Best DNS Servers 2026: Speed, Privacy and Security Compared

Last updated: June 12, 2026. Resolver addresses and privacy policies re-checked against each provider's own documentation.

Best DNS Servers in 2026: The Quick Answer

The best DNS server depends on your priority: Quad9 (9.9.9.9) for privacy plus automatic malware blocking, Cloudflare (1.1.1.1) as the fast private all-rounder, AdGuard DNS for ad blocking, OpenDNS FamilyShield for family-safe filtering, and NextDNS or ControlD if you want to choose exactly what gets blocked. All of them are free.

Not sure which DNS you are using right now? Run our DNS Leak Test — it shows the resolver actually answering your queries, which is often not the one you think.

2026 Comparison Table

Addresses and policy summaries above were verified against each provider's own published documentation in June 2026. Dashes mean the provider does not publish that detail on the pages we checked.

The Best Public DNS Servers, Compared

Cloudflare 1.1.1.1 — Best All-Around

Best for: a fast, private, zero-configuration default. Cloudflare's public resolver privacy commitments state it will never sell or share resolver data or use it for advertising, that client IPs are truncated, and that resolver logs are deleted within 25 hours. Supports DNS over HTTPS (DoH) and DNS over TLS (DoT). Optional filtered variants: 1.1.1.2 (blocks malware) and 1.1.1.3 (blocks malware and adult content).

• IPv4: 1.1.1.1 and 1.0.0.1
• IPv6: 2606:4700:4700::1111 and 2606:4700:4700::1001
• DoH: https://cloudflare-dns.com/dns-query

Google Public DNS 8.8.8.8 — Best for Reliability

Best for: a dependable, no-frills resolver on Google's global infrastructure. Privacy is decent but not zero-knowledge: per Google's own privacy page, temporary logs (which include your IP address) are deleted within 24 to 48 hours, while permanent logs keep only anonymized, city-level data with no IP addresses, and the data is not used to target ads. No content filtering.

• IPv4: 8.8.8.8 and 8.8.4.4
• IPv6: 2001:4860:4860::8888 and 2001:4860:4860::8844
• DoH: https://dns.google/dns-query

Quad9 9.9.9.9 — Best for Security and Privacy

Best for: automatic protection with a genuinely strict privacy policy. Quad9 blocks domains associated with malware, phishing, spyware, and botnets using threat-intelligence feeds, and validates DNSSEC. It is operated by the Swiss-based non-profit Quad9 Foundation, and its privacy policy states it does not collect or record users' IP addresses at all, and does not share, sell, or rent any information that could identify an individual. An unfiltered variant (9.9.9.10) exists if you want no blocking.

• IPv4: 9.9.9.9 and 149.112.112.112
• IPv6: 2620:fe::fe and 2620:fe::9

OpenDNS — Best for Families

Best for: set-and-forget parental controls. OpenDNS (owned by Cisco) is the long-running choice for family filtering: FamilyShield comes preconfigured to block adult content with zero setup. OpenDNS publishes IPv4 resolver addresses on its setup guide; if you need IPv6 or per-category filtering, check the current options on its site.

• IPv4: 208.67.222.222 and 208.67.220.220
• FamilyShield (blocks adult content): 208.67.222.123 and 208.67.220.123

AdGuard DNS — Best for Ad Blocking

Best for: network-wide ad blocking without installing anything. The default servers block ads and trackers at the DNS level; a Family Protection variant additionally blocks adult content and enforces Safe Search, and a non-filtering variant does no blocking at all. On privacy, AdGuard's policy says it stores aggregated server performance metrics and an anonymous 24-hour database of requested domains with, in its words, no information that could link any domain to the user who requested it.

• IPv4 (default, blocks ads and trackers): 94.140.14.14 and 94.140.15.15
• IPv6 (default): 2a10:50c0::ad1:ff and 2a10:50c0::ad2:ff

NextDNS — Best for Customization

Best for: people who want a personal, fully configurable resolver — a cloud firewall for DNS. You create a configuration and point your devices at your own endpoints (DoH/DoT, plus linked IPs), then pick blocklists, parental controls, and analytics. By default nothing is logged unless you turn logging on; if you do, you choose the retention period (from one hour up to two years) and the storage jurisdiction, and NextDNS states it will never sell, license, or share user data. The free tier has a monthly query quota — beyond it, NextDNS keeps resolving but stops blocking.

• Setup: per-configuration endpoints from nextdns.io (there is no universal public IP pair)

ControlD — Best for Preset Filtering Tiers

Best for: picking a ready-made filtering level without an account. ControlD (from the Toronto-based team behind Windscribe VPN) publishes free public resolvers in preset tiers alongside paid fully-customizable configurations, and states it does not log or store DNS queries on the free service. Per-tier addresses, from ControlD's own documentation:

• p0 — Unfiltered: 76.76.2.0 and 76.76.10.0 (IPv6 2606:1a40:: and 2606:1a40:1::) — DoH: https://freedns.controld.com/p0
• p1 — Malware blocking: 76.76.2.1 and 76.76.10.1 — DoH: https://freedns.controld.com/p1
• p2 — Ads & Tracking: 76.76.2.2 and 76.76.10.2 — DoH: https://freedns.controld.com/p2
• p3 — Social blocking: 76.76.2.3 and 76.76.10.3 — DoH: https://freedns.controld.com/p3

Mullvad DNS — Best for Encrypted-Only Privacy

Best for: privacy-focused users who want encrypted transport by design. Mullvad (the VPN provider) runs a public resolver built for DoH and DoT — plain port 53 is only used to bootstrap its own hostnames — and applies QNAME minimization so upstream servers see as little of your query as possible. Content-blocking variants are published as separate addresses: adblock (194.242.2.3), base (194.242.2.4), extended (194.242.2.5), family (194.242.2.6), and all (194.242.2.9).

• IPv4 (no blocking): 194.242.2.2
• IPv6 (no blocking): 2a07:e340::2
• DoH: https://dns.mullvad.net/dns-query

DNS4EU — The EU-Backed Option

Best for: users who want a resolver operated inside the European Union. DNS4EU is the public resolver launched under the EU's DNS4EU initiative, offered in five variants from protective (malware blocking) to fully unfiltered. Addresses per the official joindns4.eu setup page:

• Protective: 86.54.11.1 and 86.54.11.201 (IPv6 2a13:1001::86:54:11:1) — DoH: https://protective.joindns4.eu/dns-query
• Protective + child protection: 86.54.11.12 and 86.54.11.212 — DoH: https://child.joindns4.eu/dns-query
• Protective + ad blocking: 86.54.11.13 and 86.54.11.213
• Protective + child protection + ad blocking: 86.54.11.11 and 86.54.11.211
• Unfiltered: 86.54.11.100 and 86.54.11.200

What Happened to dns0.eu?

dns0.eu, the French resolver recommended in many older "best DNS servers" lists, was discontinued in October 2025 — the operators said running it was no longer sustainable in time and resources. If you still have 193.110.81.0 or 185.253.5.0 configured, switch now: DNS4EU protective (86.54.11.1) is the closest EU-based equivalent, and Quad9 offers similar malware blocking with a strict no-IP-collection policy. Not sure what you are running? Our DNS leak test shows the resolver actually answering your queries.

Best Secure DNS: DNSSEC, Encryption, and Malware Blocking

"Best DNS" and "best secure DNS" are not always the same question. A secure resolver does three distinct things, and the strongest picks do all three: it validates DNSSEC so answers cannot be forged, it supports encrypted transport (DoH/DoT) so your queries cannot be read or tampered with on the wire, and it can optionally block malicious domains before your device ever connects to them.

DNSSEC — proof the answer is genuine

DNSSEC (DNS Security Extensions) cryptographically signs DNS records so a validating resolver can verify the answer really came from the domain owner and was not altered in transit — it defends against cache poisoning and spoofed responses. It does not encrypt or hide your queries; it only authenticates them. The major public resolvers — Cloudflare (1.1.1.1), Google Public DNS (8.8.8.8), and Quad9 (9.9.9.9) — perform DNSSEC validation by default, per their own documentation. If you run your own resolver, enabling DNSSEC validation is the single biggest integrity upgrade you can make.

DoH and DoT — encryption so nobody can read your DNS

Classic DNS travels in plain text on port 53, which means your ISP, your network operator, or anyone on the path can see — and in principle modify — every domain you look up. Two standards fix this by encrypting the query:

Encryption (DoH/DoT) and authentication (DNSSEC) are complementary: use both. Encryption hides your queries from the network; DNSSEC proves the answers are real. Neither hides the destination IP you ultimately connect to — for that you still need a VPN, and you should confirm there is no DNS leak.

Malware-blocking resolvers — security at the DNS layer

A "protective" or "secure" resolver refuses to resolve domains known for malware, phishing, or botnet command-and-control, stopping the connection before it starts. From the verified picks above, the security-filtering options are: Quad9 (9.9.9.9) blocks malicious domains using threat-intelligence feeds, Cloudflare 1.1.1.2 blocks malware (and 1.1.1.3 adds adult-content blocking), OpenDNS / Cisco filters by category, ControlD p1 (76.76.2.1) blocks malware, DNS4EU protective (86.54.11.1) blocks malware, and AdGuard DNS blocks ads and trackers. Each address and behavior above is taken from the provider's own documentation.

Best Nameservers vs. Best DNS Resolvers — What People Actually Mean

Searches for "best nameservers" usually mean one of two different things, so it is worth separating them:

For day-to-day privacy and security, "best nameservers" means a recursive resolver that validates DNSSEC, supports DoH/DoT, and optionally blocks malware — exactly the criteria the picks in this guide are ranked on.

Which DNS Server Is Fastest? Test It From Your Browser

The honest answer: it depends on where you are. Every provider above runs a global anycast network, so the fastest resolver for you is usually whichever one has capacity closest to your ISP's routing path — and that changes by country, city, and network. Benchmark averages measured from someone else's region tell you very little about your own connection, which is why we do not print made-up millisecond numbers here. Instead, measure it yourself: the test below sends real DNS-over-HTTPS queries from your browser to each resolver and ranks them by median round-trip time.

Method note: this measures each resolver's DoH endpoint over HTTPS, which includes HTTP overhead, so absolute numbers run higher than plain UDP DNS. A warmup request is sent first so the timed runs measure the resolver rather than the TLS handshake. What matters is the ranking on your connection, not the absolute values.

In practice, the latency difference between the major resolvers is small for most connections, and cached answers are near-instant everywhere — so choose on privacy and filtering, then verify the switch worked with our DNS Leak Test.

How to Change Your DNS (and Verify It Worked)

Frequently Asked Questions

What is the best DNS server for privacy?

Quad9 and Mullvad DNS have the strongest stated privacy postures: Quad9's policy says it does not collect or record users' IP addresses at all, and Mullvad's resolver is designed for encrypted-only use with QNAME minimization. Cloudflare 1.1.1.1 is also strong — no selling or sharing, IPs truncated, logs deleted within 25 hours. Whichever you pick, confirm it took effect with the DNS Leak Test.

What is the best DNS server for speed?

There is no universal fastest resolver — anycast routing means the answer depends on your location and ISP. Cloudflare 1.1.1.1 and Google 8.8.8.8 are the usual picks when speed is the only criterion, but the only measurement that matters is from your own connection: try one for a day, then the other.

What is the best free DNS server?

Every resolver in this guide is free. As defaults: 1.1.1.1 for all-around speed and privacy, 9.9.9.9 for automatic malware blocking, AdGuard DNS for ad blocking, OpenDNS FamilyShield for family-safe browsing, and NextDNS or ControlD when you want to tune the filtering yourself.

Should I change my DNS server?

If you never changed it, you are using your ISP's resolver — which can see and log every domain you visit. Switching is free, takes minutes, is fully reversible, and can add malware blocking or content filtering on top. It is one of the highest-value, lowest-effort privacy upgrades available. Afterwards, run a DNS leak test to confirm your queries actually moved.

Does changing my DNS hide my browsing from my ISP?

Only partly. You move your query history from the ISP to the new resolver, but classic DNS is sent in plain text, so the ISP can still read queries in transit — enable DoH or DoT to close that gap. Your ISP still sees the IP addresses you connect to either way; full traffic privacy requires a VPN. See what your ISP can see for the complete picture.