Choosing a DNS resolver

Almost every comparison of public DNS resolvers is a speed table, which is the least interesting way to choose between them. They are all fast. On a normal connection the difference between the leading options is a few milliseconds, once per new domain, and you will not perceive it.

What is worth thinking about is that your resolver sees a list of every domain you visit - And that when it fails, your internet appears to stop entirely.

The main options

All three public options support DNS over HTTPS and DNS over TLS, both support IPv6, and all three run anycast networks with hundreds of locations.

Speed, honestly

Benchmarks rank these constantly and the rankings disagree, because the answer depends entirely on where you are. Anycast routes you to the nearest instance of the resolver, so what matters is which provider has a point of presence closest to your network - Not which is faster in the abstract.

Two things are more likely to be true than any published table:

A public resolver will usually beat your ISP's. Not always, and not by much, but ISP resolvers are frequently under-provisioned and occasionally badly maintained.

The cache hit rate matters more than the network distance. A resolver serving millions of users already has almost every popular domain in cache and answers instantly. A small ISP resolver has to go and ask. This is the main reason the big public resolvers feel quick, and it is invisible in a ping test.

If you want to know what is actually fastest from your connection, measure it - Dig or nslookup against each, a few times, on a domain you have not visited recently so you are not measuring a cache hit.

Privacy, which is the real question

Your resolver cannot see the pages you read. It can see every domain you ask for, and that is a remarkably detailed picture: Which bank, which health service, which employer, which dating app, which news sites, at what times.

So the honest framing is not "which is private" but "who would you rather that list went to".

Your ISP already knows your identity and your home address, and in several countries is legally required to retain records. It is also the party with the clearest commercial interest in the data.

Cloudflare makes the strongest public commitments - No logging of identifying data, query logs discarded within a day, independently audited. Its business is selling network services to companies, not advertising.

Google keeps temporary logs longer and states clearly that Public DNS data is not used for ad targeting and is kept separate from other Google services. Whether that separation is reassuring depends on how you feel about Google generally.

Quad9 is a non-profit foundation based in Switzerland, which puts it under a stricter privacy regime than a US company. It is the option chosen by people for whom the legal jurisdiction matters.

Filtering

Quad9 is the one that blocks. It refuses to resolve domains on threat-intelligence feeds - Malware command-and-control, phishing, known-bad infrastructure - So a click on a malicious link fails at the name lookup rather than reaching the site. It is a genuine security benefit and costs nothing.

The trade is occasional false positives, and no practical way to appeal one quickly. If a site fails only on Quad9, that is what has happened.

Cloudflare and Google resolve everything by default. Cloudflare offers filtered variants on different addresses - 1.1.1.2 blocks malware, 1.1.1.3 blocks malware and adult content - Which is a reasonable way to add a light filter for a family network without installing anything.

Note that none of this is content blocking in the ad-blocking sense. For that you want a resolver you run yourself, which is a different project.

Reliability, and the mistake everyone makes

These services are exceptionally reliable, and they are not infallible. Cloudflare's resolver has had genuine global incidents - In July 2024 a route leak combined with a BGP hijack made 1.1.1.1 unreachable for a portion of the internet.

When a resolver you depend on fails, the experience is total: Nothing resolves, every site and app fails, and your connection is perfectly healthy throughout. It is the most convincing impersonation of a global internet outage there is.

Which leads to the single most useful piece of advice on this page, and the one almost everybody gets wrong:

The caveat worth knowing: Operating systems do not reliably treat the secondary as a strict fallback. Some query both, some alternate. If a consistent policy matters - Say you want Quad9's filtering applied to everything - Using one provider on both entries is the way to guarantee it, at the cost of the redundancy.

A straightforward recommendation

For most people: Cloudflare primary, Google secondary. Fast, no filtering surprises, strong privacy position, and two independent operators.

If security matters more than the occasional false positive: Quad9 primary. The malware blocking is free protection that requires no software and no maintenance.

On a work laptop: Leave it alone. Corporate resolvers handle internal names, and overriding them breaks access to things you need.

If you run a Pi-hole or similar: Point your devices at it and let it use whichever upstream you prefer. Configuring a public resolver on the devices bypasses the Pi-hole entirely, which is the single most common reason people find their ad blocking has silently stopped working.

The step-by-step instructions cover every platform, including how to check afterwards that the change actually took effect.