Browse tools

DNS Speed Benchmark

Which DNS server answers fastest from your connection? Time 32 public resolvers from your own browser, then compare encrypted DNS, DNSSEC, malware and family filtering, and who keeps logs.

Run the benchmark

Your browser looks up popular websites (which every resolver already has saved) and brand-new random names (which make each resolver go and ask our domain's nameservers) through each service in turn, in a different order every round.

Ready. Close other downloads and video for the most accurate result.

Results

Median time for one lookup. Cached: a popular site the resolver already knows. Uncached: a name nobody has asked for, so the resolver has to fetch it. Lower is better.

32 services

  • Cloudflare 1.1.1.1
    DoHDoTDNSSECNo filteringIPs deleted in 25 hoursUnited States
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    Cloudflare, Inc. (United States)
    Logging
    Your IP address is never written to disk; truncated IPs in debug logs are deleted within 25 hours, and only anonymous totals are kept. Audited yearly. Privacy policy
    Your location
    Not sent: the website's DNS never learns your network (EDNS Client Subnet)
    IPv4
    1.1.1.1, 1.0.0.1
    IPv6
    2606:4700:4700::1111, 2606:4700:4700::1001
    DNS over HTTPS
    https://cloudflare-dns.com/dns-query
    DNS over TLS
    one.one.one.one
  • Cloudflare Malware blocking (1.1.1.2)
    DoHDoTDNSSECBlocks malwareIPs deleted in 25 hoursUnited States
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    Cloudflare, Inc. (United States)
    Logging
    Same privacy terms as 1.1.1.1. Privacy policy
    Your location
    Not sent: the website's DNS never learns your network (EDNS Client Subnet)
    IPv4
    1.1.1.2, 1.0.0.2
    IPv6
    2606:4700:4700::1112, 2606:4700:4700::1002
    DNS over HTTPS
    https://security.cloudflare-dns.com/dns-query
    DNS over TLS
    security.cloudflare-dns.com
  • Cloudflare Malware and adult blocking (1.1.1.3)
    DoHDoTDNSSECBlocks malwareBlocks adult sitesIPs deleted in 25 hoursUnited States
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    Cloudflare, Inc. (United States)
    Logging
    Same privacy terms as 1.1.1.1. Privacy policy
    Your location
    Not sent: the website's DNS never learns your network (EDNS Client Subnet)
    IPv4
    1.1.1.3, 1.0.0.3
    IPv6
    2606:4700:4700::1113, 2606:4700:4700::1003
    DNS over HTTPS
    https://family.cloudflare-dns.com/dns-query
    DNS over TLS
    family.cloudflare-dns.com
  • Google Public DNS 8.8.8.8
    DoHDoTDNSSECNo filteringIPs kept 24 to 48 hoursUnited States
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    Google LLC (United States)
    Logging
    Temporary logs with your full IP address are deleted within 24 to 48 hours; permanent logs keep only city or region. Privacy policy
    Your location
    Sent: part of your IP address is passed on to help pick a nearby server (EDNS Client Subnet)
    IPv4
    8.8.8.8, 8.8.4.4
    IPv6
    2001:4860:4860::8888, 2001:4860:4860::8844
    DNS over HTTPS
    https://dns.google/dns-query
    DNS over TLS
    dns.google
  • Quad9 Malware blocking (9.9.9.9)
    DoHDoTDNSSECBlocks malwareNo IP loggingSwitzerland
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    Quad9 Foundation (Switzerland)
    Logging
    Doesn't record IP addresses; keeps only anonymous counts. A Swiss non-profit, covered by Swiss and EU data protection law. Privacy policy
    Your location
    Not sent: the website's DNS never learns your network (EDNS Client Subnet)
    IPv4
    9.9.9.9, 149.112.112.112
    IPv6
    2620:fe::fe, 2620:fe::9
    DNS over HTTPS
    https://dns.quad9.net/dns-query
    DNS over TLS
    dns.quad9.net
  • Quad9 No blocking (9.9.9.10)
    DoHDoTDNSSECNo filteringNo IP loggingSwitzerland
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    Quad9 Foundation (Switzerland)
    Logging
    Same privacy terms as 9.9.9.9. Privacy policy
    Your location
    Not sent: the website's DNS never learns your network (EDNS Client Subnet)
    IPv4
    9.9.9.10, 149.112.112.10
    IPv6
    2620:fe::10, 2620:fe::fe:10
    DNS over HTTPS
    https://dns10.quad9.net/dns-query
    DNS over TLS
    dns10.quad9.net
    Note
    Has checked DNSSEC since June 2026, like every Quad9 address.
  • OpenDNS (Cisco) Home
    DoHDoTDNSSECBlocks malwareNo published retentionUnited States
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    Cisco Systems, Inc. (United States)
    Logging
    Only Cisco's general privacy statement applies; it doesn't say how long DNS logs are kept. Privacy policy
    Your location
    Sent only in some cases (EDNS Client Subnet)
    IPv4
    208.67.222.222, 208.67.220.220
    IPv6
    2620:119:35::35, 2620:119:53::53
    DNS over HTTPS
    https://doh.opendns.com/dns-query
    DNS over TLS
    dns.opendns.com
    Note
    Blocks phishing sites by default. DNS over TLS works but isn't officially documented. Withdrawn from France, Portugal and Belgium after court orders.
  • OpenDNS (Cisco) FamilyShield
    DoHDoTDNSSECBlocks malwareBlocks adult sitesNo published retentionUnited States
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    Cisco Systems, Inc. (United States)
    Logging
    Same privacy terms as OpenDNS Home. Also blocks proxy and anonymiser sites. Privacy policy
    Your location
    Sent only in some cases (EDNS Client Subnet)
    IPv4
    208.67.222.123, 208.67.220.123
    IPv6
    2620:119:35::123, 2620:119:53::123
    DNS over HTTPS
    https://doh.familyshield.opendns.com/dns-query
    DNS over TLS
    familyshield.opendns.com
  • AdGuard DNS Default (ads and malware)
    DoHDoTDoQDNSSECBlocks malwareBlocks adsNo query logsCyprus
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    AdGuard Software Ltd (Cyprus)
    Logging
    No personal data is processed for public DNS; only an anonymous 24-hour domain list and totals are kept. Data stored in Germany. Privacy policy
    Your location
    Sends a stand-in network in your area, not your own (EDNS Client Subnet)
    IPv4
    94.140.14.14, 94.140.15.15
    IPv6
    2a10:50c0::ad1:ff, 2a10:50c0::ad2:ff
    DNS over HTTPS
    https://dns.adguard-dns.com/dns-query
    DNS over TLS
    dns.adguard-dns.com
    DNS over QUIC
    quic://dns.adguard-dns.com
  • AdGuard DNS Family protection
    DoHDoTDoQDNSSECBlocks malwareBlocks adsBlocks adult sitesNo query logsCyprus
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    AdGuard Software Ltd (Cyprus)
    Logging
    Same privacy terms as AdGuard DNS Default. Also turns on safe search. Privacy policy
    Your location
    Sends a stand-in network in your area, not your own (EDNS Client Subnet)
    IPv4
    94.140.14.15, 94.140.15.16
    IPv6
    2a10:50c0::bad1:ff, 2a10:50c0::bad2:ff
    DNS over HTTPS
    https://family.adguard-dns.com/dns-query
    DNS over TLS
    family.adguard-dns.com
    DNS over QUIC
    quic://family.adguard-dns.com
  • AdGuard DNS No filtering
    DoHDoTDoQDNSSECNo filteringNo query logsCyprus
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    AdGuard Software Ltd (Cyprus)
    Logging
    Same privacy terms as AdGuard DNS Default. Privacy policy
    Your location
    Sends a stand-in network in your area, not your own (EDNS Client Subnet)
    IPv4
    94.140.14.140, 94.140.14.141
    IPv6
    2a10:50c0::1:ff, 2a10:50c0::2:ff
    DNS over HTTPS
    https://unfiltered.adguard-dns.com/dns-query
    DNS over TLS
    unfiltered.adguard-dns.com
    DNS over QUIC
    quic://unfiltered.adguard-dns.com
  • CleanBrowsing Security filter
    DoHDoTNo DNSSEC checkBlocks malwareNo IP loggingUnited States
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    CleanBrowsing, Inc. (United States)
    Logging
    No IP addresses or personal data stored for free users; anonymised totals may be kept. Privacy policy
    Your location
    Not documented (EDNS Client Subnet)
    IPv4
    185.228.168.9, 185.228.169.9
    IPv6
    2a0d:2a00:1::2, 2a0d:2a00:2::2
    DNS over HTTPS
    https://doh.cleanbrowsing.org/doh/security-filter/
    DNS over TLS
    security-filter-dns.cleanbrowsing.org
  • CleanBrowsing Family filter
    DoHDoTNo DNSSEC checkBlocks malwareBlocks adult sitesFamily filterNo IP loggingUnited States
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    CleanBrowsing, Inc. (United States)
    Logging
    Same privacy terms as the Security filter. Also blocks proxies and VPN sites, and forces safe search and YouTube restricted mode. Privacy policy
    Your location
    Not documented (EDNS Client Subnet)
    IPv4
    185.228.168.168, 185.228.169.168
    IPv6
    2a0d:2a00:1::, 2a0d:2a00:2::
    DNS over HTTPS
    https://doh.cleanbrowsing.org/doh/family-filter/
    DNS over TLS
    family-filter-dns.cleanbrowsing.org
  • NextDNS Without an account
    DoHDoTDNSSECNo filteringNo logs unless you askUnited States
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    NextDNS Inc. (United States)
    Logging
    Logs are off unless you create a free account and turn them on. Privacy policy
    Your location
    Not sent: the website's DNS never learns your network (EDNS Client Subnet)
    IPv4
    45.90.28.0, 45.90.30.0
    IPv6
    2a07:a8c0::, 2a07:a8c1::
    DNS over HTTPS
    https://dns.nextdns.io/dns-query
    DNS over TLS
    dns.nextdns.io
    Note
    With a free account you choose your own blocklists.
  • Control D Free, no filtering
    DoHDoTDoQDNSSECNo filteringNo query logsCanada
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    Control D, Inc. (sister company of Windscribe) (Canada)
    Logging
    The free resolvers keep no query logs, timestamps or browsing history. Privacy policy
    Your location
    Not documented (EDNS Client Subnet)
    IPv4
    76.76.2.0, 76.76.10.0
    IPv6
    2606:1a40::, 2606:1a40:1::
    DNS over HTTPS
    https://freedns.controld.com/p0
    DNS over TLS
    p0.freedns.controld.com
    DNS over QUIC
    quic://p0.freedns.controld.com
  • Control D Free, malware blocking
    DoHDoTDoQDNSSECBlocks malwareNo query logsCanada
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    Control D, Inc. (sister company of Windscribe) (Canada)
    Logging
    The free resolvers keep no query logs, timestamps or browsing history. Privacy policy
    Your location
    Not documented (EDNS Client Subnet)
    IPv4
    76.76.2.1, 76.76.10.1
    IPv6
    2606:1a40::1, 2606:1a40:1::1
    DNS over HTTPS
    https://freedns.controld.com/p1
    DNS over TLS
    p1.freedns.controld.com
    DNS over QUIC
    quic://p1.freedns.controld.com
  • Control D Free, family
    DoHDoTDoQDNSSECBlocks malwareBlocks adsBlocks adult sitesNo query logsCanada
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    Control D, Inc. (sister company of Windscribe) (Canada)
    Logging
    The free resolvers keep no query logs, timestamps or browsing history. Privacy policy
    Your location
    Not documented (EDNS Client Subnet)
    IPv4
    76.76.2.4, 76.76.10.4
    IPv6
    2606:1a40::4, 2606:1a40:1::4
    DNS over HTTPS
    https://freedns.controld.com/family
    DNS over TLS
    family.freedns.controld.com
    DNS over QUIC
    quic://family.freedns.controld.com
  • Mullvad DNS No filtering
    DoHDoTEncrypted onlyDNSSECNo filteringNo logsSweden
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    Mullvad VPN AB (Sweden)
    Logging
    Doesn't log DNS queries. Privacy policy
    Your location
    Not sent: the website's DNS never learns your network (EDNS Client Subnet)
    IPv4
    194.242.2.2
    IPv6
    2a07:e340::2
    DNS over HTTPS
    https://dns.mullvad.net/dns-query
    DNS over TLS
    dns.mullvad.net
    Note
    Only answers encrypted DNS (DoH or DoT). The IP addresses are for bootstrapping, not plain DNS.
  • DNS4EU Protective
    DoHDoTDNSSECBlocks malwarePseudonymised logs, 6 monthsCzech Republic (EU)
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    Whalebone s.r.o., for the EU-funded DNS4EU project (Czech Republic (EU))
    Logging
    Your IP address is held only in memory. Query logs are kept up to 6 months for threat research with the IP replaced by a daily-changing pseudonym, and shared in anonymised form with project partners. Privacy policy
    Your location
    Not documented (EDNS Client Subnet)
    IPv4
    86.54.11.1, 86.54.11.201
    IPv6
    2a13:1001::86:54:11:1, 2a13:1001::86:54:11:201
    DNS over HTTPS
    https://protective.joindns4.eu/dns-query
    DNS over TLS
    protective.joindns4.eu
    Note
    For individuals only; not for commercial use.
  • DNS4EU Unfiltered
    DoHDoTDNSSECNo filteringPseudonymised logs, 6 monthsCzech Republic (EU)
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    Whalebone s.r.o., for the EU-funded DNS4EU project (Czech Republic (EU))
    Logging
    Same terms as DNS4EU Protective. Privacy policy
    Your location
    Not documented (EDNS Client Subnet)
    IPv4
    86.54.11.100, 86.54.11.200
    IPv6
    2a13:1001::86:54:11:100, 2a13:1001::86:54:11:200
    DNS over HTTPS
    https://unfiltered.joindns4.eu/dns-query
    DNS over TLS
    unfiltered.joindns4.eu
    Note
    For individuals only; not for commercial use. Blocks required by court orders still apply.
  • DNS.SB No filtering
    DoHDoTDNSSECNo filteringNo logsGermany
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    xTom GmbH (Germany)
    Logging
    Says it doesn't log queries or IP addresses. Privacy policy
    Your location
    Not sent: the website's DNS never learns your network (EDNS Client Subnet)
    IPv4
    185.222.222.222, 45.11.45.11
    IPv6
    2a09::, 2a11::
    DNS over HTTPS
    https://doh.dns.sb/dns-query
    DNS over TLS
    dot.sb
  • Comodo Secure DNS Malware blocking
    DNSSEC variesBlocks malwareNo published policyUnited States
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    Comodo Security Solutions, Inc. (United States)
    Logging
    We couldn't find a privacy policy for the free resolver. Privacy policy
    Your location
    Not documented (EDNS Client Subnet)
    IPv4
    8.26.56.26, 8.20.247.20
    Note
    No encrypted DNS on the free service. Slow from the UK in our tests.
  • UltraDNS Public No filtering
    DNSSECNo filteringNo published policyUnited States
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    Vercara, part of DigiCert (United States)
    Logging
    No privacy policy specific to the resolver; its old Vercara page no longer loads. Privacy policy
    Your location
    Not documented (EDNS Client Subnet)
    IPv4
    64.6.64.6, 64.6.65.6
    IPv6
    2620:74:1b::1:1, 2620:74:1c::2:2
    Note
    The former Verisign Public DNS (same addresses). Still answers, but no longer has a maintained web page. No encrypted DNS.
  • DNS.Watch No filtering
    DNSSECNo filteringNo logsGermany
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    DNS.Watch (operator not named) (Germany)
    Logging
    Says it doesn't log queries. Privacy policy
    Your location
    Not sent: the website's DNS never learns your network (EDNS Client Subnet)
    IPv4
    84.200.69.80, 84.200.70.40
    IPv6
    2001:1608:10:25::1c04:b12f, 2001:1608:10:25::9249:d69b
    Note
    No encrypted DNS (its own site says DoH isn't working). Many of our test queries went unanswered in October 2026, and its newest notices date from 2019.
  • Hurricane Electric ordns.he.net
    DoHDoTDNSSEC variesNo filteringNo published policyUnited States
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    Hurricane Electric LLC (United States)
    Logging
    No privacy policy published for the resolver. Privacy policy
    Your location
    Not documented (EDNS Client Subnet)
    IPv4
    74.82.42.42
    IPv6
    2001:470:20::2
    DNS over HTTPS
    https://ordns.he.net/dns-query
    DNS over TLS
    ordns.he.net
    Note
    Validated DNSSEC over DoH from a UK home connection, but not over plain DNS from our server or the same connection. Its web page is a single line.
  • CIRA Canadian Shield Protected
    DoHDoTDNSSECBlocks malwareIPs kept 24 hoursCanada
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    CIRA (Canada)
    Logging
    Query data with your IP address is kept up to 24 hours, then only as totals. All servers and data stay in Canada. Run by a not-for-profit. Privacy policy
    Your location
    Not sent: the website's DNS never learns your network (EDNS Client Subnet)
    IPv4
    149.112.121.20, 149.112.122.20
    IPv6
    2620:10a:80bb::20, 2620:10a:80bc::20
    DNS over HTTPS
    https://protected.canadianshield.cira.ca/dns-query
    DNS over TLS
    protected.canadianshield.cira.ca
    Note
    Servers are in Canada, so it's slow from the UK.
  • Wikimedia DNS No filtering
    DoHDoTEncrypted onlyDNSSECNo filteringNo logsUnited States
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    Wikimedia Foundation (United States)
    Logging
    Says it doesn't currently log anything. Run by the non-profit behind Wikipedia; described as a small-scale beta. Privacy policy
    Your location
    Not sent: the website's DNS never learns your network (EDNS Client Subnet)
    IPv4
    185.71.138.138
    IPv6
    2001:67c:930::1
    DNS over HTTPS
    https://wikimedia-dns.org/dns-query
    DNS over TLS
    wikimedia-dns.org
    Note
    Only answers encrypted DNS (DoH or DoT).
  • DNSForge Ad and malware blocking
    DoHDoTDoQDNSSECBlocks malwareBlocks adsNo logsGermany
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    adminForge (volunteer team) (Germany)
    Logging
    Query logging is switched off. Privacy policy
    Your location
    Not sent: the website's DNS never learns your network (EDNS Client Subnet)
    IPv4
    176.9.93.198, 176.9.1.117
    IPv6
    2a01:4f8:c013:29d::122, 2a01:4f8:c010:8c35::175
    DNS over HTTPS
    https://dnsforge.de/dns-query
    DNS over TLS
    dnsforge.de
    DNS over QUIC
    quic://dnsforge.de
    Note
    Blocks ads, trackers and malware by default; its site lists other addresses with no filtering or stricter filtering.
  • RethinkDNS No filtering
    DoHEncrypted onlyDNSSECNo filteringNo logsNot stated
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    RethinkDNS (open-source project; no company named) (Not stated)
    Logging
    Says its resolvers don't log requests or collect IP addresses. Privacy policy
    Your location
    Not documented (EDNS Client Subnet)
    IPv4
    None (encrypted DNS only)
    DNS over HTTPS
    https://sky.rethinkdns.com/dns-query
    Note
    DNS over HTTPS only. Free blocklists can be added in its configurator.
  • UncensoredDNS Anycast
    DoHDoTDoQEncrypted onlyDNSSECNo filteringNo published policyDenmark
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    Thomas Steen Rasmussen (an individual) (Denmark)
    Logging
    Run by one person in Denmark as an uncensored alternative; we couldn't find a logging policy. Privacy policy
    Your location
    Not sent: the website's DNS never learns your network (EDNS Client Subnet)
    IPv4
    91.239.100.100
    IPv6
    2001:67c:28a4::
    DNS over HTTPS
    https://anycast.uncensoreddns.org/dns-query
    DNS over TLS
    anycast.uncensoreddns.org
    DNS over QUIC
    quic://anycast.uncensoreddns.org
    Note
    Only answers encrypted DNS (DoH, DoT or DoQ); plain DNS was switched off in 2022.
  • Digitale Gesellschaft No filtering
    DoHDoTDoQEncrypted onlyDNSSECNo filteringNo logsSwitzerland
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    Digitale Gesellschaft (Switzerland)
    Logging
    A Swiss digital rights non-profit running its own hardware in Switzerland; keeps no logs. Privacy policy
    Your location
    Not sent: the website's DNS never learns your network (EDNS Client Subnet)
    IPv4
    185.95.218.42, 185.95.218.43
    IPv6
    2a05:fc84::42, 2a05:fc84::43
    DNS over HTTPS
    https://dns.digitale-gesellschaft.ch/dns-query
    DNS over TLS
    dns.digitale-gesellschaft.ch
    DNS over QUIC
    quic://dns.digitale-gesellschaft.ch
    Note
    Only answers encrypted DNS (DoH or DoT).
  • AliDNS (Alibaba) No filtering
    DoHDoTNo DNSSEC checkNo filteringNo published policyChina
    Cached-
    Uncached-
    Answered-

    Addresses and privacy
    Run by
    Alibaba Cloud (China)
    Logging
    We couldn't find a privacy policy. Subject to Chinese law, which can require data to be handed over. Privacy policy
    Your location
    Sent: part of your IP address is passed on to help pick a nearby server (EDNS Client Subnet)
    IPv4
    223.5.5.5, 223.6.6.6
    IPv6
    2400:3200::1, 2400:3200:baba::1
    DNS over HTTPS
    https://dns.alidns.com/dns-query
    DNS over TLS
    dns.alidns.com
    Note
    Included for comparison. Timed through its JSON interface, because its standard DNS over HTTPS address doesn't allow websites to read answers.

15 services allow any website to query them, so every answer is checked. 14 more don't (or, like Quad9, only sometimes), so in Chrome and Edge they're timed without reading the answer ("timing only"); other browsers skip them, apart from Quad9. Services with no DNS over HTTPS address are only measured from our server.

Set up your chosen DNS

Pick a service to see its addresses, a ready-made Windows command and an Apple profile, then follow the steps for your device below.

Windows 11
  1. Open Settings, then Network & internet, then Wi-Fi or Ethernet, then your connection (for Wi-Fi, choose "Hardware properties").
  2. Next to "DNS server assignment", choose Edit, then Manual, and turn on IPv4.
  3. Enter the first IPv4 address as "Preferred DNS" and the second as "Alternate DNS".
  4. Under "DNS over HTTPS", choose "On (automatic template)". Windows already knows the encrypted addresses for Cloudflare, Google and Quad9. For other services choose "On (manual template)" and paste the DNS over HTTPS address, or run the command shown above in Terminal (Admin) first.
  5. Turn off "Fallback to plaintext" if you never want unencrypted lookups. Repeat for IPv6 if your connection has it, then Save.
Mac
  1. Open System Settings, then Network, then your connection (Wi-Fi or Ethernet), then Details.
  2. Choose DNS, press + and add the IPv4 (and IPv6) addresses. Remove the old ones, then OK.
  3. For encrypted DNS, download the Apple profile above, open System Settings, then General, then Device Management (or search for "Profiles"), and install it. macOS can't switch on encrypted DNS without a profile or an app.
iPhone and iPad
  1. Encrypted DNS: download the Apple profile above in Safari, then open Settings, tap "Profile Downloaded" near the top, and Install. Remove it any time from Settings, General, VPN & Device Management.
  2. Many services also have their own app or profile: Cloudflare (1.1.1.1 app), NextDNS, AdGuard, Control D and Quad9 among them.
  3. Plain DNS for one Wi-Fi network only: Settings, Wi-Fi, tap the (i) next to the network, Configure DNS, Manual, then add the addresses. This doesn't apply on mobile data.
Android
  1. Open Settings, then Network & internet (on Samsung: Connections, then More connection settings), then Private DNS.
  2. Choose "Private DNS provider hostname" and enter the service's DNS over TLS name, for example one.one.one.one, dns.google or dns.quad9.net. Save.
  3. This encrypts every lookup on Wi-Fi and mobile data. Android doesn't take IP addresses here, only the hostname.
Router (whole home) and UniFi
  • Log in to your router and look for DNS under Internet, WAN, or LAN/DHCP settings. Enter the two IPv4 addresses (and IPv6 if offered). Every device that gets its settings from the router then uses them.
  • Many UK broadband routers (BT, Sky, Virgin Media, TalkTalk) don't let you change DNS. Change it on each device instead, or add your own router.
  • UniFi: in the Network app, open Settings, then Internet, choose the WAN, turn off automatic DNS and enter the addresses. Recent versions also offer encrypted DNS (DNS over HTTPS) in the security settings, using a list of known providers or a custom DNS stamp. The exact menu name varies between versions.
  • Plain DNS from a router isn't encrypted on its way to the resolver, so your internet provider can still read it. A router with DNS over TLS or HTTPS support, or per-device encrypted DNS, fixes that.
Web browsers (Chrome, Edge, Firefox)
  • Chrome: Settings, Privacy and security, Security, turn on "Use secure DNS", choose "With" and pick a provider or "Add custom DNS service provider", then paste the DNS over HTTPS address.
  • Edge: Settings, Privacy, search, and services, Security, "Use secure DNS to specify how to look up the network address for websites", then "Choose a service provider" and pick or paste one.
  • Firefox: Settings, Privacy & Security, DNS over HTTPS, choose "Increased" or "Max Protection", then pick a provider or "Custom" and paste the address.
  • A browser setting only covers that browser. Other apps on the device still use the system DNS.

What faster DNS does (and doesn't) do

  • Every new website starts with a DNS lookup. A quicker resolver makes that first step quicker, so you notice it most on the first visit to a site.
  • Your device and browser remember answers for minutes or hours, so repeat visits often skip DNS altogether. A faster resolver won't speed up downloads or video.
  • Uncached times matter more than they look: they're what you get for less popular sites, and for any site after its saved answer expires.
  • A few milliseconds either way is noise. Pick from the services near the top on filtering and privacy, not on a 2 ms lead.

Your internet provider's DNS

  • Your provider's own resolver is often the fastest, because it's inside their network. This page can't time it, because it has no public encrypted address.
  • It sees every site you look up, may keep logs, and in the UK is used to block sites under court orders.
  • To see which resolver you're really using, run the DNS Leak Checker. To check a domain's own records, use the DNS Checker.
How is the test done?

Your browser sends real DNS queries over HTTPS (DNS over HTTPS, RFC 8484) straight to each service and times them. The first request to each service is kept apart, because it also includes connecting and setting up encryption. Each round then asks for one popular name and one random never-seen name under osir.co.uk, in a shuffled order, and the page reports the median and the 90th percentile.

Why do the encrypted (browser) times differ from the server times?

They measure different paths. The browser figures run from your connection, over HTTPS. The server figures are plain DNS on port 53 from our server in a UK data centre, which sits close to many resolvers' London sites. Use the browser figures to choose; the server ones fill in services your browser can't test.

What does "timing only" mean?

Some services don't allow websites to read their answers (they don't send CORS headers). Chrome and Edge still let a page time the request, so we do, but we can't confirm the answer was correct. Firefox and Safari don't allow it, so those services show only the server figure there.

What do DNSSEC, DoH, DoT and DoQ mean?

DNSSEC checking means the resolver rejects answers that have been tampered with, for domains that sign their records. DoH (DNS over HTTPS), DoT (DNS over TLS) and DoQ (DNS over QUIC) encrypt the lookups between your device and the resolver, so your internet provider and anyone on your Wi-Fi can't read or change them.

Does this test see the sites I visit?

No. Your browser only looks up the popular names listed on this page and random test names. Nothing about your own browsing is used, and the DNS services see the lookups come from your IP address, as they would for any query.

Which services were left out?

Services that have shut down (dns0.eu closed in October 2025), ones with no support for years (Freenom World), and ones whose encrypted service we couldn't reach from the UK in October 2026 (Quad101 in Taiwan). Verisign Public DNS lives on as UltraDNS Public, which is in the list. We re-check every few months.

More free tools