3D render: a stack of white and metal server units with status lights, beside a glass query capsule

Resolvers

Best DNS Servers with Encrypted DNS: Six Public Resolvers Compared

Editorial team · reviewed 9 October 2026 · how pages are written

Search for the best DNS servers and most answers rank resolvers by raw speed. Speed matters, but it changes with your location and your ISP’s routing. What does not change from one city to the next is how a resolver encrypts your queries, what it promises to log, and what it filters, and those properties are what this shortlist compares.

Hop 01

What makes the best DNS servers for privacy

Five criteria decide a place here. The resolver must accept at least one encrypted protocol, either DNS-over-HTTPS, DNS-over-TLS or DNSCrypt. Its operator must publish a logging policy. It must validate DNSSEC. Filtering, if any, must be stated, with an unfiltered option for those who want one. And the operator’s legal home should be easy to find.

Resolver	IPv4 addresses	Encrypted protocols	DNSSEC	Default filtering	Stated logging
Cloudflare 1.1.1.1	1.1.1.1, 1.0.0.1	DoH, DoT, ODoH	Validates	None (1.1.1.2 and 1.1.1.3 filter)	Logs deleted within 25 hours
Quad9	9.9.9.9, 149.112.112.112	DoH, DoT, DNSCrypt	Validates on all addresses	Malware (9.9.9.10 unfiltered)	No user IP addresses recorded
Google Public DNS	8.8.8.8, 8.8.4.4	DoH, DoT	Validates	None	Temporary logs, 24 to 48 hours
AdGuard DNS	94.140.14.14, 94.140.15.15	DoH, DoT, DoQ, DNSCrypt	Flag set in stamp	Ads, tracking, phishing	Anonymous domain list, 24 hours
NextDNS	Per account	DoH, DoT	Flag set in stamp	Per account	Nothing unless the user enables it
DNS.SB	185.222.222.222, 45.11.45.11	DoH, DoT	Flag set in stamp	None	No logs

The DNSSEC entries marked as a stamp flag come from the public resolver directory, where each operator declares DNSSEC, logging and filtering bits in its DNS stamp. Mullvad DNS would have qualified, but Mullvad states that its public encrypted DNS service will be discontinued on November 2, 2026, so it is left out.

Hop 02

Cloudflare 1.1.1.1

Cloudflare’s resolver answers on 1.1.1.1 and 1.0.0.1, with 2606:4700:4700::1111 and 2606:4700:4700::1001 for IPv6, and Windows lists it among its known DoH servers. Its documentation lists DNS-over-TLS, DNS-over-HTTPS and Oblivious DoH as supported encryption standards. The FAQ calls 1.1.1.1 a DNSSEC-validating resolver and says it does not send the EDNS Client Subnet header to authoritative servers.

The privacy commitment is specific. Cloudflare says client IP addresses are not written to non-volatile storage, apart from randomly sampled packets from at most 0.05 percent of traffic, and that resolver logs are deleted within 25 hours. For filtering, 1.1.1.1 for Families uses 1.1.1.2 to block malware and 1.1.1.3 to block malware and adult content.

Hop 03

Quad9

Quad9 is run by a Swiss foundation based in Zürich, and its privacy policy states that it does not collect or record user IP addresses. What it keeps are mostly counters, broken down by things like query type, server location and coarse region. The main addresses 9.9.9.9 and 149.112.112.112 block malicious domains and validate DNSSEC.

Quad9 is one of two resolvers here, with AdGuard, that offer all three encrypted protocols: DoH at dns.quad9.net/dns-query, DoT at dns.quad9.net, and DNSCrypt through a published resolver file. Experts who want no blocking can use 9.9.9.10, which still validates DNSSEC, while 9.9.9.11 keeps the blocking and adds EDNS Client Subnet.

Hop 04

Google Public DNS

Google’s resolver at 8.8.8.8 and 8.8.4.4 supports DoT at dns.google on port 853 and DoH at dns.google/dns-query, plus a JSON API. Its FAQ calls it a validating, security-aware resolver that does not block or filter, with rare exceptions for security threats or legal requirements. It does use EDNS Client Subnet, sharing part of your address with authoritative servers.

The privacy page describes two tiers. Temporary logs with full IP addresses are deleted within 24 to 48 hours, while a sample is kept permanently with the address replaced by city or region-level location. Google says it does not correlate these logs with other Google services, except to address security and abuse. DNSCrypt is not among its documented transports.

Hop 05

AdGuard DNS: ad blocking at the resolver

AdGuard DNS Default at 94.140.14.14 and 94.140.15.15 is the choice here for ad blocking without installing anything: its servers block ads, tracking and phishing. A Family Protection variant adds adult-site blocking and safe search, and a Non-filtering variant at 94.140.14.140 blocks nothing at all, for those who only want encryption.

It also has the widest protocol range in this list: DoH, DoT, DNS-over-QUIC, and DNSCrypt on port 5443. The privacy policy says no personal data is processed on the public servers, with only an anonymous list of domains requested in the last 24 hours. AdGuard Software Limited is registered in Limassol, Cyprus, and stores this data in Frankfurt.

Hop 06

NextDNS

NextDNS works differently from the rest. Instead of one shared configuration, each account gets its own endpoint with its own block lists, so ad blocking, tracker blocking or parental rules are whatever you set. The public resolver list also carries a non-filtering NextDNS entry with DNSSEC and no-log flags, for use without an account.

Its privacy policy says nothing is logged unless the user asks for it, and that users choose what is logged, for how long and in which jurisdiction. When logging is off, the server discards request and response data right after replying. That makes it a strong pick if you want filtering under your own control.

Hop 07

DNS.SB

DNS.SB is a free resolver built on xTom’s anycast network, which its homepage describes as running in 30 locations across six continents. The IPv4 addresses are 185.222.222.222 and 45.11.45.11, and it offers DNS-over-HTTPS and DNS-over-TLS. The homepage promises no logs, and the resolver list entry describes it as unfiltered with DNSSEC.

It earns its place as a plain, unfiltered alternative outside the large platforms, and one of the best DNS servers for readers who want nothing changed in their answers. The published policy is short, a single no-logs statement, so it suits readers who are happy to trust a brief promise in exchange for simplicity.

Hop 08

Primary and secondary addresses

Every operator publishes at least two addresses, and they are meant to be used as a pair. Enter both as primary and secondary DNS on a router or adapter: if one address is unreachable, the system tries the other. Mixing two operators splits your queries between two policies, so one forgotten address undoes the choice.

With dnscrypt-proxy the pair matters less, because the proxy keeps several servers in rotation, measures their speed and moves traffic to the fastest ones. To see which of these resolvers answers fastest where you are, run the DoH speed test; for blocking beyond what a resolver offers, the filtering guide covers local block lists.

Hop 09

How the best DNS servers shortlist was put together

Every entry is based on what each operator publishes about its own service: its setup pages, its privacy policy and its FAQ, all read in October 2026, plus the properties each operator declares in its DNS stamp in the public resolver list. Nothing here comes from comparison sites or user reports.

A resolver made the list only if its encrypted endpoints, logging policy and filtering were all stated on its own pages, which is why some well-known services are missing. No performance or privacy testing was carried out, and logging claims are reported as the operators state them, so check the linked policies again before relying on one.

Hop 11

Frequently asked questions

Which public DNS server is the most private?

It depends on whose published policy you trust most. Quad9 says it does not collect or record user IP addresses, Cloudflare says client IPs are not written to non-volatile storage and logs go within 25 hours, and NextDNS logs nothing unless you ask it to. Google keeps temporary logs for 24 to 48 hours.

What should I use as primary and secondary DNS?

Use the two addresses the same operator publishes, such as 9.9.9.9 and 149.112.112.112 for Quad9 or 1.1.1.1 and 1.0.0.1 for Cloudflare. Mixing operators means some queries follow one privacy policy and filter list while the rest follow another, which makes results hard to predict. If one address stops answering, the system simply tries the other.

Which resolver blocks ads?

AdGuard DNS Default at 94.140.14.14 and 94.140.15.15 blocks ads, tracking and phishing. NextDNS lets you build your own block lists per account. Quad9's main addresses and Cloudflare's 1.1.1.2 focus on malware, and Google Public DNS does not filter at all. For encryption without blocking, AdGuard also offers a Non-filtering variant at 94.140.14.140.

Do these resolvers validate DNSSEC?

Cloudflare, Google and Quad9 state on their own pages that they validate DNSSEC, Quad9 on every address. The stamps in the public resolver list also carry a DNSSEC flag for AdGuard, NextDNS and DNS.SB, as declared by their operators. With dnscrypt-proxy, the require_dnssec setting limits it to servers whose stamps declare that flag.

Can I use these resolvers with dnscrypt-proxy?

Yes. All six appear in the public resolver list that dnscrypt-proxy downloads, either as DNSCrypt servers, DoH servers or both. You select them by name in the server_names setting, or let the proxy choose the fastest from those that match your require_nolog and require_dnssec filters. Only Quad9 and AdGuard offer DNSCrypt, so the other four are used over DoH.