DNS Reviews
A guide to choosing a DNS resolver: how public resolvers compare with your ISP's default, what DNSSEC and DNS-over-HTTPS actually protect, and how to check the difference yourself.
Introduction
A guide to choosing a DNS resolver: how public resolvers compare with your ISP's default, what DNSSEC and DNS-over-HTTPS actually protect, and how to check the difference yourself.
Overview
dig or a similar tool against a few candidate resolvers rather than trusting an advertised number. Security (DNSSEC validation, malware filtering) and privacy (query-log retention, encrypted DNS) matter as much as speed. After switching, run our DNS leak test to confirm your queries really go to the new resolver.Key Features
Speed & Latency
Large Anycast resolvers like Cloudflare (1.1.1.1) and Google (8.8.8.8) usually answer in a few tens of milliseconds or less from most locations, while ISP resolvers are often slower and less consistent. Faster DNS makes connections start sooner, which you'll notice in browsing and some online games. It doesn't change your download speed. Resolver performance varies by location and network, so test from your own connection.
Security Checks
DNSSEC lets a validating resolver detect forged DNS answers, which blocks cache-poisoning attacks that redirect you to fake sites. The major public resolvers validate DNSSEC automatically, and several offer an alternative address that also blocks known malicious domains (Quad9 does this by default; Cloudflare's 1.1.1.2 is its malware-blocking variant). If your DNS is leaking to your ISP while you're on a VPN, the usual fix is to set DNS explicitly in your router or VPN client, not rely on the ISP-assigned servers.
Privacy Standards
Log-retention policies differ between resolvers. Cloudflare, for example, publicly commits to deleting 1.1.1.1 query logs within 25 hours and has had that policy independently audited. Read each resolver's privacy policy before switching, and turn on encrypted DNS (DoH or DoT) so people on your local network can't read your lookups.
System & Network Performance
Anycast routing spreads a resolver's traffic across many locations worldwide, which keeps lookups fast and makes the service resilient to outages and large DDoS attacks. Configuring both a primary and a secondary resolver address protects you if one route fails.
Pricing & Value Analysis
Public DNS resolvers are free to use. Authoritative DNS hosting for domain owners is often free at low volume, with paid tiers based on query volume and advanced traffic-management features.
What Good Options Offer
- •Faster, more consistent lookups than many ISP resolvers.
- •Easy to configure on routers and operating systems.
- •Optional filtering of known phishing and malware domains.
Common Trade-offs
- •Retention policies differ, and some resolvers keep logs longer.
- •Content filtering can occasionally block legitimate sites.
Who Should Use It
Worth doing for network admins who want faster, filtered DNS across an office network, and for anyone at home who wants more consistent lookups or encrypted DNS. Check your public IP and ISP first so you know which default resolver you're replacing.
Alternatives to Consider
ISP-assigned default DNS resolvers
Alternative 1
Local recursive resolvers (like a Pi-hole setup)
Alternative 2
Private DNS configurations on local networks
Alternative 3
Frequently Asked Questions
How do I change my DNS settings?
You can update your DNS settings in your operating system network preferences, or in your home router settings to apply it to all devices.
What is DNS-over-HTTPS?
DoH encrypts your DNS queries inside HTTPS, so your ISP and others on the network can't read your DNS lookups. They can still see the IP addresses you connect to, and usually the site name in the TLS handshake.
Will changing my DNS speed up my downloads?
No. It can shorten the time it takes to start connecting to a site, but download speed depends on your internet plan and the server you're downloading from.
Bottom Line
Switching from your ISP's default resolver to a well-run public one is one of the simplest free upgrades you can make. Choose one that validates DNSSEC, supports DoH or DoT, publishes a short log-retention policy, and performs well from your location. Then confirm the switch with a DNS leak test.