What DNS Actually Does (and Why It Matters)
Every time you visit a website, your device first asks a DNS resolver to translate the domain name into an IP address. Your ISP assigns one automatically — usually its own — and it sees every site you look up. Choosing a different resolver can mean:
- Faster lookups — big providers run globally distributed anycast networks, often quicker than your ISP's.
- More privacy — resolvers like Cloudflare pledge not to sell or profile your query history.
- Malware blocking — resolvers like Quad9 refuse to resolve known malicious domains for every device on your network.
This is a five-minute, free change. It pairs well with the privacy layers in our VPN comparison.
Cloudflare 1.1.1.1 — Fastest and Privacy-Focused
Cloudflare operates the largest DNS network on earth, and its 1.1.1.1 resolver is consistently at or near the top of independent latency measurements (check current rankings at dnsperf.com). The privacy pitch is unusually strong: Cloudflare contracts with an independent auditor to ensure query logs are discarded within 24 hours and never sold.
- IPv4: 1.1.1.1 and 1.0.0.1
- IPv6: 2606:4700:4700::1111 and 2606:4700:4700::1001
- Malware blocking variant: 1.1.1.2 / 1.0.0.2
Support for encrypted DNS (DoH and DoT) hides your queries even from local network snoops. If you want one default answer, this is it.
Google Public DNS — Reliable and Boring (in a Good Way)
Google's 8.8.8.8 has been the default "tech person" DNS for 15 years because it simply never goes down. The anycast network is massive, lookup times are excellent worldwide, and uptime has been effectively flawless since launch.
- IPv4: 8.8.8.8 and 8.8.4.4
- IPv6: 2001:4860:4860::8888 and 2001:4860:4860::8844
The honest caveat: Google's business model is data, and its privacy policy for the resolver is weaker than Cloudflare's — queries are logged, with IP addresses truncated after a day and full logs kept temporarily for security. If you are comfortable inside Google's ecosystem anyway, it is a rock-solid choice; if your goal is minimizing Google's visibility, pick Cloudflare or Quad9.
Quad9 — Best Built-in Malware Protection
Quad9 (9.9.9.9) is a Swiss nonprofit foundation with one mission: refuse to resolve domains that distribute malware or run phishing campaigns. It draws on threat intelligence from more than a dozen security vendors and blocks billions of malicious lookups daily.
- IPv4 (with filtering): 9.9.9.9 and 149.112.112.112
- Unfiltered variant: 9.9.9.10 and 149.112.112.10
This makes Quad9 the best choice for whole-home protection — set it on your router once and every device, including visitors' phones and smart TVs, gains a safety net. Privacy is strong: Swiss jurisdiction, nonprofit governance, and a policy of not logging personal data.
OpenDNS (Cisco) — Best for Parental Controls
OpenDNS, owned by Cisco, offers FamilyShield (208.67.222.123 / 208.67.220.123), which blocks adult content and malware at the resolver level. For parents who want network-wide filtering that a child cannot bypass by clearing browser settings, DNS-level blocking is the simplest tool available.
The free tier's filtering is fixed; granular per-category control requires Cisco's paid umbrella products. Note that determined teenagers with a phone and a data plan can switch resolvers — pair DNS filtering with device-level screen-time tools for real coverage.
How to Change Your DNS (Windows, macOS, Router)
Windows 11: Settings → Network & internet → your connection → DNS server assignment → Edit → Manual → turn on IPv4 → enter the addresses above.
macOS: System Settings → Network → your connection → Details → DNS → add the addresses with the + button.
Router (protects every device): log in to your router's admin page (usually 192.168.1.1 or 192.168.0.1), find DHCP or WAN/DNS settings, and replace the ISP-provided DNS servers. This is the highest-leverage option — done once, it covers phones, consoles, and TVs automatically.
Verify it worked: visit 1.1.1.1/help or dnsleaktest.com in a browser — the resolver shown should match your choice. Flush your system DNS cache afterward if sites misbehave: ipconfig /flushdns on Windows.
