Selecting a Public DNS Resolver

Finding the right public DNS resolver involves balancing various trade-offs. Whether you prioritize absolute privacy, malware mitigation, parental oversight, raw speed, or specific legal jurisdictions, this guide helps narrow down 29 global services to find your ideal match.

Below is a comprehensive breakdown, including an interactive selection process and research-based insights.

---

🛠️ The Selection Process

To find your perfect resolver, follow these three stages:

• Step 1: Interactive Filtering $\rightarrow$ Define your requirements.
• Step 2: Live Latency Benchmarking $\rightarrow$ Test real-world speed.
• Step 3: Comprehensive Comparison $\rightarrow$ Review the full dataset.

Step 1: The Interactive Finder

Use these "hard filters" to eliminate services that don't meet your technical or ethical standards.

🛡️ Privacy & Security Priorities

• Maximum Privacy: Seek operators with a privacy-first ethos and minimal to no query logging.
• Malware/Phishing Protection: Ensure a security blocklist is active by default or easily toggled.
• Ad & Tracker Blocking: Implement network-wide filtering to stop telemetry and advertisements.
• Parental Controls: Filter out adult content via dedicated family-safe variants.
• Unaltered DNS: Filtering $\rightarrow$ No filtering; returns records exactly as published.
• Custom Rules: Ability to manage personal blocklists via a user account.

⚡ Performance & Technical Requirements

• Global Speed: Look for large, low-latency anycast networks.
• Operator Type: Choose between Commercial entities or Non-profit/Community/Public-interest organizations.
• Encrypted Transports: Must support one or more of the following:
  • DoH (DNS-over-HTTPS)
  • DoT (DNS-over-TLS)
  • DoQ (DNS-over-QUIC)
  • DNSCrypt
• Additional Specs:
  • DNSSEC: Must perform validation.
  • IPv6: Must provide v6 resolver addresses.
  • Jurisdiction: Filter by the legal home of the operator.
  • EDNS Client Subnet (ECS):
    • Disabled: Better privacy (no IP leakage).
    • Enabled: Better CDN routing (faster content delivery).

---

Step 2: Live Latency Testing

Because DNS speed is highly dependent on your physical location, you should benchmark the DoH round-trip time (RTT) from your own browser.

Note: These tests include TLS and HTTP overhead. Since results can fluctuate, it is recommended to run the benchmark multiple times. Your IP is revealed to the resolver during the query, but no data is sent to third parties.

Sample Benchmark Output:

| Resolver       | Median Latency | Status |
|----------------|----------------|--------|
| Cloudflare     | 12ms           | Best   |
| Google         | 18ms           | Good   |
| Quad9          | 25ms           | Fair   |

Technique based on Silviu Stroe's open-source DNS Speed Test (GPL-3.0).

---

Step 3: Full Comparison Matrix

The following table summarizes the 29 global resolvers across 15 jurisdictions.

---

📚 Research-Backed Decision Notes

When weighing your options, consider these findings from peer-reviewed measurement studies.

🚀 Speed and Latency

While plain DNS is technically the fastest, encrypted versions are highly competitive. The total time for a page load is often negligible regardless of the transport used. $\text{Total Latency} \approx T_{\text{DNS}} + T_{\text{TLS Handshake}} + T_{\text{HTTP Overhead}}$ (Ref: Hounsel et al., WWW 2020; Böttger et al., IMC 2019)

🔒 Security vs. Privacy

Encryption $\neq$ Total Privacy. Encrypted DNS prevents your ISP or a local attacker from snooping or tampering with your queries, but the resolver operator still sees everything.

• Tampering: Encrypted DNS significantly reduces the risk of interception. However, be wary of providers with invalid TLS certificates (found in $\approx 25\%$ of DoT providers in some studies).
• Anonymity: To decouple your identity from your queries, look for Oblivious DoH (ODoH).

🛡️ Validation and Routing

• DNSSEC: This is the only way to prevent forged DNS answers. Top-tier providers like Google, Cloudflare, and Quad9 successfully handled the first root-key (KSK) rollover.
• ECS Trade-off: EDNS Client Subnet improves CDN mapping (speed) by sharing part of your IP, but it reduces privacy. Google and OpenDNS use it; Cloudflare and Quad9 typically do not.

🌐 Modern Transports

• DNS-over-QUIC (DoQ): Currently the fastest encrypted method. It outperforms DoH and DoT in response times, though some handshakes are limited by address-validation.
  • Supported by: Quad9, AdGuard, NextDNS, Control D, Mullvad, UncensoredDNS.
• DNSCrypt: A legacy encrypted option (v2 since 2013). It avoids Certificate Authorities (CAs) by using pre-shared public keys and offers an "Anonymized DNS" mode.
  • Supported by: Quad9, OpenDNS, AdGuard, NextDNS, Control D, Yandex.

⚠️ Final Considerations

1. Jurisdiction: The legal framework of the operator's home country determines what data can be legally compelled.
2. Centralization: A few massive providers handle most of the world's traffic, creating a single point of failure.
3. Traffic Analysis: Even with DoH, sophisticated traffic analysis can often identify the domains you visit.