A public recursive name server (also called public DNS resolver) is a name server service that networked computers may use to query the Domain Name System (DNS), the decentralized Internet naming system, in place of (or in addition to) name servers operated by the local Internet service provider (ISP) to which the devices are connected. Reasons for using these services include:
- speed, compared to using ISP DNS services
- filtering (security, ad-blocking, porn-blocking, etc.)
- reporting
- avoiding censorship
- redundancy (smart caching)
- access to unofficial alternative top level domains not found in the official DNS root zone
- temporary unavailability of the ISP's name server
Public DNS resolver operators often cite increased privacy as an advantage of their services; critics of public DNS services have cited the possibility of mass data collection targeted at the public resolvers as a potential risk of using these services. Most services now support secure DNS lookup transport services such as DNS over TLS (DoT), DNS over HTTPS (DoH) and DNS over QUIC (DoQ).
Public DNS resolvers are operated either by commercial companies, offering their service for free use to the public, or by private enthusiasts to help spread new technologies and support non-profit communities.
Notable public DNS service operators
Provider | Privacy policy | DNS over UDP/TCP (Do53) | DNSSEC | DNS over TLS (DoT) | DNS over HTTPS (DoH) | DNS over QUIC (DoQ) | EDNS Padding | DNSCrypt | Hostname | IPv4 addresses | IPv6 addresses | Filters | Remarks |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
AdGuard | Yes6 | Yes | Yes7 | Yes | Yes8 | Yes9 | No | Yes10 | dns.adguard-dns.com11 | 94.140.14.1494.140.15.15 | 2a10:50c0::ad1:ff2a10:50c0::ad2:ff | Default: ads and trackers12 | |
family.adguard-dns.com | 94.140.14.1594.140.15.16 | 2a10:50c0::bad1:ff2a10:50c0::bad2:ff | Family: ads, trackers, and adult content13 | ||||||||||
unfiltered.adguard-dns.com | 94.140.14.14094.140.14.141 | 2a10:50c0::1:ff2a10:50c0::2:ff | None14 | ||||||||||
Alibaba | ? | Yes | No | Yes | Yes | No | No | No | dns.alidns.com | 223.5.5.5223.6.6.6 | 2400:3200::12400:3200:baba::1 | ? | Chinese regulations |
Cloudflare | Yes15 | Yes | Yes16 | Yes17 | Yes18 | No19 | Yes | No | one.one.one.one201dot1dot1dot1.cloudflare-dns.com | 1.1.1.11.0.0.1 | 2606:4700:4700::11112606:4700:4700::1001 | None | |
security.cloudflare-dns.com | 1.1.1.21.0.0.2 | 2606:4700:4700::11122606:4700:4700::1002 | Malware, Phishing | ||||||||||
family.cloudflare-dns.com | 1.1.1.31.0.0.3 | 2606:4700:4700::11132606:4700:4700::1003 | Malware, Phishing,Adult content | ||||||||||
dns64.cloudflare-dns.com | — | 2606:4700:4700::642606:4700:4700::6400 | None | Intended to be IPv6-only.21 See NAT64 and DNS64. | |||||||||
DNS4EU | ? | Yes | Yes | Yes | Yes | No | Yes | No | ? | ? | ? | ? | EU |
Yes22 | Yes | Yes | Yes | Yes23 | No | Yes | No | dns.google24 | 8.8.8.88.8.4.4 | 2001:4860:4860::88882001:4860:4860::8844 | None | ||
dns64.dns.google | — | 2001:4860:4860::64642001:4860:4860::64 | None | Intended for networks with NAT64 gateway.25 | |||||||||
Gcore | Yes26 | Yes | Yes | No | No | No | No | No | — | 95.85.95.852.56.220.2 | 2a03:90c0:999d::12a03:90c0:9992::1 | None | |
Mullvad | Only for VPN service available27 | No28 | Yes | Yes29 | Yes30 | No | Yes | No | dns.mullvad.net31 | 194.242.2.2 | 2a07:e340::2 | None | Can be used without its VPN service |
adblock.dns.mullvad.net | 194.242.2.3 | 2a07:e340::3 | Ads, and trackers | ||||||||||
base.dns.mullvad.net | 194.242.2.4 | 2a07:e340::4 | Ads, trackers, and malware | ||||||||||
extended.dns.mullvad.net | 194.242.2.5 | 2a07:e340::5 | Ads, trackers, malware, and social media | ||||||||||
all.dns.mullvad.net | 194.242.2.9 | 2a07:e340::9 | Ads, trackers, malware, social media, gambling and adult content | ||||||||||
Vercara (formerly Neustar Security Services) | Yes32 | Yes | Yes | No | No | No | No | No | ? | 64.6.64.664.6.65.6 | 2620:74:1b::1:12620:74:1c::2:2 | None | Verisign transferred its public DNS to Neustar.33 |
156.154.70.1156.154.71.1 | 2610:a1:1018::12610:a1:1019::1 | ||||||||||||
156.154.70.2156.154.71.2 | 2610:a1:1018::22610:a1:1019::2 | Malware, ransomware, spyware, phishing | |||||||||||
156.154.70.3156.154.71.3 | 2610:a1:1018::32610:a1:1019::3 | Low security + gambling, pornography, violence, hate | |||||||||||
156.154.70.4156.154.71.4 | 2610:a1:1018::42610:a1:1019::4 | Medium security + gaming, adult, drugs, alcohol, anonymous proxies | |||||||||||
156.154.70.5156.154.71.5 | 2610:a1:1018::52610:a1:1019::5 | None | Will not redirect non-existent domains to a landing page. | ||||||||||
Cisco Umbrella (OpenDNS) | Yes34 | Yes | Yes35 | Yes | Yes36 | No | Yes | Yes37 | dns.opendns.comdns.umbrella.com38 | 208.67.222.222208.67.220.220 | 2620:119:35::352620:119:53::53 | Basic Security filtering + user defined policies | |
familyshield.opendns.com | 208.67.222.123208.67.220.123 | 2620:119:35::1232620:119:53::123 | FamilyShield: adult content | ||||||||||
sandbox.opendns.com | 208.67.222.2208.67.220.2 | 2620:0:ccc::22620:0:ccd::2 | None | Sandbox addresses that provide no filtering. | |||||||||
Oracle (formerly Dyn) | Yes39 | Yes | Yes | No | No | No | No | No | resolver1.dyndnsinternetguide.comresolver2.dyndnsinternetguide.comrdns.dynect.net | 216.146.35.35216.146.36.36 | — | None | |
Quad9 | Yes4041 | Yes | Yes42 | Yes43 | Yes44 | No | No | Yes45 | dns.quad9.net | 9.9.9.9149.112.112.112 | 2620:fe::92620:fe::fe | Phishing, malware, and exploit kit domains | |
Yes46 | dns11.quad9.net | 9.9.9.11149.112.112.11 | 2620:fe::112620:fe::fe:11 | Phishing, malware, and exploit kit domains | Passes EDNS Client Subnet. | ||||||||
No47 | dns10.quad9.net | 9.9.9.10149.112.112.10 | 2620:fe::102620:fe::fe:10 | None | |||||||||
Wikimedia | Informal48 | No49 | Yes50 | Yes51 | Yes52 | No | No53 | No | wikimedia-dns.org54 | 185.71.138.13855 | 2001:67c:930::156 | None57 | |
Yandex | No58 | Yes | No | Yes | Yes | No | Yes | Yes | common.dot.dns.yandex.net | 77.88.8.877.88.8.1 | 2a02:6b8::feed:0ff2a02:6b8:0:1::feed:0ff | None | |
safe.dot.dns.yandex.net | 77.88.8.8877.88.8.2 | 2a02:6b8::feed:bad2a02:6b8:0:1::feed:bad | Safe: fraudulent / infected / bot sites | ||||||||||
family.dot.dns.yandex.net | 77.88.8.777.88.8.3 | 2a02:6b8::feed:a112a02:6b8:0:1::feed:a11 | Family: fraudulent / infected / bot / adult sites |
External links
References
"How to Change Your Default DNS to Google DNS for Fast Internet Speeds". TechWorm. 2016-08-20. Retrieved 2016-10-22. http://www.techworm.net/2016/08/change-default-dns-google-dns-fast-internet-speeds.html ↩
"A simple way to get around Rogers' DNS re-directing". IT Business. Retrieved 2016-10-22. http://www.itbusiness.ca/news/a-simple-way-to-get-around-rogers-dns-re-directing/12025 ↩
"OpenDNS Adds Centralized Reporting, IP-Layer Enforcement to Umbrella". mspmentor.net. Archived from the original on 2016-10-22. Retrieved 2016-10-22. https://web.archive.org/web/20161022224758/http://mspmentor.net/managed-services/110415/opendns-adds-centralized-reporting-ip-layer-enforcement-umbrella ↩
"Austrian Pirate Bay Blockade Censors Slovak Internet - TorrentFreak". TorrentFreak. 2015-12-03. Retrieved 2016-10-22. https://torrentfreak.com/austrian-pirate-bay-blockade-censors-slovak-internet-accidentally-151203/ ↩
Security; Iana. "DNS devastation: Top websites whacked offline as Dyn dies again". The Register. Retrieved 2016-10-22. https://www.theregister.co.uk/2016/10/21/dns_devastation_as_dyn_dies_under_denialofservice_attack/ ↩
AdGuard DNS Privacy Notice https://adguard.com/en/privacy/dns.html ↩
AdGuard DNS FAQ: What is DNSSEC? https://adguard.com/en/adguard-dns/overview.html ↩
The official release of AdGuard DNS — a new unique approach to privacy-oriented DNS https://adguard.com/en/blog/adguard-dns-announcement.html ↩
AdGuard DNS-over-QUIC https://adguard.com/en/blog/dns-over-quic.html ↩
Adguard DNS now supports DNSCrypt https://adguard.com/en/blog/adguard-dns-now-supports-dnscrypt.html ↩
AdGuard DNS Setup guide https://adguard-dns.io/en/public-dns.html ↩
AdGuard DNS Setup guide https://adguard-dns.io/en/public-dns.html ↩
AdGuard DNS Setup guide https://adguard-dns.io/en/public-dns.html ↩
AdGuard DNS Setup guide https://adguard-dns.io/en/public-dns.html ↩
"Privacy Policy". Cloudflare. Retrieved 2019-01-04. https://www.cloudflare.com/privacypolicy/ ↩
"The Nitty Gritty - Cloudflare Resolver". 24 January 2023. https://developers.cloudflare.com/1.1.1.1/nitty-gritty-details/#dnssec ↩
Cloudflare Inc (2018-03-31). "DNS over TLS - Cloudflare Resolver". Developers.cloudflare.com. Retrieved 2019-01-04. https://developers.cloudflare.com/1.1.1.1/dns-over-tls/ ↩
Cloudflare Inc. "DNS over HTTPS - Cloudflare Resolver". Developers.cloudflare.com. Retrieved 2019-01-04. https://developers.cloudflare.com/1.1.1.1/dns-over-https/ ↩
"DNS over QUIC (DoQ)". Cloudflare Community. 31 August 2022. Retrieved 2022-09-12. https://community.cloudflare.com/t/dns-over-quic-doq/415627 ↩
"Test DNS owner one.one.one.one". 2018-08-21. https://community.cloudflare.com/t/test-dns-owner-one-one-one-one/29970/4 ↩
"Supporting IPv6-only Networks". Archived from the original on 2020-12-09. Retrieved 2019-01-20. https://web.archive.org/web/20201209005501/https://developers.cloudflare.com/1.1.1.1/support-nat64 ↩
Google Public DNS: Your Privacy https://developers.google.com/speed/public-dns/privacy ↩
Google Public DNS: DNS-over-HTTPS https://developers.google.com/speed/public-dns/docs/dns-over-https ↩
"Get Started | Public DNS". https://developers.google.com/speed/public-dns/docs/using ↩
Google Public DNS64 https://developers.google.com/speed/public-dns/docs/dns64 ↩
"Legal Information on Gcore Services". https://gcore.com/legal?tab=privacy_policy ↩
"Privacy policy - Guides". Mullvad VPN. Retrieved 2023-08-27. https://mullvad.net/en/help/privacy-policy/ ↩
"DNS over HTTPS and DNS over TLS - Guides". Mullvad. 2023-08-08. Retrieved 2023-08-23. https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/ ↩
"DNS over HTTPS and DNS over TLS - Guides". Mullvad. 2023-08-08. Retrieved 2023-08-23. https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/ ↩
"DNS over HTTPS and DNS over TLS - Guides". Mullvad. 2023-08-08. Retrieved 2023-08-23. https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/ ↩
"DNS over HTTPS and DNS over TLS - Guides". Mullvad. 2023-08-08. Retrieved 2023-08-23. https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/ ↩
"Privacy Policy | Neustar". home.neustar. https://www.home.neustar/privacy/privacy-policy#data_in_products_services ↩
"Verisign Public DNS Offers DNS Stability And Security – Verisign". www.verisign.com. Archived from the original on 2021-03-31. Retrieved 2020-12-05. https://web.archive.org/web/20210331041511/https://www.verisign.com/en_US/security-services/public-dns/index.xhtml ↩
Cisco Online Privacy Statement https://www.cisco.com/c/en/us/about/legal/privacy-full.html ↩
OpenDNS: DNSSEC General Availability https://support.opendns.com/hc/en-us/articles/360039659971 ↩
OpenDNS: Querying OpenDNS using DoH https://support.opendns.com/hc/en-us/articles/360038463251 ↩
OpenDNS: OpenDNS and DNSCrypt https://support.opendns.com/hc/en-us/articles/227989147 ↩
Cisco Umbrella Enhances Support of DNS Encryption with DNS Over HTTPS https://umbrella.cisco.com/blog/enhancing-support-dns-encryption-with-dns-over-https ↩
"Oracle's Privacy Policy". dyn.com. Retrieved 2018-12-31. https://dyn.com/legal/dyn-privacy-policy/ ↩
Quad9: Compliance and Applicable Law https://quad9.net/privacy/compliance-and-applicable-law/ ↩
Quad9: Data and Privacy Policy https://quad9.net/privacy/policy/ ↩
Quad9 FAQ: Does Quad9 implement DNSSEC? https://www.quad9.net/support/faq/#dnssec ↩
Quad9 FAQ: Does Quad9 support DNS over TLS? https://www.quad9.net/support/faq/#dns_tls ↩
Quad9 FAQ: Does Quad9 support DNS over HTTPS (DoH)? https://www.quad9.net/support/faq/#doh ↩
Quad9 FAQ: Does Quad9 support dnscrypt? https://www.quad9.net/support/faq/#dns_crypt ↩
Quad9 FAQ: Does Quad9 implement DNSSEC? https://www.quad9.net/support/faq/#dnssec ↩
Quad9 FAQ: Is there a service that Quad9 offers that does not have the blocklist or other security? https://www.quad9.net/support/faq/#services ↩
Wikimedia DNS: Privacy Policy https://meta.wikimedia.org/wiki/Wikimedia_DNS#Privacy_policy ↩
Wikimedia DNS: Encrypted DNS" https://wikitech.wikimedia.org/wiki/Wikimedia_DNS#Encrypted_DNS ↩
Wikitech: Wikimedia DNS: DNSSEC https://wikitech.wikimedia.org/wiki/Wikimedia_DNS#DNSSEC ↩
Wikitech: Wikimedia DNS https://wikitech.wikimedia.org/wiki/Wikimedia_DNS ↩
Wikitech: Wikimedia DNS https://wikitech.wikimedia.org/wiki/Wikimedia_DNS ↩
Wikitech: Wikimedia DNS: EDNS.280.29 Padding https://wikitech.wikimedia.org/wiki/Wikimedia_DNS#EDNS.280.29_Padding ↩
Wikimedia DNS: Instructions https://meta.wikimedia.org/wiki/Wikimedia_DNS/Instructions ↩
Wikimedia DNS: Instructions https://meta.wikimedia.org/wiki/Wikimedia_DNS/Instructions ↩
Wikimedia DNS: Instructions https://meta.wikimedia.org/wiki/Wikimedia_DNS/Instructions ↩
Wikimedia DNS https://meta.wikimedia.org/wiki/Wikimedia_DNS ↩
Terms of use of the Yandex.DNS service https://yandex.com/legal/dns_termsofuse/ ↩