Best Public DNS Servers 2026 — Tested and Ranked

PublicDNS.info monitors over 109,644 public DNS resolvers from multiple geographic locations. Every 72 hours, each server is probed for response time, uptime, DNSSEC validation status, and error behavior. We track reliability over rolling 30-day windows and flag servers that return incorrect responses, timeout frequently, or fail DNSSEC checks.

The rankings on this page reflect real-world performance data, not vendor claims. We do not accept payment for placement. Servers must maintain at least 80% reliability with no persistent timeout errors to appear in our directory at all. For full details on our monitoring infrastructure, see our about page.

Each probe sends standard A-record queries for well-known domains, measures the round-trip time in milliseconds, and checks whether the returned response is valid. We also send intentionally malformed queries and queries for DNSSEC-signed domains to test each server's error handling and signature validation. Servers that hijack NXDOMAIN responses (returning their own landing page instead of a proper error) are flagged in our NXDOMAIN hijacking guide.

You can verify any server's current status yourself using our DNS Privacy Check tool or the DNS Gaming Benchmark.

DNS speed is measured by the round-trip time (RTT) from your device to the resolver and back. Lower is better. The fastest DNS server for you depends on your physical location and your ISP's peering arrangements. A server that returns 5ms in Frankfurt might return 120ms in Sydney.

In our global testing, Cloudflare 1.1.1.1 consistently records the lowest average latency. Its anycast network spans 300+ cities, which means you are almost always hitting a nearby node. Google 8.8.8.8 is a close second, with similar global coverage. Quad9 has made significant improvements in 2025 and 2026, expanding its anycast footprint to over 200 locations.

These numbers represent typical performance. Your results will differ. The only way to know which is fastest for your specific network is to test it. Our DNS gaming benchmark runs real queries from your browser against 24+ servers and shows you the results in seconds.

For country-specific data, check our United States, United Kingdom, or full country directory.

Every DNS query you make reveals which domains you visit. If your DNS provider logs those queries, your browsing history exists on their servers. If the connection is unencrypted, your ISP can also read every query in transit.

Privacy-focused DNS requires two things: a provider that does not retain query logs, and encrypted transport (DoH or DoT) to prevent eavesdropping. The three strongest options right now are Mullvad, Quad9, and Cloudflare.

Mullvad DNS is the most private option available. Run by the same Swedish company behind the Mullvad VPN, it requires no accounts, keeps zero logs, and supports DoH and DoT. There is nothing to link queries back to you.

Quad9 is based in Switzerland, subject to Swiss privacy law. It does not log personal data and publishes transparency reports. It also blocks known-malicious domains by default, adding a security layer without sacrificing privacy.

Cloudflare 1.1.1.1 commits to purging all query logs within 24 hours and submits to regular third-party audits by KPMG. It supports DoH, DoT, and the WARP app for mobile devices.

For a deeper comparison, see our best private DNS guide. You can audit any server with our DNS privacy check. For provider-specific details, read the Cloudflare security audit, Quad9 security audit, or Mullvad security audit.

Security-focused DNS servers do more than resolve names. They validate DNSSEC to prevent spoofing, block queries to known-malicious domains, and refuse to resolve phishing sites. This stops threats before any connection is established.

Quad9 is the strongest security option. Backed by a nonprofit foundation, it integrates threat intelligence from 25+ feeds including IBM X-Force. Any query to a known-bad domain returns NXDOMAIN instead of the malicious IP. It validates DNSSEC on all responses.

OpenDNS (Cisco Umbrella) provides configurable security categories. The free tier blocks phishing and malware. Paid tiers add granular controls used by enterprises worldwide. It has been operating since 2006 and has one of the largest threat databases in the industry.

AdGuard DNS blocks ads, trackers, and known malicious domains. It supports DNSSEC and offers family-safe variants that add content filtering. Its wide protocol support (DoH, DoT, DoQ, DNSCrypt) makes it flexible across different setups.

All three validate DNSSEC. If your current DNS provider does not validate DNSSEC, you are vulnerable to DNS cache poisoning attacks. Check your status with our DNS privacy and security checker. For more details, see the AdGuard security audit and OpenDNS security audit.

DNS does not affect your in-game ping once you are connected to a game server. What it does affect is how quickly your device resolves the matchmaking server's hostname, how fast game updates start downloading, and whether you can connect at all if your ISP's DNS is flaky.

For gaming, you want the lowest possible resolution latency and high reliability. Cloudflare 1.1.1.1 and Google 8.8.8.8 are the top picks. Cloudflare typically wins on raw speed. Google wins on compatibility and has slightly better performance in parts of Asia-Pacific.

Set DNS at the router level so your console, PC, and mobile devices all benefit. If you are on PS5 or Xbox, you will need to set it on the console directly since consoles often ignore router DNS settings for certain queries. On PC, changing DNS at the OS level takes effect immediately without restarting your game client.

Avoid using DNS servers that inject ads or block gaming-related domains. Some filtered resolvers (particularly ISP defaults) interfere with matchmaking by returning incorrect IPs for game services. Stick with Cloudflare, Google, or Quad9 for an unfiltered, low-latency experience.

For detailed setup guides and platform-specific benchmarks, see our best DNS for gaming guide. Run the DNS gaming benchmark to test latency from your exact location.

Family-safe DNS servers block adult content, malware, and other harmful domains at the network level. Set one on your router and every device in the house is filtered automatically — phones, tablets, smart TVs, and game consoles included.

CleanBrowsing Family Filter (185.228.168.168) is the most restrictive. It blocks adult content, VPN and proxy sites, and mixed-content domains. OpenDNS FamilyShield (208.67.222.123) is the simplest — preconfigured, no account required. AdGuard Family (94.140.14.15) adds ad and tracker blocking on top of content filtering.

DNS filtering is effective but not bulletproof. A determined user can change their device's DNS settings to bypass it. Combine DNS filtering with device-level parental controls for stronger coverage. Our best family DNS guide covers setup in detail.

Every server in the comparison table above is free to use. Cloudflare, Google, Quad9, Mullvad, OpenDNS, AdGuard, CleanBrowsing, and Comodo all offer unrestricted free tiers with no bandwidth caps or query limits.

NextDNS offers a generous free tier of 300,000 queries per month with full filtering and analytics. After that, it falls back to a basic resolver without custom rules. The paid plan is $1.99/month for unlimited queries. Control D has a similar model: free basic resolution, paid plans for custom filtering and geo-unblocking.

There is no reason to pay for basic DNS resolution. The free options from Cloudflare, Google, and Quad9 are faster and more reliable than most paid alternatives. Where paid plans add value is in custom filtering rules, analytics dashboards, and per-device policies — features that NextDNS and Control D handle well.

If you want to go a step further without spending money, you can run your own recursive resolver using Unbound or set up Pi-hole on a Raspberry Pi for network-wide ad blocking. Both are open source and well-documented.

Cloudflare DNS (1.1.1.1)

Launched in 2018, Cloudflare's resolver is consistently the fastest public DNS in global benchmarks. Its anycast network operates from 300+ cities. It supports DoH, DoT, and Cloudflare WARP for mobile. The privacy policy commits to purging all logs within 24 hours and is audited annually by KPMG. DNSSEC validation is enabled by default. The main drawback is that Cloudflare is a US-based company, which may concern users in jurisdictions with data sovereignty requirements. Read the full Cloudflare DNS audit.

Google Public DNS (8.8.8.8)

The most widely used public DNS service, launched in 2009. Google operates one of the largest anycast networks in existence. Response times are consistently low worldwide, and uptime is near-perfect. It supports DoH and DoT. Temporary logs are retained for 24-48 hours, then replaced with aggregated data. Google DNS does not block any domains — it resolves everything. This makes it suitable when you want a pure, unfiltered resolver. Read the full Google DNS audit.

Quad9 (9.9.9.9)

Run by a Swiss nonprofit, Quad9 combines fast resolution with built-in threat blocking. It pulls from 25+ threat intelligence feeds and blocks queries to known-malicious domains before your device ever connects. No personal data is logged. DNSSEC is enforced on all responses. With 200+ anycast locations, performance is competitive with the top commercial providers. If you want security without configuring anything, Quad9 is the best default. Read the full Quad9 audit.

AdGuard DNS (94.140.14.14)

AdGuard's default resolver blocks ads and trackers at the DNS level. This means fewer HTTP requests, reduced page load times, and less tracking across all devices. It supports DoH, DoT, DoQ (DNS over QUIC), and DNSCrypt. Based in Cyprus, outside Five Eyes jurisdiction. No personally identifiable information is logged. The family variant (94.140.14.15) adds adult content blocking. Read the full AdGuard DNS audit.

OpenDNS / Cisco Umbrella (208.67.222.222)

One of the oldest public DNS services, acquired by Cisco in 2015. The free tier includes phishing and malware protection. Paid Umbrella plans add detailed logging and category-based filtering used by thousands of enterprises. OpenDNS is known for its stability and wide compatibility, but its logging practices are less transparent than newer providers. It supports DoH but not DoT. Read the full OpenDNS audit.

Mullvad DNS (194.242.2.2)

The most private DNS service available. Run by the Swedish VPN provider Mullvad, it requires no accounts, no registration, and logs nothing. It supports DoH and DoT. The network footprint is smaller than Cloudflare or Google, so latency is higher in some regions, but it performs well across Europe and North America. If privacy is your top concern and you are willing to accept a few milliseconds of extra latency, Mullvad is the right choice. Read the full Mullvad DNS audit.

NextDNS (45.90.28.0)

NextDNS is a configurable DNS firewall. You create a custom profile with blocklists, allowlists, and filtering rules, then point your devices at it. The free tier covers 300,000 queries/month. Logging is fully user-controlled — you can disable it entirely or keep detailed analytics. It supports DoH and DoT. The web dashboard is excellent for monitoring what is being blocked across your network. Read the full NextDNS audit.

Control D (76.76.2.0)

Control D offers free DNS with optional paid features for custom filtering and geo-unblocking. The free resolver does not log queries. Paid plans let you create filter profiles, block specific content categories, and redirect DNS for streaming services. It supports DoH, DoT, and DoQ. The network is smaller than the top providers but covers major regions well. Read the full Control D audit.

CleanBrowsing (185.228.168.9)

Focused on content filtering, CleanBrowsing offers three filter tiers: Security (malware only), Adult (malware + adult), and Family (the most restrictive, blocking VPNs and proxy sites too). All tiers support DoH and DoT. It is popular in schools and households where content control is needed without installing software on every device. No personal query data is logged. Read the full CleanBrowsing audit.

Comodo Secure DNS (8.26.56.26)

Comodo's resolver focuses on malware domain blocking. It maintains a blocklist of known threats and prevents resolution of those domains. However, it does not support encrypted DNS (no DoH or DoT), and its logging policy is not publicly documented. Performance is adequate but not competitive with the top tier. It is primarily used in corporate environments that already run Comodo security products. Read the full Comodo DNS audit.

Changing DNS takes less than five minutes on any platform. You can set it on individual devices or at the router level to cover your entire network. Router-level changes apply to every connected device automatically.

For encrypted DNS (DoH/DoT), you will need to configure it separately — plain DNS settings only use unencrypted UDP/TCP. Most modern operating systems now support encrypted DNS natively.

Platform setup guides:

Encrypted DNS guides:

Global averages do not tell you what performs best on your specific ISP and location. The only reliable way to find your fastest DNS is to benchmark from your own network. Our tools run real DNS queries from your browser — no downloads, no installs.

Or check your DNS privacy & security score

What is the best DNS server?

There is no single best DNS server for everyone. Cloudflare (1.1.1.1) is typically fastest, Quad9 (9.9.9.9) offers the strongest security with built-in threat blocking, and Mullvad DNS provides the most privacy with zero logging. The right choice depends on whether you prioritize speed, security, or privacy.

Is 1.1.1.1 better than 8.8.8.8?

Cloudflare 1.1.1.1 is generally faster than Google 8.8.8.8 in most regions, with lower average latency and a stronger privacy policy (logs purged within 24 hours, independently audited). Google DNS is slightly more reliable in terms of uptime and has wider IPv6 support. Both are solid choices.

Does changing DNS make internet faster?

Changing DNS can reduce the time it takes to resolve domain names, which speeds up the initial connection to websites. It will not increase your download speed or bandwidth. The biggest gains come from replacing a slow ISP resolver with a well-peered anycast provider like Cloudflare or Google.

Is it safe to use public DNS?

Yes, public DNS servers from reputable providers are safe and often more secure than ISP defaults. Providers like Quad9 and Cloudflare validate DNSSEC, block known malicious domains, and support encrypted DNS (DoH/DoT). Choose a provider with a clear privacy policy and enable encrypted DNS for maximum security.

What DNS does my ISP use?

Your ISP assigns its own DNS servers automatically via DHCP when you connect. These are typically operated by the ISP itself and may log your queries, inject ads, or lack DNSSEC validation. You can check which DNS server you are currently using with our DNS Privacy Check tool.

How often should I change DNS?

You do not need to change DNS servers regularly. Set it once to a reliable provider and leave it. Re-evaluate if your provider changes its privacy policy, if you notice resolution failures, or if a faster option becomes available in your region. Running a periodic benchmark can help identify if a switch would improve performance.

Explore more

• Browse DNS servers by country — find local resolvers in 100+ countries
• Provider security audits — detailed privacy and security profiles for every major DNS provider
• All DNS guides — setup instructions, encrypted DNS, Pi-hole, Unbound, and more
• Set up Unbound — run your own recursive resolver for maximum control
• Set up Pi-hole — network-wide ad blocking via DNS
• NXDOMAIN hijacking — how ISPs redirect failed queries and how to stop it
• Gaming DNS by country — regional performance data for gamers
• Privacy DNS by country — DNSSEC and encryption stats per country