DNS Resolver Leaderboard

Fastest in most regions; minimal logging by policy.

Cloudflare's 1.1.1.1 is the fastest public resolver in most regions thanks to an aggressive anycast footprint and well-peered transit. Cloudflare publishes a privacy policy committing to not write query logs to disk and to discard in-memory traces within 24 hours; KPMG audits this annually. The trade-off for performance and privacy: Cloudflare does not send EDNS Client Subnet by default, which can lead to less-optimal GeoDNS routing for sites that depend on it. Good default for: privacy-conscious users, low-latency lookups, and developers who want reliable global performance.

30-day p50— samples—

Best EDNS Client Subnet support; widely deployed.

Google Public DNS at 8.8.8.8 was the first mass-market anycast resolver and remains one of the most-used. It supports EDNS Client Subnet by default, which means GeoDNS-routed services typically get better answers through Google than through Cloudflare. Logging is more aggressive than Cloudflare's (temporary full logs, anonymized after 48 hours), which is the visible trade-off. Good default for: developers debugging GeoDNS, users on networks where Cloudflare is rate-limited or blocked, and anyone wanting a globally-available second resolver alongside 1.1.1.1.

30-day p50— samples—

Blocks known malicious domains; non-profit, Swiss-based.

Quad9 is run by a non-profit foundation based in Zurich. Its differentiator is built-in threat blocking: 9.9.9.9 consults real-time threat-intelligence feeds and returns NXDOMAIN for known malware/phishing domains. There's also 9.9.9.10 (no filtering) and 9.9.9.11 (filtering + ECS). Latency is generally higher than Cloudflare or Google because of the smaller POP footprint, particularly in Asia and South America. Good default for: small business and family use where automatic malware blocking is more valuable than the last 20ms of latency.

30-day p50— samples—

Optional content filtering; long-running US operator.

OpenDNS has been around since 2005 and is now part of Cisco's Umbrella security platform. The free tier at 208.67.222.222 offers basic phishing protection and optional category-based content filtering (configurable on an account dashboard). It's a popular choice in schools and small offices for that filtering. Performance is solid in North America and Western Europe, weaker in Asia. Good default for: parents who want a simple "block adult content" setup without installing client software, or organizations that already use Cisco Umbrella.

30-day p50— samples—

Blocks ads + trackers at the DNS layer.

AdGuard DNS at 94.140.14.14 filters ad and tracker domains by default, making it a network-wide adblocker without any per-device configuration. There's also a "Family Protection" endpoint (94.140.14.15) that additionally blocks adult and malware domains. Latency is best in Europe and the Middle East; usable elsewhere. The trade-off: any DNS-layer blocklist will occasionally over-block legitimate domains (CDN trackers that double as functional assets, for instance). Good default for: users who don't want browser-level adblockers, or routers that should filter for every device.

30-day p50— samples—

Per-user customizable blocklists; free tier with quotas.

NextDNS gives each user their own configuration (blocklists, allowlists, logging preferences, parental controls). The free tier allows 300,000 queries per month, which is generous for a single household. Setup involves creating a profile and pointing devices at a per-account DoH/DoT endpoint or one of the rotating IPs. Performance is competitive with the major anycast operators. Good default for: power users who want granular control over blocklists, want detailed query logs they actually own, or are managing DNS for a small group.

30-day p50— samples—

Best latency for Russian / CIS users; Cyrillic-language defaults.

Yandex DNS at 77.88.8.8 is the dominant public resolver for users in Russia and the CIS region. It offers three modes: basic, "safe" (blocks malware), and "family" (additionally blocks adult content). Latency from Western Europe and North America is noticeably higher than the other globally-distributed operators. WhereIsDNS queries it primarily for cross-regional consensus: if a record looks healthy at every Western resolver but Yandex returns something different, that's a meaningful signal.

30-day p50— samples—

Best performance from mainland China.

AliDNS at 223.5.5.5 is run by Alibaba Cloud. Like Yandex, its latency from outside its home region is high — typically several hundred milliseconds from Europe or the Americas. From within mainland China it's one of the fastest and most reliable resolvers available. WhereIsDNS queries AliDNS to surface how a given record actually looks to Chinese users, which can differ meaningfully from the Western view when GeoDNS or local network-layer filtering is in play.

30-day p50— samples—

Tencent's mainland-China resolver.

DNSPod at 119.29.29.29 is Tencent Cloud's public DNS service. Similar profile to AliDNS — fast inside mainland China, slow from elsewhere — and similarly valuable as a second China-region data point for cross-checking how a record appears to Chinese users. Tencent and Alibaba run independent infrastructure, so when both return the same value it's strong confirmation; when they diverge, there's typically a recent change still propagating through mainland Chinese DNS infrastructure.

30-day p50— samples—

Optional family / adult-content filtering.

CleanBrowsing offers three free filtering profiles: security (blocks malware), adult (additionally blocks adult content), and family (additionally enforces SafeSearch on Google/YouTube/Bing). It's popular in US schools and homes for the family-filtering profile. Latency is best in North America. Good default for: parents who want a single DNS change to enforce SafeSearch across all devices without installing browser extensions or relying on each platform's parental controls.

30-day p50— samples—

No-logs operator; DoH/DoT only (no plain UDP).

Mullvad DNS is run by the Swedish privacy-focused VPN operator. Unlike most public resolvers, Mullvad's DNS service only accepts encrypted queries (DNS-over-HTTPS or DNS-over-TLS); plain UDP queries on port 53 are not answered. Several blocking profiles exist: base (no filtering), adblock, family, extended. Best latency in Northern Europe. Good default for: users who already use Mullvad VPN, or anyone wanting an explicitly encrypted-only no-logs DNS service in Sweden's strict privacy jurisdiction.

30-day p50— samples—

Customizable like NextDNS; built by Windscribe team.

Control D is run by the Windscribe VPN team and offers per-account customizable filtering similar to NextDNS. The free tier provides several pre-configured profiles (block malware, block ads, block social, etc.); paid tiers add custom blocklists, per-device routing, and detailed analytics. Performance is competitive with the bigger operators. Good default for: users who want NextDNS-style customization with a slightly different feature set and a Canadian/global infrastructure footprint.

30-day p50— samples—

Long-running ISP resolver; popular among network operators.

Hurricane Electric is best known as a major Tier 1 IP transit provider, but it also operates a public DNS resolver at 74.82.42.42. The resolver is more of a "network engineer's tool" than a mass-market service — there's no filtering, no fancy dashboard, just straightforward recursive DNS from one of the better-peered networks on the internet. Good default for: ISPs, hosting providers, and engineers who want a resolver from a deeply-peered transit operator as a reference point.

30-day p50— samples—

EU-funded public resolver; GDPR-aligned by design.

DNS4EU is a publicly-funded European DNS initiative led by Whalebone, launched in 2025 to give EU users an alternative to US/non-EU public resolvers. It operates exclusively within EU jurisdiction, with explicit GDPR-aligned data handling and optional malware/phishing filtering. Latency is excellent inside the EU and meaningful elsewhere as a "what does this look like from an EU-jurisdiction resolver" data point. Still relatively new, so the POP footprint is smaller than the legacy operators.

30-day p50— samples—