Network registry · reviewed 2026-09-24
Public DNS resolvers, documented and measured
Comparison
Every resolver at a glance
| Resolver | Primary IPv4 | DNSSEC | Client subnet (ECS) | Protocols | Variants |
|---|---|---|---|---|---|
| Cloudflare 1.1.1.1 Cloudflare | 1.1.1.1 | Validates | None sent | DNS (53)DoTDoH | 3 |
| Google Public DNS Google | 8.8.8.8 | Validates | Sends /24 | DNS (53)DoTDoH | 1 |
| Quad9 Quad9 | 9.9.9.9 | Validates | Some addresses send /24 | DNS (53)DoTDoH | 3 |
| OpenDNS Cisco | 208.67.222.222 | Validates | Sends /24 | DNS (53) | 2 |
| AdGuard DNS AdGuard | 94.140.14.14 | Validates | Sends /24 | DNS (53)DoTDoH | 3 |
| CleanBrowsing CleanBrowsing | 185.228.168.9 | Validates | None sent | DNS (53)DoTDoH | 3 |
| Control D Free DNS Control D | 76.76.2.0 | Validates | None sent | DNS (53)DoTDoH | 6 |
| Mullvad DNS Mullvad VPN AB | 194.242.2.2 | Validates | Not measured | DoTDoH | 6 |
| DNS.SB xTom GmbH | 185.222.222.222 | Validates | None sent | DNS (53) | 1 |
| Comodo Secure DNS Comodo | 8.26.56.26 | Does not validate | None sent | DNS (53) | 1 |
| Yandex DNS Yandex | 77.88.8.8 | Does not validate | None sent | DNS (53)DoT | 3 |
| AliDNS (Alibaba Cloud Public DNS) Alibaba Cloud | 223.5.5.5 | Does not validate | Sends /25 | DNS (53)DoT | 1 |
| DNSPod Public DNS Tencent Cloud | 119.29.29.29 | Does not validate | Sends /24 | DNS (53)DoTDoH | 1 |
| 114DNS 114DNS | 114.114.114.114 | Does not validate | None sent | DNS (53) | 3 |
| CIRA Canadian Shield Canadian Internet Registration Authority (CIRA) | 149.112.121.10 | Does not validate | None sent | DNS (53)DoTDoH | 3 |
| DNS4EU Whalebone, s.r.o. | 86.54.11.1 | Validates | None sent | DNS (53)DoTDoH | 5 |
| SafeDNS SafeDNS | 195.46.39.39 | Does not validate | None sent | DNS (53) | 1 |
| Surfshark DNS Surfshark B.V. | 194.169.169.169 | Does not validate | None sent | DNS (53)DoH | 1 |
| DNS.WATCH DNS.WATCH | 84.200.69.80 | Validates | None sent | DNS (53)DoH | 1 |
| LibreDNS LibreDNS | 116.202.176.26 | Does not validate | Not measured | DoTDoH | 1 |
By behaviour
Find a resolver by what it does
DNSSEC-validating resolvers
Which resolvers refused deliberately mis-signed domains, and which returned them anyway.
DNS-over-HTTPS (DoH) endpoints
Every documented DoH URL, and whether it answered an RFC 8484 query over HTTP/2.
DNS-over-TLS (DoT) hostnames
Hostnames for Android Private DNS and other DoT clients, tested on port 853.
Client subnet (ECS) behaviour
Who passes part of your address to authoritative servers, and at what prefix length.
Family and malware filtering
Filtered variants, described in each operator’s own words.
DNSSEC
11 operators validate DNSSEC
dnssec-failed.org, rhybar.cz and badsig.go.dnscheck.tools with SERVFAIL while still resolving ordinary names.Cloudflare 1.1.1.1
1.1.1.1 · 1.0.0.1
Google Public DNS
8.8.8.8 · 8.8.4.4
Quad9
9.9.9.9 · 149.112.112.112
OpenDNS
208.67.222.222 · 208.67.220.220
AdGuard DNS
94.140.14.14 · 94.140.15.15
CleanBrowsing
185.228.168.9 · 185.228.169.9
Control D Free DNS
76.76.2.0 · 76.76.10.0
Mullvad DNS
194.242.2.2
DNS.SB
185.222.222.222 · 45.11.45.11
DNS4EU
86.54.11.1 · 86.54.11.201
DNS.WATCH
84.200.69.80 · 84.200.70.40
Privacy
Client subnet (ECS)
Sent a client subnet
- Google Public DNS · /24
- Quad9 · /24
- OpenDNS · /24
- AdGuard DNS · /24
- AliDNS (Alibaba Cloud Public DNS) · /25
- DNSPod Public DNS · /24
Sent no client subnet
Cloudflare 1.1.1.1, CleanBrowsing, Control D Free DNS, DNS.SB, Comodo Secure DNS, Yandex DNS, 114DNS, CIRA Canadian Shield, DNS4EU, SafeDNS, Surfshark DNS, DNS.WATCH
Encrypted only
Resolvers without public plain DNS
Method
How every entry is checked
Documented facts
- Addresses, DoH URLs, DoT hostnames and filtering descriptions come only from the operator's own pages, linked on each entry.
- A script renders each source page in a browser and confirms all 265 facts appear word for word (2026-09-24). The build refuses to run if one is missing.
- Policy statements are quoted, not summarised. We have not audited any operator's practices.
- Where an operator does not describe a variant's filtering, the registry says so instead of guessing.
Measured behaviour
- DNSSEC: SERVFAIL for all three mis-signed names while example.com resolves counts as validating; answers for all three counts as not validating; anything else is inconclusive.
- ECS: the TXT record at o-o.myaddr.l.google.com echoes the subnet the resolver sent. We record only the prefix length.
- NXDOMAIN: a random name under .com must return NXDOMAIN; an address instead would mean the resolver rewrites errors.
- Encrypted: DoH over HTTP/2 (RFC 8484) and DoT on port 853 with certificate validation against the documented hostname.
- 3 rounds per address, majority result, from one vantage point. IPv6 addresses are listed but were not probed.
Not measured: speed, uptime, or how well any filter blocks what it promises. Those depend on where you are and change over time.
Questions
Public DNS resolver questions
Which public DNS resolvers validate DNSSEC?
In our 2026-09-24 measurement, 11 of 20 operators rejected all three deliberately mis-signed test domains on every address that answered: Cloudflare 1.1.1.1, Google Public DNS, Quad9, OpenDNS, AdGuard DNS, CleanBrowsing, Control D Free DNS, Mullvad DNS, DNS.SB, DNS4EU, DNS.WATCH.
Which public DNS resolvers do not validate DNSSEC?
Comodo Secure DNS, Yandex DNS, AliDNS (Alibaba Cloud Public DNS), DNSPod Public DNS, 114DNS, CIRA Canadian Shield, SafeDNS, Surfshark DNS, LibreDNS returned addresses for all three mis-signed test domains, so they did not validate DNSSEC in our test.
Which resolvers send part of my IP address to other DNS servers?
EDNS Client Subnet (ECS) passes a truncated client subnet to authoritative servers so they can pick a nearby answer. We saw it reach Google's authoritative servers from Google Public DNS, Quad9, OpenDNS, AdGuard DNS, AliDNS (Alibaba Cloud Public DNS), DNSPod Public DNS. The others sent none on the addresses we probed. A resolver can send ECS to some authoritative servers and not others.
Which DNS resolver does my proxy use?
That depends on where hostnames are resolved. With an HTTP proxy, or a client set to socks5h://, the proxy side resolves them. Clients such as curl and Python requests set to socks5:// resolve the name on your device first and send only the IP address. A DNS leak test shows which resolvers actually received your queries.
Are the addresses on this page official?
Every address, DoH URL and DoT hostname comes from the operator's own documentation. A script renders each source page and checks all 265 facts word for word before the registry is built.
Proxies and DNS
Check which resolver your traffic really uses
Research library
Network registries & open data
Find the reference behind a network decision. Browse the records, follow their sources and download the available datasets.