Public DNS resolver · Comodo

Comodo Secure DNS DNS servers

Comodo Secure DNS answers on 8.26.56.26 and 8.20.247.20. In our 2026-09-24 test it did not validate DNSSEC and sent no client subnet.

Addresses
2
Variants
1
Measured
2026-09-24
Operator
Comodo
Primary IPv4
8.26.56.26
All IPv4
8.26.56.26, 8.20.247.20
All IPv6
none documented
DNS over HTTPS
not documented
DNS over TLS
not documented
Service variants
1 (Comodo Secure DNS)
DNSSEC in our test
Does not validate
Client subnet (ECS)
None sent
Protocols
DNS (53)

Comodo Secure DNS DNS addresses by variant

Set the IPv4 or IPv6 addresses as your DNS servers, or use an encrypted endpoint where one is listed.
Comodo Secure DNS addresses
VariantFiltering (operator description)IPv4IPv6Encrypted
Comodo Secure DNSNot specified by the operator8.26.56.268.20.247.20Not documented

What we observed

Measured 2026-09-24 from one vantage point, three rounds per address, majority result. Anycast resolvers can behave differently from other networks.
DNSSEC validation
Does not validate Returned addresses for dnssec-failed.org, rhybar.cz and badsig.go.dnscheck.tools, which a validating resolver would refuse.
Client subnet (ECS)
No client subnet reached the authoritative server from any address we probed.
Plain DNS and NXDOMAIN
2/2 documented IPv4 addresses answered on port 53. Random non-existent names came back as NXDOMAIN, so errors are not rewritten into ads or search pages.

Which networks carry it

The announcing network comes from RIPEstat routing data for each documented address. The query network is where the resolver sent its own lookups during our probe, which a DNS leak test reports.
Networks
ASNHolderRole
AS23393NUCDN - NuCDN LLCAnnounces the service addresses

Query network not published: the lookup did not return, or the network describes our vantage point rather than the resolver.

Confirm your device is using Comodo Secure DNS

Changing a DNS setting does not guarantee your lookups reach that resolver: a VPN, a browser's own secure DNS or a proxy can send them elsewhere. Our DNS leak test shows which resolvers actually received your queries.
From a terminal
# Which address did the resolver query from?
dig +short whoami.akamai.net @8.26.56.26

# Does it pass your subnet on (ECS)?
dig +short TXT o-o.myaddr.l.google.com @8.26.56.26

# Does it validate DNSSEC? SERVFAIL means yes
dig dnssec-failed.org @8.26.56.26

Behind a proxy

With an HTTP proxy, or a client set to socks5h://, the proxy side resolves hostnames, so your own resolver setting does not apply to that traffic. With socks5:// in curl or Python requests, your device resolves names first. The SOCKS5 vs SOCKS5h guide shows how to check which one you have.

Comodo Secure DNS questions

What are Comodo Secure DNS's DNS server addresses?
Comodo Secure DNS: 8.26.56.26, 8.20.247.20.
Does Comodo Secure DNS validate DNSSEC?
Not in our 2026-09-24 test: it returned addresses for all three deliberately mis-signed domains.
Does Comodo Secure DNS support DNS over HTTPS or DNS over TLS?
The Comodo Secure DNS page we checked documents plain DNS addresses only.
Does Comodo Secure DNS send my IP subnet to other servers (ECS)?
We observed no client subnet on any address we probed.
How can I check that I am using Comodo Secure DNS?
Run a DNS leak test and compare the network it reports. On the command line, dig +short whoami.akamai.net @8.26.56.26 returns the address the resolver used to query Akamai.

Sources

Documentation checked 2026-09-24. Measured 2026-09-24. Registry reviewed 2026-09-24.

  1. [1]https://www.comodo.com/secure-dns/

Addresses and endpoints come from each operator's documentation; behaviour is what we measured from one location on 2026-09-24. Speed, uptime and how well a filter blocks what it promises were not tested.