DNS resolver registry · measured 2026-09-24

Public DNS-over-TLS (DoT) resolver hostnames

DNS-over-TLS (RFC 7858) sends DNS inside a TLS connection on port 853. Android's Private DNS setting takes one of these hostnames. Operators document 37 DoT hostnames; 36 completed a TLS handshake with a valid certificate for that name and answered a query on 2026-09-24.
All resolvers Dataset

Hostnames

Documented DoT hostnames

On Android, open Settings, then Network, Private DNS, and enter the hostname exactly as shown.
ResolverVariantHostname (port 853)Result
Cloudflare 1.1.1.11.1.1.1one.one.one.oneAnswered
Google Public DNSGoogle Public DNSdns.googleAnswered
Quad9Quad9 (recommended)dns.quad9.netAnswered
Quad9Quad9 secured with ECSdns11.quad9.netAnswered
Quad9Quad9 unsecureddns10.quad9.netAnswered
AdGuard DNSAdGuard DNS defaultdns.adguard-dns.comAnswered
AdGuard DNSAdGuard DNS family protectionfamily.adguard-dns.comAnswered
AdGuard DNSAdGuard DNS non-filteringunfiltered.adguard-dns.comAnswered
CleanBrowsingCleanBrowsing Security Filtersecurity-filter-dns.cleanbrowsing.orgAnswered
CleanBrowsingCleanBrowsing Adult Filteradult-filter-dns.cleanbrowsing.orgAnswered
CleanBrowsingCleanBrowsing Family Filterfamily-filter-dns.cleanbrowsing.orgAnswered
Control D Free DNSUnfilteredp0.freedns.controld.comAnswered
Control D Free DNSMalwarep1.freedns.controld.comAnswered
Control D Free DNSAds & Trackingp2.freedns.controld.comAnswered
Control D Free DNSSocialp3.freedns.controld.comAnswered
Control D Free DNSFamily Friendlyfamily.freedns.controld.comNo answer
Control D Free DNSUncensoreduncensored.freedns.controld.comAnswered
Mullvad DNSMullvad dnsdns.mullvad.netAnswered
Mullvad DNSMullvad adblockadblock.dns.mullvad.netAnswered
Mullvad DNSMullvad basebase.dns.mullvad.netAnswered
Mullvad DNSMullvad extendedextended.dns.mullvad.netAnswered
Mullvad DNSMullvad familyfamily.dns.mullvad.netAnswered
Mullvad DNSMullvad allall.dns.mullvad.netAnswered
Yandex DNSYandex DNS Basiccommon.dot.dns.yandex.netAnswered
Yandex DNSYandex DNS Safesafe.dot.dns.yandex.netAnswered
Yandex DNSYandex DNS Familyfamily.dot.dns.yandex.netAnswered
AliDNS (Alibaba Cloud Public DNS)AliDNSdns.alidns.comAnswered
DNSPod Public DNSDNSPod Public DNSdot.pubAnswered
CIRA Canadian ShieldCanadian Shield Privateprivate.canadianshield.cira.caAnswered
CIRA Canadian ShieldCanadian Shield Protectedprotected.canadianshield.cira.caAnswered
CIRA Canadian ShieldCanadian Shield Familyfamily.canadianshield.cira.caAnswered
DNS4EUProtectiveprotective.joindns4.euAnswered
DNS4EUProtective with child protectionchild.joindns4.euAnswered
DNS4EUProtective with ad blockingnoads.joindns4.euAnswered
DNS4EUProtective with child protection and ad blockingchild-noads.joindns4.euAnswered
DNS4EUUnfilteredunfiltered.joindns4.euAnswered
LibreDNSLibreDNSdot.libredns.grAnswered

Measured 2026-09-24 from one vantage point, three rounds per address, majority result. Anycast resolvers can behave differently from other networks. How we test

Questions

Common questions

What should I enter for Android Private DNS?

A DoT hostname, not an IP address or URL. For example Cloudflare documents one.one.one.one, Google dns.google and Quad9 dns.quad9.net.

What is the difference between DoT and DoH?

Both encrypt DNS. DoT uses its own port, 853, which a network can easily recognise and block. DoH travels over HTTPS on port 443 alongside normal web traffic.

More lists

Other ways to compare

DNSSEC-validating resolversDNS-over-HTTPS (DoH) endpointsClient subnet (ECS) behaviourFamily and malware filtering

Research library

Network registries & open data

Find the reference behind a network decision. Browse the records, follow their sources and download the available datasets.

Explore research