The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
There is no universal winner among Cloudflare, Google Public DNS, and Quad9. Choose Cloudflare when you want selectable malware or adult-content filtering, Quad9 when blocking known threat domains is the priority, and Google when you want a widely deployed resolver that generally does not filter content. All three document encrypted DNS through DNS over HTTPS (DoH) and DNS over TLS (DoT). Speed depends on your location, ISP routing, cache state, and current network conditions, so test from the connection where you will use the service.
What does a public DNS resolver do, and why does the choice matter?
Domain Name System (DNS) translates names such as example.com into IP addresses that devices can connect to. Your broadband provider usually supplies a resolver automatically, but you can configure a public resolver on a device, browser, operating system, or router instead.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The resolver you select can affect whether known malicious domains are refused, whether adult-content categories are filtered, how DNS traffic is protected on the network path, and how quickly a name resolves from your particular location. It does not replace a firewall, endpoint security software, parental controls, or a virtual private network. DNS filtering works at the domain-lookup stage; it cannot inspect every URL, file, or application connection.
What are the addresses for Cloudflare, Google, and Quad9?
Use the pair that matches the policy you want. Where a platform accepts primary and secondary DNS servers, enter both addresses from the same service and policy tier.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| Provider and policy | IPv4 addresses | IPv6 addresses or variants |
|---|---|---|
| Cloudflare standard resolver | 1.1.1.1 and 1.0.0.1 | Not stated in the supplied provider specifications |
| Cloudflare malware blocking | 1.1.1.2 and 1.0.0.2 | Not stated in the supplied provider specifications |
| Cloudflare malware plus adult-content blocking | 1.1.1.3 and 1.0.0.3 | Not stated in the supplied provider specifications |
| Google Public DNS | 8.8.8.8 and 8.8.4.4 | 2001:4860:4860::8888 and 2001:4860:4860::8844 |
| Quad9 secure, threat-blocking service | 9.9.9.9 and 149.112.112.112 | Not stated in the supplied provider specifications |
| Quad9 service without threat blocking | 9.9.9.10 and 149.112.112.10 | Not stated in the supplied provider specifications |
| Quad9 ECS variants | 9.9.9.11 and 9.9.9.12 | Not stated in the supplied provider specifications |
“ECS” means the Quad9 variants are identified as EDNS Client Subnet services in Quad9’s published lineup. Select them only if you specifically need that variant and understand the policy described in Quad9’s current documentation; do not assume every numbered address has the same blocking behavior.
Which provider blocks malware or adult content?
Cloudflare gives you three published policy levels
Cloudflare’s standard addresses, 1.1.1.1 and 1.0.0.1, are the general-purpose option. Its 1.1.1.2 and 1.0.0.2 pair is published for malware blocking. The 1.1.1.3 and 1.0.0.3 pair combines malware blocking with adult-content blocking. Choose the pair that matches your household or organization rather than mixing addresses from different tiers.
Filtering is a DNS response policy, not a guarantee that every unsafe page, image, app, or newly registered domain will be blocked. A device can also bypass a router’s DNS setting by using its own encrypted resolver, so managed networks may need to control DNS at the endpoint or gateway as well.
Quad9 makes threat blocking the defining feature of its main service
Quad9 describes 9.9.9.9 and 149.112.112.112 as its secure, threat-blocking service. That is the relevant choice when preventing resolution of domains associated with malware, phishing, or other reported threats matters more than content-category filtering.
Quad9 also publishes 9.9.9.10 and 149.112.112.10 without threat blocking. The existence of that pair lets you use Quad9’s resolver without its blocking policy, while 9.9.9.11 and 9.9.9.12 are listed as ECS variants. Verify the current service description before deploying a less common variant.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Google generally avoids content filtering
Google Public DNS uses 8.8.8.8 and 8.8.4.4 for IPv4, plus 2001:4860:4860::8888 and 2001:4860:4860::8844 for IPv6. Google generally does not filter content. Its documentation notes that limited security or legal cases can result in different handling, so “no filtering” should not be read as an absolute promise that every domain always resolves.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →How do DoH and DoT protect DNS queries?
Traditional DNS is readable on the network path. Someone able to observe that path, such as an access provider or an operator of a hostile Wi-Fi network, may be able to see the domain names your device requests even when the website itself uses HTTPS.
DNS over TLS (DoT) wraps DNS in TLS and normally uses port 853. DNS over HTTPS (DoH) carries DNS queries and replies inside HTTPS, normally on port 443. Cloudflare, Google Public DNS, and Quad9 all document DoH and DoT support, but each uses its own documented endpoint hostname and configuration syntax.
Encryption protects the connection between your device and the resolver from ordinary on-path inspection; it does not make the resolver unable to see the queries it processes. Read the provider’s current privacy documentation before deciding whether its retention and operational policies fit your needs. The availability of DoH or DoT alone does not establish that the three providers retain data in equivalent ways.
Which public DNS is fastest?
Official provider documentation does not establish a universal speed winner. DNS latency changes with your physical location, the path your ISP takes to each resolver, whether the requested name is already cached, congestion, and the conditions of the network at the time of testing.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
A resolver that is fastest at home may be slower from a phone hotspot or an office connection. Test from each important network instead of relying on a worldwide ranking or a result measured on someone else’s ISP.
A simple local comparison
- Connect to the network where you will use the resolver and pause downloads, video calls, and other heavy traffic.
- On macOS or Linux, run a DNS query tool such as
digagainst the same domain and each server, for exampledig @1.1.1.1 example.com,dig @8.8.8.8 example.com, anddig @9.9.9.9 example.com. - On Windows, use
nslookup example.com 1.1.1.1, then repeat with8.8.8.8and9.9.9.9. - Repeat each query several times with several ordinary domains. Record the reported query time, noting that the first lookup may be a cache miss and later lookups may be cached.
- Retest at another time of day. Choose a resolver that is consistently responsive and reliable on your connection, not the one that wins a single run by a few milliseconds.
These commands test plain DNS reachability. If you intend to use DoH or DoT, test the encrypted configuration in the browser, operating system, or router where it will actually run; a fast plaintext result does not prove that an encrypted endpoint is configured correctly.
How should I choose between Cloudflare, Google, and Quad9?
| Your priority | Most suitable starting point | Reason and qualification |
|---|---|---|
| Optional malware or adult-content filtering | Cloudflare filtered pair | Choose the malware-only or malware-plus-adult pair according to the policy you need. |
| Threat-domain blocking as the main requirement | Quad9 9.9.9.9 / 149.112.112.112 | Its main secure service is explicitly threat-blocking. |
| General-purpose resolution with little content filtering | Google Public DNS | Google generally avoids content filtering, with limited security or legal exceptions. |
| Encrypted DNS | Any of the three | All document DoH and DoT; use the provider’s exact endpoint and verify it locally. |
| Lowest latency | Whichever tests best locally | No provider is documented as universally fastest. |
Do not select a primary server with strict blocking and a secondary server with no blocking if you expect the policy to be consistent. Depending on the operating system or router, the secondary may answer when the primary is slow or unreachable, allowing a domain you intended to block to resolve.
How do I configure one of these resolvers?
The exact labels differ by operating system, browser, and router firmware, but the workflow is consistent: choose a policy pair, enter the addresses, decide whether to enable DoH or DoT, save, and verify.
- Choose the scope. For one computer or phone, change DNS in that device’s network settings. For every device on a home network, use the router’s LAN or DHCP DNS settings. Some browsers provide a separate “secure DNS” or DoH control that can override the operating system.
- Enter both addresses. Use the two IPv4 addresses for your selected service. On an IPv6-capable network, add the provider’s documented IPv6 addresses where the interface supports them. Keep both entries in the same filtering tier.
- Select encrypted transport if available. Pick DoH or DoT in the device, browser, or router’s secure-DNS menu and enter the exact hostname published by the provider. DoT normally requires port 853; DoH normally uses HTTPS on port 443.
- Save and reconnect. Apply the settings, disconnect and reconnect to Wi-Fi or restart the network interface if the device continues using its old resolver.
- Verify the result. Run a lookup against a known domain and inspect the resolver shown by your system or browser. For a filtered service, use the provider’s documented diagnostic or test domain rather than assuming that a successful ordinary lookup proves filtering is active.
A router that supports custom DNS is useful for whole-home deployment, but encrypted DNS support is not universal. If the router accepts only numeric DNS addresses, configure DoH or DoT on compatible endpoints instead.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
What can go wrong after changing DNS?
Names no longer resolve
Check for a mistyped address, an invalid IPv6 entry, or a firewall that blocks outbound DNS. Temporarily restore the previous DNS setting to confirm whether the change caused the failure, then re-enter the pair carefully and test one address at a time.
Filtering seems inconsistent
Confirm that both primary and secondary addresses belong to the same policy tier. Also check whether a browser, security application, VPN, or operating-system feature is using its own DoH service instead of the router’s DNS.
DoH or DoT will not connect
Recheck the provider’s current endpoint hostname and transport setting. DoT requires a path that permits TLS on port 853; DoH needs HTTPS access on port 443. A network that blocks one transport may still permit the other, but switching transports does not change the resolver’s filtering policy.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWebsites are slower or behave differently
Flush the device’s DNS cache, reconnect to the network, and repeat local timing tests. A resolver can return a different content-delivery-network address because of routing and cache decisions, so compare real browsing on your connection rather than assuming that one lookup time explains every site’s performance.
Does changing DNS improve privacy or security by itself?
Changing from an ISP resolver to a public resolver can change who receives your DNS queries and which blocking policy is applied. Enabling DoH or DoT prevents ordinary observers on the network path from reading those queries in transit, but the selected resolver still processes them. DNS encryption also does not hide the IP connections your device makes after resolution.
For security, a threat-blocking resolver can stop a device from resolving domains already identified in its threat intelligence. It cannot guarantee protection against newly created domains, compromised legitimate domains, malicious IP addresses reached directly, or malware that ignores system DNS. Use DNS filtering as one layer alongside updates, endpoint protection, account security, and sensible network controls.
What is the practical verdict?
Start with the policy rather than the brand name. Use Cloudflare’s filtered addresses for a selectable malware or adult-content policy, Quad9’s secure pair when threat-domain blocking is the deciding feature, and Google Public DNS when you prefer a broadly deployed resolver that generally avoids content filtering. Whichever you select, configure matching primary and secondary addresses, use the documented encrypted endpoint when supported, and measure performance from the networks you actually use.
Frequently Asked Questions
Can I use different DNS providers as primary and secondary servers?
You can, but the result may be unpredictable because many systems select the secondary when the primary is slow or unavailable. Mixing a blocking resolver with a non-blocking one can therefore bypass the policy you intended; use a matched pair when consistent filtering matters.
Will public DNS block advertisements in apps and on every website?
Not necessarily. The services described here publish malware, threat, or adult-content policies, not a universal advertisement-blocking promise, and DNS cannot remove ads delivered from the same domain as ordinary content.
Is DoH better than DoT for every network?
Neither is universally superior. DoT uses TLS on port 853, while DoH uses HTTPS on port 443; a network may handle one more reliably than the other, so choose the transport your device and network support correctly.
Can a VPN override the DNS server I set on my router?
Yes. VPN clients commonly install their own DNS handling, and some browsers or security tools use their own encrypted resolver. If results do not match the router policy, inspect those applications before changing the router again.
How do I return to my internet provider’s DNS?
Set the network interface or router DNS option back to automatic or DHCP, remove manually entered IPv4 and IPv6 addresses, save, and reconnect. Then verify that the resolver shown by your device has changed before troubleshooting website access.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
