocking: 208.67.222.123 and 208.67.220.123. Owned by Cisco: a free account adds query statistics and filtering across dozens of categories — the closest thing to network-level parental control. DoH is available at doh.opendns.com.

Best for: families and small offices that need category filtering and reports.

Downsides: latency from many regions is noticeably higher; the value unlocks after registration (and category filtering needs your home IP registered with the account); queries are logged by design.

5. AdGuard DNS — ad blocking at the resolver level

Default addresses (ads and trackers blocked): 94.140.14.14 and 94.140.15.15; non-filtering: 94.140.14.140 and 94.140.14.141; family mode: 94.140.14.15 and 94.140.15.16. The only resolver here built to cut ads and tracking at DNS level: it works in every app and on devices where a blocker cannot go — TVs, set-top boxes, IoT. Supports DoH, DoT and DNS-over-QUIC via dns.adguard-dns.com.

Best for: fewer ads on every device at once, including smart TVs.

Downsides: DNS-level blocking occasionally breaks affiliate links and widgets; per-domain whitelisting is only available with a personal (account-based) server.

Other resolvers worth knowing

Public DNS comparison table

Public DNS IPv6 addresses

If your ISP gives you IPv6, set IPv6 resolvers too — otherwise the device keeps using the ISP's IPv6 DNS from router advertisements and your IPv4 change is only half applied.

Is 1.1.1.1 better than 8.8.8.8?

For most home users Cloudflare 1.1.1.1 is the slightly better default: similar or lower latency in many regions, a shorter stated log retention, and optional filtered addresses. Google 8.8.8.8 wins on predictability and has no router or captive-portal conflicts with its address. Neither filters anything by default. The honest answer is a measurement: run the dig loop below against both from your network at two different times of day and keep the one with the lower median.

Quad9 vs Cloudflare: which is safer?

They protect against different things. Quad9 9.9.9.9 blocks known malicious domains by default, which stops a phishing link before the page loads. Cloudflare 1.1.1.1 does no blocking unless you switch to 1.1.1.2 (malware) or 1.1.1.3 (malware and adult content); its strength is privacy commitments and speed. If you want protection without extra software, Quad9 or Cloudflare 1.1.1.2 are the comparable choices — test both for latency.

DoH and DoT: encrypting your DNS queries

Classic DNS travels in plain text over UDP port 53, so anyone on the path can read and alter it. DNS-over-HTTPS (RFC 8484) and DNS-over-TLS (RFC 7858) encrypt the traffic all the way to the resolver. Step-by-step settings for every platform are in our guide on how to change DNS server.

In Chrome and Edge turn on "Use secure DNS" under Privacy and security; in Firefox — "DNS over HTTPS" under Privacy & Security. Windows 11 offers DoH next to the DNS fields in adapter properties once you enter a known resolver address; Android has a "Private DNS" option accepting a hostname from the table; macOS and iOS use a configuration profile from the DNS provider.

How to switch DNS: Windows, macOS, Linux, router

Changing DNS on a device affects that device only — handy for testing. On the router (DNS fields under WAN or DHCP) it covers every device — the place for a permanent setup. Always enter both addresses: the secondary takes over when the primary is unreachable.

# Windows 11 — PowerShell as administrator
Get-DnsClientServerAddress                       # show current servers
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses ("1.1.1.1","1.0.0.1")
ipconfig /flushdns                               # flush the cache

# macOS — Terminal
networksetup -listallnetworkservices             # interface names
sudo networksetup -setdnsservers "Wi-Fi" 1.1.1.1 1.0.0.1
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

# Revert to ISP defaults (values from DHCP)
sudo networksetup -setdnsservers "Wi-Fi" empty

# Linux with systemd-resolved
resolvectl status                                # current servers per link
sudo resolvectl dns eth0 1.1.1.1 1.0.0.1         # temporary, until reconnect
sudo resolvectl flush-caches

# Linux with NetworkManager (persistent)
nmcli connection show                            # connection names
sudo nmcli connection modify "Wired connection 1" ipv4.dns "1.1.1.1 1.0.0.1" ipv4.ignore-auto-dns yes
sudo nmcli connection up "Wired connection 1"

GUI equivalents: Windows — Settings, Network and Internet, adapter properties, "DNS server assignment: Manual"; macOS — System Settings, Network, your connection, Details, DNS. On a router look for "Primary / Secondary DNS" under WAN or Internet settings. Then flush the system DNS cache and restart the browser.

How to find the fastest DNS server for you

Third-party rankings are a hint, not the truth: latency is defined by the route from your ISP to the service's nearest node — a neighbor on another ISP can get numbers that differ by multiples. Measure the candidates from your network with dig (Linux/macOS) or nslookup (Windows):

# General form: dig @<resolver_address> domain
# The "Query time" field is the resolver latency in ms
dig @1.1.1.1 example.com | grep "Query time"
dig @8.8.8.8 example.com | grep "Query time"
dig @9.9.9.9 example.com | grep "Query time"

# A series of 5 runs — filters out random spikes
for i in 1 2 3 4 5; do dig @9.9.9.9 example.com +noall +stats | grep "Query time"; done

# Windows PowerShell — nslookup response time
Measure-Command { nslookup example.com 1.1.1.1 } | Select-Object TotalMilliseconds

Measure each server several times and at different hours: the first run is inflated by a cold cache, and a popular name like example.com is almost always cached — also try a less common domain to see the resolver's own recursion speed. Include your current ISP resolver in the test (its address is shown by ipconfig /all on Windows, scutil --dns on macOS, resolvectl status on Linux). On Windows, GRC's free DNS Benchmark automates the same comparison. More utilities — in our review of DNS lookup tools.

The rule is simple: among services whose policy and filtering suit you, pick the one with the lowest median latency. The gap between 5 and 40 ms per cold domain is a real difference on heavy pages.

Which DNS server am I actually using?

Settings can lie: a router, VPN client or antivirus may intercept port 53 and answer itself. Ask Google's servers who reached them — the TXT answer contains the address of the resolver that actually did the lookup:

dig +short TXT o-o.myaddr.l.google.com
nslookup -type=TXT o-o.myaddr.l.google.com

If you configured 1.1.1.1 but the returned address belongs to your ISP, your queries are being redirected. Cloudflare users can also open https://1.1.1.1/help in a browser to see whether they are connected to 1.1.1.1 and whether DoH or DoT is in use.

How to check your DNS with enterno.io

Once the new resolver is set, confirm two things from outside your network: that the domains you care about resolve to the right addresses, and that the latency to the resolver is what you expect.

• DNS lookup — query A, AAAA, MX, NS, TXT, CNAME and SOA records of any domain and compare them with what your device sees.
• Ping and latency check — response time to 1.1.1.1, 8.8.8.8, 9.9.9.9 or any other address.
• DNS propagation check — how a record looks across many public resolvers at once, useful when one resolver returns a different answer.

Privacy and filtering

A resolver sees the domain of every site you open — sensitive data. Cloudflare promises to delete query logs within 25 hours, Quad9 states it does not store user IPs, Google keeps temporary logs up to 48 hours, AdGuard declares it does not record activity, Yandex follows its general privacy policy, and OpenDNS logs queries deliberately — its dashboard is built on them. These are the services' own statements — unverifiable by users, so it comes down to trust in the brand and jurisdiction.

DNS-level filtering is simple: if a domain is on an ad, phishing or malware list, the resolver returns an empty or blocked answer — the page, script or tracker never loads. A convenient first line of defense covering every device, no software needed.

A filtering DNS is neither an antivirus nor a full parental-control suite: it blocks by domain lists that can be bypassed and never sees page content. Treat it as the first layer of protection, not the last.

The takeaway: a DNS filter complements browser protections against phishing but does not replace them; for children's traffic, the family modes of Cloudflare, OpenDNS, AdGuard or Yandex DNS make a sensible base layer.

Is it safe to use a public DNS server?

Yes — the major public resolvers are operated by organizations with published privacy policies, DNSSEC validation and large security teams, which is more than most ISP resolvers can show. The real risks are elsewhere: plain-text DNS can be read or modified on the network path (fix it with DoH or DoT), and a resolver you do not recognize — for example, one set by malware or an unknown router firmware — can send you to fake sites. Stick to well-known addresses from the tables above and check your settings with the TXT test.

Checklist: switch to a new DNS in 10 minutes

• Pick 2–3 candidates from the ranking for your goal: speed, privacy or filtering.
• Measure each one's latency from your network — dig/nslookup or the online latency checker; repeat in the evening.
• Use the DNS checker to confirm the domains you care about resolve correctly.
• Set the primary and secondary addresses of one service — device for testing, router for the whole network; add the IPv6 pair if you have IPv6.
• Enable DoH or DoT in the browser or OS.
• Flush the system DNS cache and restart the browser.
• Verify with the o-o.myaddr.l.google.com TXT query which resolver answers.
• Observe for a couple of days: if a site stops opening due to the filter, change the mode or service.

FAQ

What is the best DNS server to use?

For most people, Cloudflare 1.1.1.1 with 1.0.0.1 as secondary; Google 8.8.8.8 if you want maximum predictability; Quad9 9.9.9.9 if you want malware blocking; AdGuard DNS for ad blocking; OpenDNS for parental controls. Confirm with a latency test from your own network.

Can I mix the primary DNS from one service with a secondary from another?

Technically yes — 1.1.1.1 + 8.8.8.8 works. But the OS may query both addresses rather than strictly fail over, making filtering unpredictable: a query to the unfiltered server bypasses the blocks. If filtering matters, both addresses must come from one service and mode.

Will changing DNS make websites load faster?

Only the resolution step gets faster — tens of milliseconds per new domain; the effect shows on cold sites. Download and streaming speeds do not depend on DNS.

Does changing DNS hide my browsing from my ISP?

Not on its own. With plain DNS the ISP can still read your queries on the wire, and it always sees the IP addresses you connect to. Encrypted DNS (DoH or DoT) hides the queries themselves, but the destination addresses remain visible.

What is the best free DNS server for ad blocking?

AdGuard DNS at 94.140.14.14 and 94.140.15.15 blocks ads and trackers for free on every device. It cannot remove ads served from the same domain as the content, so some video and social-network ads remain.

What happens if a public DNS server goes down?

The device switches to the secondary address — which is why you configure one. Full outages of major resolvers are rare but happen, so keep a backup service's addresses handy.