DNS resolver registry · measured 2026-09-24

Which public DNS resolvers send EDNS Client Subnet?

EDNS Client Subnet (ECS, RFC 7871) lets a resolver pass a truncated form of your address to the authoritative server, so a CDN can answer with a server near you. The trade-off is that the authoritative server learns roughly where you are. We asked Google's o-o.myaddr.l.google.com, which echoes the subnet it received, through every resolver. A resolver can send ECS to some authoritative servers and not others, so this shows what reached Google's.
All resolvers Dataset

Results

6 operators sent a client subnet; 12 sent none

ResolverECS observedDNSSEC
Google Public DNSSends /24 Validates
Quad9Some addresses send /24 Validates
OpenDNSSends /24 Validates
AdGuard DNSSends /24 Validates
AliDNS (Alibaba Cloud Public DNS)Sends /25 Does not validate
DNSPod Public DNSSends /24 Does not validate
Cloudflare 1.1.1.1None sent Validates
CleanBrowsingNone sent Validates
Control D Free DNSNone sent Validates
DNS.SBNone sent Validates
Comodo Secure DNSNone sent Does not validate
Yandex DNSNone sent Does not validate
114DNSNone sent Does not validate
CIRA Canadian ShieldNone sent Does not validate
DNS4EUNone sent Validates
SafeDNSNone sent Does not validate
Surfshark DNSNone sent Does not validate
DNS.WATCHNone sent Validates

Measured 2026-09-24 from one vantage point, three rounds per address, majority result. Anycast resolvers can behave differently from other networks. How we test

Quad9 documents a separate ECS-enabled variant (9.9.9.11), so it appears with some addresses sending a subnet. Mullvad and LibreDNS are encrypted-only and were not part of this plain DNS test.

Questions

Common questions

What does /24 mean for ECS?

The resolver sent the first 24 bits of your IPv4 address, which identifies a block of 256 addresses rather than your exact address.

Which DNS resolvers do not send ECS?

In our 2026-09-24 test: Cloudflare 1.1.1.1, CleanBrowsing, Control D Free DNS, DNS.SB, Comodo Secure DNS, Yandex DNS, 114DNS, CIRA Canadian Shield, DNS4EU, SafeDNS, Surfshark DNS, DNS.WATCH.

More lists

Other ways to compare

DNSSEC-validating resolversDNS-over-HTTPS (DoH) endpointsDNS-over-TLS (DoT) hostnamesFamily and malware filtering

Research library

Network registries & open data

Find the reference behind a network decision. Browse the records, follow their sources and download the available datasets.

Explore research