DNS is the phone book of the internet: it turns the names you type into the IP addresses your device actually connects to. Your provider runs a resolver for you by default, but public DNS servers from Cloudflare, Google, Quad9 and others are often faster, more private and can block malware or adult content. This page compares them and explains the record types behind every domain.
Public DNS servers compared
All of these are free and work with any device. Filtering means the resolver refuses to answer for known-bad domains. Logging describes what the operator keeps about your lookups. DoH and DoT are the encrypted variants your browser or phone can use so that nobody on the network can read your queries.
| Provider | IPv4 | IPv6 | Filtering | Logging | Encrypted (DoH / DoT) |
|---|---|---|---|---|---|
| Cloudflare | 1.1.1.1 1.0.0.1 | 2606:4700:4700::1111 2606:4700:4700::1001 | None (1.1.1.2 blocks malware, 1.1.1.3 malware + adult) | Minimal, deleted within 24 hours, independently audited | cloudflare-dns.com/dns-query 1dot1dot1dot1.cloudflare-dns.com |
| 8.8.8.8 8.8.4.4 | 2001:4860:4860::8888 2001:4860:4860::8844 | None | Temporary logs, identifying data deleted within 48 hours | dns.google/dns-query dns.google | |
| Quad9 | 9.9.9.9 149.112.112.112 | 2620:fe::fe 2620:fe::9 | Malware and phishing | No IP addresses stored; Swiss non-profit | dns.quad9.net/dns-query dns.quad9.net |
| OpenDNS | 208.67.222.222 208.67.220.220 | 2620:119:35::35 2620:119:53::53 | Optional; FamilyShield (208.67.222.123) blocks adult | Logs kept, dashboard with account | doh.opendns.com/dns-query |
| AdGuard DNS | 94.140.14.14 94.140.15.15 | 2a10:50c0::ad1:ff 2a10:50c0::ad2:ff | Ads and trackers; Family variant adds adult | Anonymised, 24-hour retention | dns.adguard-dns.com/dns-query dns.adguard-dns.com |
| NextDNS | Assigned per account (45.90.28.x / 45.90.30.x) | Assigned per account | Fully configurable blocklists | Optional, controlled by you | dns.nextdns.io/<id> |
How to change your DNS server
You can change DNS on one device or on the router so that every device inherits it. On the router, log in to the admin page (see the router login IPs), find the WAN, Internet or DHCP settings, replace the automatic DNS entries with the primary and secondary addresses above, save and reboot. On Windows, open Network settings, edit the adapter’s IP settings and set DNS to manual. On macOS it is under Wi-Fi details › DNS. iPhone and Android expose it per network under the Wi-Fi settings, and both support encrypted DNS in the system settings.
DNS record types explained
A domain is a set of records held at its authoritative nameservers. These are the ones you will meet when setting up a website or email.
| Record | Purpose | Example value |
|---|---|---|
| A | Maps a name to an IPv4 address | 203.0.113.42 |
| AAAA | Maps a name to an IPv6 address | 2001:db8::42 |
| CNAME | Alias of another name; cannot coexist with other records at the same name | www → example.com |
| MX | Mail servers for the domain, with priority | 10 mail.example.com |
| TXT | Free text; used for SPF, DKIM, DMARC and domain verification | v=spf1 include:_spf.google.com ~all |
| NS | Nameservers authoritative for the zone | ns1.example-dns.com |
| SOA | Zone metadata: primary server, admin contact, serial, refresh timers | ns1.example.com hostmaster.example.com 2026090601 … |
| SRV | Location of a service by protocol and port | _sip._tcp 10 60 5060 sip.example.com |
| CAA | Which certificate authorities may issue for the domain | 0 issue "letsencrypt.org" |
| PTR | Reverse lookup: IP to name | 42.113.0.203.in-addr.arpa → host.example.com |
How DNS propagation works
Every DNS answer carries a time-to-live, the TTL, which tells resolvers how long they may cache it. When you change a record, resolvers that already hold the old answer keep serving it until the TTL runs out, so some visitors see the new value immediately and others see the old one for minutes or hours. Lowering the TTL a day before a planned change shortens the window. There is no way to force every resolver on the internet to refresh at once, but flushing your own device’s cache lets you check the new record straight away.
Encrypted DNS: DoH and DoT
Classic DNS travels in plain text, so anyone on the path, from coffee-shop Wi-Fi to your provider, can read and alter it. DNS over HTTPS (DoH) wraps queries in ordinary HTTPS traffic on port 443; DNS over TLS (DoT) uses a dedicated encrypted channel on port 853. Chrome, Firefox, Edge, Android and iOS all support one or both. The table above lists each provider’s endpoints.