← Blog · May 23, 2026 · dns, performance
Public DNS Resolvers: 1.1.1.1 vs 8.8.8.8 vs 9.9.9.9
If you just want an answer — use 1.1.1.1 (Cloudflare) for raw speed,9.9.9.9 (Quad9) if you want malware-domain filtering, and 8.8.8.8 (Google) when those two are blocked on a hotel network. All three are free, anycast, DNSSEC-validating, and support DoH/DoT.
The numbers
DNSPerf has been benchmarking public resolvers since 2017. Long-running 2025 medians from their global probes:
| Resolver | Primary IPv4 | Secondary | Median global latency | Filtering |
|---|---|---|---|---|
| Cloudflare | 1.1.1.1 | 1.0.0.1 | ~11 ms | None (default) — 1.1.1.2 blocks malware, 1.1.1.3 blocks malware + adult |
8.8.8.8 | 8.8.4.4 | ~18 ms | None | |
| Quad9 | 9.9.9.9 | 149.112.112.112 | ~22 ms | Blocks domains on threat-intel feeds (~3M malicious hosts) |
| OpenDNS (Cisco) | 208.67.222.222 | 208.67.220.220 | ~24 ms | Optional category filtering via account |
| AdGuard DNS | 94.140.14.14 | 94.140.15.15 | ~27 ms | Blocks ads + trackers + (optional) adult content |
Latency varies wildly by location — Cloudflare wins almost everywhere in North America and Europe, but in some parts of Asia Quad9 or Google edge ahead because of where their POPs land.
Privacy policies — actually read them once
- Cloudflare — logs anonymized queries for 25 hours, audited annually by KPMG, never sells or shares with third parties for advertising.
- Google — logs queries permanently in aggregated form, retains full query+IP for 24-48 hours. Privacy policy is the same as the rest of Google, which is a yellow flag for some.
- Quad9 — Swiss non-profit, does not log client IPs at all. The strongest privacy story of the four.
- AdGuard DNS — Cyprus-based, anonymized stats only, no IP logging.
DoH and DoT — encrypt your queries
Plain DNS (port 53) is unencrypted. Your ISP, hotel WiFi, and anyone on the path can read every domain you visit. All four resolvers above support encrypted DNS:
- DoH (DNS over HTTPS) — port 443, looks like normal web traffic.
https://cloudflare-dns.com/dns-query - DoT (DNS over TLS) — port 853, dedicated.
tls://1.1.1.1 - DNSCrypt — older, niche, still works.
Firefox and Chrome both support DoH natively. iOS 14+ and macOS 11+ support both DoH and DoT via configuration profiles. Android 9+ does DoT as "Private DNS."
The decision tree
- Want the fastest resolver and don't care about filtering —
1.1.1.1. - Want automatic malware-domain blocking with no setup —
9.9.9.9. - Want family-safe filtering (block adult content) —
1.1.1.3. - Want to block ads at the DNS layer — AdGuard DNS or run your own Pi-hole.
- Want maximum privacy with zero IP logging — Quad9.
- On a network that blocks the others —
8.8.8.8is allowed almost everywhere.
Test before you commit
Latency varies by your physical location and ISP route. Measure from your own network with dig @1.1.1.1 example.com or use a benchmarking tool like DNS Benchmark or namebench. A 30 ms difference in DNS lookup is invisible for most browsing — only worth caring about if you make thousands of lookups per minute (build servers, CI runners, web crawlers).
One more thing — your ISP's resolver might already be fine
ISPs in major markets now run anycast DNS with sub-10ms latency to subscribers. The reason to switch is rarely speed — it's privacy, filtering, or escaping ISP-level DNS hijacking (where typos redirect to ad pages). If your ISP doesn't do those, you're probably fine staying put.