Secure DNS servers

Classic DNS in the clear Do53 RFC 1035, STD 13

UDP and TCP 53

The default case since 1987. RFC 1035 specifies that DNS runs over UDP and TCP on port 53 and provides for no confidentiality at all. Anyone on the same network, or running it, reads every query.

RFC 9076, the current IETF document on DNS privacy considerations, names the most rewarding tapping point explicitly: “The best place to tap, from an eavesdropper's point of view, is clearly between the stub resolvers and the recursive resolvers, because traffic is not limited by DNS caching.” That is precisely the stretch DoT, DoH and DoQ encrypt.

DNS over TLS DoT RFC 7858

TCP 853

DNS inside a TLS tunnel on a dedicated port. RFC 7858 specifies: “By default, a DNS server that supports DNS over TLS MUST listen for and accept TCP connections on port 853, unless it has mutual agreement with its clients to use a port other than 853 for DNS over TLS.”

The dedicated port is both an advantage and a drawback. Advantage: the operating system can set DoT system-wide for all applications, which is what Android has done for years under “Private DNS”. Drawback: port 853 is visible and easy to block on restrictive networks.

DNS over HTTPS DoH RFC 8484

TCP 443

DNS inside ordinary HTTPS requests. RFC 8484 states it in one line: “Each DNS query-response pair is mapped into an HTTP exchange.”

Because the traffic runs on port 443 it is hard to distinguish from normal web traffic and correspondingly hard to block. The price: DoH is usually configured per application rather than system-wide. A browser with its own DoH uses a different resolver from the rest of the system, which regularly causes confusion in practice.

DNS over QUIC DoQ RFC 9250

UDP 853

The most recent of the three encrypted transports, standardised in May 2022. RFC 9250 describes the benefit as follows: “The encryption provided by QUIC has similar properties to those provided by TLS, while QUIC transport eliminates the head-of-line blocking issues inherent with TCP and provides more efficient packet-loss recovery than UDP.”

In practice that means the same confidentiality as DoT, but faster connection setup and less delay under packet loss. Quad9 answered DoQ queries reliably in our test. UncensoredDNS, dnsforge.de and Freifunk München announce DoQ as well, though at UncensoredDNS a real query went unanswered in our test.

Signatures, not encryption DNSSEC RFC 4033, 4034, 4035

independent of the transport

The most common confusion in this field. DNSSEC encrypts nothing. RFC 4033 says in one sentence what it does: “The Domain Name System Security Extensions (DNSSEC) add data origin authentication and data integrity to the Domain Name System.” And it says just as plainly what it does not do: “These extensions do not provide confidentiality.”

So DNSSEC protects against someone forging the answer. It does not protect against someone reading the question. You only get both once a validating resolver is reached over an encrypted transport.

One side effect is worth knowing: RFC 4033 warns that DNSSEC in its NSEC variant allows enumeration of all names in a zone. For the privacy of zone contents, DNSSEC is therefore no gain.

QNAME minimisation QNAME RFC 9156

resolver behaviour

Without minimisation a recursive resolver asks the root server for the full name, even though the root server only knows who is responsible for the suffix. With minimisation each level learns only as much as it needs in order to refer the query onwards.

Important for accuracy: the valid standard is RFC 9156 from November 2021, Standards Track. The frequently cited RFC 7816 was experimental and is explicitly marked as obsoleted.

EDNS Client Subnet ECS RFC 7871

extension, informational

The resolver passes a truncated part of the client address on to authoritative servers so that a content network can give a geographically close answer. The price is privacy.

It is notable that the RFC itself counsels restraint: “We recommend that the feature be turned off by default in all nameserver software, and that operators only enable it explicitly in those circumstances where it provides a clear benefit for their clients.” RFC 7871 is informational, not Standards Track.

Practical consequence: anyone putting privacy above speed picks an endpoint without ECS. At Quad9 those are 9.9.9.9 and 9.9.9.10, while 9.9.9.11 and 9.9.9.12 deliberately use ECS.

EDNS(0) Padding Padding RFC 7830

extension

Encryption hides the content, not the size. RFC 9076 points out that the size and timing patterns of encrypted messages allow inferences. RFC 7830 defines padding to uniform lengths as a countermeasure. Anyone running a resolver themselves should enable padding.

Quad9 CH

Operator

Quad9, a foundation under Swiss law, Zurich (UID CHE-435.091.407)

Legal form

Non-profit foundation

DNSSEC

Validating. Since 15 June 2026 Quad9 validates on all endpoints according to its own announcement, including the addresses that previously did not validate.

DNS over QUIC

Yes. DNS over QUIC and DNS over HTTP/3 have been live since 31 March 2026. Quad9 states verbatim: “Quad9 has enabled DNS over HTTP/3 (DoH3) and DNS over QUIC (DoQ) across its global resolver network.” DoQ uses the respective service hostname on UDP port 853.

Filtering

Selectable by address. 9.9.9.9 and 9.9.9.11 block domains reported by partners as malware, phishing or botnet infrastructure. 9.9.9.10 and 9.9.9.12 do not. Quad9 does not filter advertising or trackers at all.

Logging

The privacy policy (version 1.1, published 24 June 2026) states verbatim in section 2.1: “Quad9 does not collect or record user IP addresses, nor does it collect or hold any proxy for or representation of user IP addresses, nor does it collect or hold any other unique identifier of individuals in lieu of IP addresses.”

Endpoints

What speaks for it

• A non-profit foundation under Swiss law, not a company with an advertising or data business.
• The privacy policy is explicitly aligned with RFC 8932, the IETF document on privacy policies for DNS operators. That is a self-declaration rather than an audited certification, but it makes the commitments comparable.
• Very large anycast network and a complete protocol range: Do53, DoT, DoH, DoH3 and DoQ.
• Filtered and unfiltered addresses from the same operator under the same privacy policy.

What speaks against it

• Court-ordered copyright blocks apply worldwide. Following the Paris ruling in the Canal+ proceedings, Quad9 blocks the contested domains for all users because the service does not differentiate by region. Quad9 itself writes: “we have to block these sites for all users, in all areas. This amounts to French law being applied globally.”
• These blocks also apply on the unfiltered addresses. At Quad9, “unfiltered” refers to the malware list, not to court orders.
• The commitment not to store client IP addresses is a self-imposed obligation. No independent technical audit confirming this practice is available.

Evidence

• Quad9: Service Addresses and Features
• Quad9: Data Privacy Policy, version 1.1, 24 June 2026
• Quad9 blog: Quad9 Enables DNS Over HTTP/3 and DNS Over QUIC, 31 March 2026
• Quad9: press statement on the Canal+ proceedings in France, 10 December 2024

DNS4EU CZ

Operator

Whalebone, s.r.o., Jezuitská 14/13, 602 00 Brno, Czechia (company ID 05120403)

Legal form

Private company, grown out of an EU co-funded project

DNSSEC

Validating.

DNS over QUIC

Not documented. On the endpoints tested on 6 September 2026 neither the QUIC identifier “doq” nor HTTP/3 was offered.

Filtering

Five profiles, each with its own addresses. According to the operator the child protection profile filters the categories gambling, sexual content, weapons, child abuse, drugs, racism, terrorism and violence. DNS4EU additionally implements legally mandated blocks, and those apply across all profiles.

Logging

Unlike the other services in this list, DNS4EU is not a no-log resolver. The DNS4EU Public Resolvers Policy lists the data collected, including the query sent, the response, the query type and the timestamp. According to the operator the client IP address is anonymised; query data are retained for up to six months.

Endpoints

What speaks for it

• Resolvers located exclusively inside the EU. The policy names 14 recursive resolvers in 14 EU member states.
• Five clearly separated filter profiles with their own addresses, including one profile with no content filter at all.
• Supervision by a named European data protection authority, the Czech Úřad pro ochranu osobních údajů. A named data protection officer is reachable.
• A published Digital Services Act transparency report exists, as does a published list of blocking orders.

What speaks against it

• The name suggests operation by the EU, which is not the case. The EU co-funded project phase ran from 2023 to 2025. The official page describes it in the past tense and says of the present: “Now fully commercialized and operated by Whalebone ... without ongoing EU operational funding.” Choosing DNS4EU today means choosing a free service run by a Czech private company with an EU project heritage, not a resolver operated by the EU.
• Query data are retained for up to six months. That is the longest documented retention period of any service recommended here.
• Legally mandated blocks also apply in the “Unfiltered” profile. On 6 September 2026 rt.com and Sputnik domains, among others, did not resolve there. At DNS4EU, “Unfiltered” refers to the content filters, not to blocking orders.
• The terms of use exclude enterprises and connectivity providers. The service is intended for private individuals, with a limit of 1,000 queries per second per IP address.

Evidence

• DNS4EU: DNS4EU for Public
• DNS4EU: About the project
• DNS4EU: Legal information and compliance
• HaDEA, the EU executive agency for CEF Digital funding

DNS.SB DE

Operator

xTom GmbH, Kreuzstraße 60, 40210 Düsseldorf, Germany (commercial register HRB 86779, Düsseldorf)

Legal form

Private company

DNSSEC

Validating.

DNS over QUIC

Not officially documented.

Filtering

None. The operator states: “No, we do not implement any content filtering or blocking. DNS.SB provides neutral, unfiltered DNS resolution.”

Logging

The privacy policy, effective 17 January 2026, opens with: “TL;DR: We don't collect or store your DNS queries. Period.” In detail it states that neither queried domains nor IP addresses nor timestamps are recorded in connection with queries.

Endpoints

What speaks for it

• A very short, unambiguous privacy policy with a stated effective date.
• The operator has published annual transparency reports on government requests since 2019, including requests from authorities outside Germany.
• A globally distributed network. The operator names 19 locations.
• An operator with a German commercial register entry and a serviceable address, so responsibility is traceable.

What speaks against it

• The widely repeated claim that DNS.SB is run by a company called “Xing Tech” could not be confirmed in any primary source. The operator is xTom GmbH.
• This is a for-profit hosting company, not a non-profit body. The service is funded in part through priced sponsorship tiers.
• The no-log commitment is a self-declaration. There is no independent audit.

Evidence

• DNS.SB: home page with endpoints
• DNS.SB: Privacy Policy, effective 17 January 2026
• DNS.SB: transparency reports since 2019
• xTom GmbH: legal notice

UncensoredDNS DK

Operator

Thomas Steen Rasmussen, Denmark. A private individual, no legal entity.

Legal form

Private individual, operated free of charge

DNSSEC

Validating.

DNS over QUIC

Announced, but unanswered in our test. On 23 October 2025 the operator wrote: “Starting today UncensoredDNS fully supports QUIC based DNS lookups.” The QUIC identifier “doq” is indeed negotiated. A real DoQ query with kdig, however, went unanswered three times on 7 September 2026 from a German connection, while the same query against Quad9 and AdGuard DNS succeeded. This is a point-in-time observation from a single connection, not proof that the service cannot do DoQ. DoT on the same server worked flawlessly.

Filtering

None. The service exists explicitly as a counterpoint to filtering. The operator writes: “I am strongly against using DNS as a tool to filter content on the internet.”

Logging

The FAQ states: “Absolutely nothing is being logged, neither about the users nor the usage of this service. I do keep graphs of the total number of queries, but no personally identifiable information is saved.”

Endpoints

What speaks for it

• The service has run since 2009, making it one of the oldest independent open resolvers in Europe.
• A complete protocol range including DNS over QUIC and DNS over HTTP/3.
• A clear, unambiguous stance against filtering, with no commercial interest behind it.
• Two separate entry points, one anycast and one unicast node, which can be entered as primary and secondary server.

What speaks against it

• The service depends entirely on a single private individual. There is no association, no team and no published succession plan.
• The logging commitment consists of two sentences in a FAQ. There is no formal privacy policy, no audit and no transparency report.
• The anycast network is small. The official table lists three nodes, two of them in Denmark. Outside northern Europe the latency benefit is correspondingly limited.

Evidence

• UncensoredDNS: home page and server list
• UncensoredDNS: FAQ with the logging statement
• UncensoredDNS: Full DoQ and DoH3 support, 23 October 2025

Digitalcourage e. V. DE

Operator

Digitalcourage e. V., Marktstraße 18, 33602 Bielefeld, Germany

Legal form

Registered non-profit association

DNSSEC

A measurement on 6 September 2026 showed DNSSEC validation. The association itself makes no statement about this on the service page, so it is not a guaranteed property.

DNS over QUIC

No.

Filtering

None. The service is explicitly a censorship-free resolver, not an advertising or tracker blocker.

Logging

The official page for dns3.digitalcourage.de states, in German: “kein Logging, nur im Fehlerfall (ohne Client-IP)”, meaning no logging except in the event of an error, and then without the client IP.

Endpoints

What speaks for it

• A non-profit association with a long, publicly traceable record of work on fundamental rights and data protection.
• German server location and German jurisdiction; sponsorship and funding are traceable through a published transparency report.
• Explicitly censorship-free, with no commercial interest in the query data.

What speaks against it

• The address dns.digitalcourage.de, still cited in many places, has been permanently shut down. The association writes, in German, that the server is switched off and that the IP 85.214.20.141 should be removed from existing configurations. Anyone still using that IP has no working resolver. Only dns3.digitalcourage.de is active.
• No DoH. The association states explicitly that the server cannot be set as a DNS server in the browser because that would require DNS over HTTPS, which the service does not support. The service therefore cannot be used in the DoH settings of Firefox or Chrome.
• There is exactly one server. No anycast, no second node, so a single point of failure. Configuring a second, independent resolver as a fallback is advisable.

Evidence

• Digitalcourage: censorship-free DNS server
• Digitalcourage e. V.: legal notice

Digitale Gesellschaft CH

Operator

Digitale Gesellschaft, an association under Articles 60 et seq. of the Swiss Civil Code, with its seat in Basel. Servers in Zurich.

Legal form

Non-profit association

DNSSEC

Validating, explicitly guaranteed by the operator.

DNS over QUIC

Not documented.

Filtering

None. The association states, in German, that no logging takes place and no block lists are used. It reserves the right to temporary blocks in cases of abuse.

Logging

Official statement, in German: no logging takes place, no block lists are used, and DNSSEC is validated.

Endpoints

What speaks for it

• A non-profit association with published statutes and a server configuration disclosed in a public repository.
• Swiss server location and Swiss law, outside EU jurisdiction.
• A clear, concise commitment with no marketing gloss: no logging, no block lists, DNSSEC validation.
• Very low running costs, 1,000 Swiss francs a year according to the FAQ, which makes independent funding plausible.

What speaks against it

• No plaintext DNS on port 53. The association deliberately does not run it. Routers, smart TVs and many IoT devices that only speak classic DNS cannot be served this way.
• The IP addresses given are the addresses of the encrypted endpoints. They belong in a DoT or DoH field, not in an ordinary DNS server field.
• The operator reserves the right to temporarily block individual client IP addresses and individual domain names in cases of abuse. “No block lists” therefore does not mean “unmodified under all circumstances”.

Evidence

• Digitale Gesellschaft: public DNS resolver
• Digitale Gesellschaft: resolver configuration

Artikel10 e. V. DE

Operator

Artikel10 e. V., Hamburg, Germany (register VR 24066, Hamburg local court). Infrastructure hosted at Individual Network Berlin e. V.

Legal form

Registered association

DNSSEC

A measurement on 6 September 2026 showed DNSSEC validation. There is no explicit commitment from the operator.

DNS over QUIC

Not documented.

Filtering

The operator makes no explicit statement. A measurement on 6 September 2026 showed no filtering.

Logging

The service page states, in German, that the server stores no information about individual DNS queries.

Endpoints

What speaks for it

• A registered association with statutes and a register entry, dedicated for years to protecting the privacy of correspondence and also operating Tor infrastructure.
• German location and German jurisdiction.
• A concise, clear logging statement without qualifications in the small print.

What speaks against it

• No plaintext DNS on port 53. The addresses respond only via DoT on port 853 and DoH on port 443. Entering them as ordinary DNS servers yields no resolution at all.
• The association has not communicated publicly since 27 November 2023. The service demonstrably runs, but there is no current communication about its state.
• The service is documented very briefly. There is no formal privacy policy for the resolver, no audit and no transparency report.

Evidence

• Artikel10: DNS resolver
• Artikel10 e. V.: website and legal notice

dnsforge.de DE

Operator

adminForge, run by Stefan Giebel, Cologne, Germany. Servers in Germany.

Legal form

Private project, donation funded

DNSSEC

Validating.

DNS over QUIC

The operator lists DoQ endpoints for all four variants. No independent measurement of these is available.

Filtering

Four graded variants, each with its own addresses, from “Normal” with ad and tracker filtering to “Blank” with no filtering at all. Blocked names are answered with 0.0.0.0 or ::, not with NXDOMAIN.

Logging

The FAQ states, in German, that dnsforge.de logs no DNS queries and operates entirely without logging. The adminForge privacy notice contains a dedicated section on this.

Endpoints

What speaks for it

• Four clearly separated filter levels, including a completely unfiltered one. The choice stays with the user rather than the operator.
• The block lists used are named openly rather than merely asserted.
• Servers exclusively in Germany, operator with a legal notice and a serviceable address.
• Block list counts are published on the home page and updated daily.

What speaks against it

• The service is run neither by an association nor by a company but as a private project. For use in organisations with availability requirements that is a serious consideration.
• The service is funded by donations. The donation page shows the monthly targets, so funding is visible but not institutionally secured.
• The no-log commitment is a self-declaration without an independent audit.

Evidence

• dnsforge.de: endpoints, variants and FAQ
• adminForge: privacy notice
• adminForge: legal notice

Freifunk München DE

Operator

Freie Netze München e. V., Parkstraße 28, 82131 Gauting, Germany (register VR 206402, Munich local court). Servers in Munich and Vienna.

Legal form

Registered association

DNSSEC

Validating.

DNS over QUIC

The operator names the hostname doq.ffmuc.net. DoH over HTTP/3 is offered.

Filtering

None. The service privacy policy states: “The resolver operates as a general-purpose recursive DNS service and does not perform content filtering or censorship by default.”

Logging

The privacy policy states: “The service does not retain identifiable per-user DNS query logs.” Temporary per-IP counters for rate limiting are explicitly mentioned.

Endpoints

What speaks for it

• A registered association from the Freifunk movement with long-standing practice in running open networks.
• Servers exclusively within the EU, specifically in Munich and Vienna.
• The operator names the exception itself: temporary per-IP counters for rate limiting.
• Both plaintext DNS and encrypted protocols are available.

What speaks against it

• The charitable tax status is unclear. The setup page describes the association as a non-profit, while its own wiki FAQ states that it is not recognised as charitable because the legal requirements are not met, and cannot issue donation receipts. No exemption notice could be found. The suffix “e. V.” alone does not imply charitable status.
• Two locations, both in German-speaking Europe. Outside central Europe the service is correspondingly slower.

Evidence

• FFMUC: DNS setup
• FFMUC: DNS Privacy Policy
• Freie Netze München e. V.: legal notice

RESTENA LU

Operator

Fondation Restena, 2 place de l'Université, L-4365 Esch-sur-Alzette, Luxembourg

Legal form

Foundation, the national research and education network of Luxembourg

DNSSEC

Validating.

DNS over QUIC

Not documented.

Filtering

No filtering is documented for the public resolver. The service page cites “Guaranteed neutrality, as the resolver does not deliberately modify the collected information before transmitting it”. The separately offered DNS firewall is, according to the operator, available only to connected institutions.

Logging

There is no dedicated logging policy for the resolver. The service page says the information collected for resolution is “limited to the minimum necessary for the technical functioning of the service”. That is less specific than for the other services in this list.

Endpoints

What speaks for it

• The operator is a foundation with a public mandate, the national research and education network of Luxembourg. That is a degree of institutional stability that private projects cannot offer.
• Location and jurisdiction Luxembourg, within the EU.
• Explicitly guaranteed neutrality of the answers.

What speaks against it

• The foundation’s general conditions limit use of its resources to “the community of education, research, culture, health and administration”, while the public resolver page explicitly addresses the general public. This contradiction is not resolved in the primary sources.
• There is exactly one public resolver host, one IPv4 and one IPv6 address. No documented anycast, no fallback target. The foundation itself recommends adding a second server.
• The logging statement is generic. No retention period is quantified.

Evidence

• Fondation Restena: Public DNS resolver
• Fondation Restena: Website

Applied Privacy AT

Operator

Foundation for Applied Privacy, an Austrian association, register number ZVR 1254016365, Floragasse 7, 1040 Vienna

Legal form

Non-profit association

DNSSEC

Validating.

DNS over QUIC

Not documented.

Filtering

None. The operator states: “We do not provide DNS filter services, our resolvers provide the information they get from the authoritative DNS servers.”

Logging

The privacy policy states: “We do NOT log your IP address. We do NOT log your DNS query. We do NOT share query data with third parties.”

Endpoints

What speaks for it

• A non-profit association with an Austrian register number and the explicit purpose of promoting digital privacy.
• A very clear, three-part negative logging commitment without qualifications.
• DoT is additionally offered on port 443. That helps on networks that block port 853.
• According to the operator, no EDNS Client Subnet is set.

What speaks against it

• The operator itself classifies the service as experimental: “This is an experimental service which is operated on a best effort basis.” It is therefore not intended for production or business-critical use.
• A single documented location, Vienna, and in practice a single pair of servers. The DoH and DoT endpoints resolve to the same addresses. No anycast, no geographic redundancy.
• No plaintext DNS on port 53.

Evidence

• Foundation for Applied Privacy: DNS Privacy Services
• Foundation for Applied Privacy: Privacy Policy

LibreDNS GR

Operator

LibreOps, a collective of named volunteers from Greece. Servers at Hetzner in Nuremberg, Germany.

Legal form

Volunteer collective without a legal entity of its own

DNSSEC

No, and that is the most important point about this service. LibreDNS does not validate. Its own documentation records “DNSSEC: no” for every DNS stamp, the published configuration sets “dnssec=process-no-validate”, and a measurement on 7 September 2026 confirmed it: deliberately mis-signed test domains were answered normally, while a validating resolver refused them.

DNS over QUIC

Not documented.

Filtering

Two separate recursors. The default endpoint does not filter. The second one blocks advertising and trackers using the public StevenBlack list.

Logging

The website states: “We keep no logs. Logs are disabled for our DNS daemon.” Unlike every other service in this list, that can be checked: the complete configuration is public, and in it the web server access log is switched off and the resolver is set to “quiet”.

Endpoints

What speaks for it

• The complete operating configuration is public. That makes the no-log commitment technically verifiable rather than merely believable. No other service on this page offers that.
• The operators are named individuals, not anonymous and not behind a shell company.
• Funded solely by donations, with a publicly readable ledger on Open Collective. No tariffs, no advertising, no data business.
• Servers in Germany and therefore within EU jurisdiction, even though the collective is based in Greece.

What speaks against it

• No DNSSEC validation. Anyone using LibreDNS is unprotected against forged DNS answers above the resolver. For a page about secure name resolution that is the gravest objection to this service, and it outweighs the exemplary transparency.
• A single server in a single location. No anycast, no geographic redundancy, no fallback target.
• No plaintext DNS on port 53. The service is reachable only over DoH and DoT.
• No legal entity. The collective uses Open Collective Europe as a fiscal host for donations; that does not make the foundation the operator and creates no liability for the service.
• Only two DoH endpoints and two DoT names appear on the website itself. Further variants circulate in the project wiki and in Apple configuration profiles.

Evidence

• LibreDNS: endpoints and privacy statement
• LibreOps: the collective behind it
• LibreDNS: complete operating configuration
• LibreOps on Open Collective: open ledger

CIRA Canadian Shield Contractually limited to Canada

On the merits this service would be a model. It is run by the Canadian Internet Registration Authority, a not-for-profit corporation under Canadian federal law that also operates the country domain .ca. The service is cross-funded from registration fees, states an explicit 24-hour retention limit, demonstrably validates DNSSEC and offers a genuinely unfiltered variant.

It is still not in the list. The terms of use require a representation: “You represent and warrant that a) you are an individual resident of Canada”. Anyone configuring the service from Germany makes a declaration that is untrue. It is technically reachable, which changes nothing about the legal position. On top of that there is no European location; response time in our test was around 100 milliseconds.

For readers resident in Canada it is a very good choice. For everyone else, recommending it would be an invitation to break a contract.

• CIRA Canadian Shield: terms and conditions

Cloudflare

Addresses

1.1.1.1 and 1.0.0.1, filtered variants 1.1.1.2 and 1.1.1.3

Cloudflare, Inc. is a US company. Its privacy commitment is unusually specific: source IP addresses are, by its own account, not stored persistently, and truncated addresses and log data are deleted within 25 hours. There is an exception for at most 0.05 per cent of randomly sampled network packets, for which no retention period is stated. Aggregated analyses may be stored indefinitely. Cloudflare shares query data without client IP with APNIC Labs. An external audit is promised.

• Cloudflare: Public DNS Resolver Privacy

Google Public DNS

Addresses

8.8.8.8 and 8.8.4.4

Google LLC, a US company. Google Public DNS is not a malware blocker, but reserves the right to apply security-related blocks and to implement court orders. Google sends EDNS Client Subnet to authoritative servers that support it, which brings resolution geographically closer while also passing a truncated part of the client address to third parties.

• Google Public DNS: Privacy

AdGuard DNS

Addresses

94.140.14.14 filtered, 94.140.14.140 unfiltered

AdGuard Software Limited, based in Limassol, Cyprus. The service offers filtered and unfiltered addresses as well as DoH, DoT, DoQ and DNSCrypt. The filter list used is available as a public repository with an open issue tracker, so anyone can report a misclassification in public and follow what happens to it.

• AdGuard DNS: Public DNS

Cisco OpenDNS

Addresses

208.67.222.222 and 208.67.220.220, FamilyShield 208.67.222.123 and 208.67.220.123

Cisco Systems, Inc., a listed US corporation. The free service is the entry point to the paid Cisco Umbrella. What is missing is notable: there is no longer a dedicated privacy policy for the DNS service, and the former address now shows only the general Cisco statement. That leaves no no-log commitment and no published retention period for query data. DNSSEC is validated. In France and Portugal, following court decisions, Cisco did not filter the service but shut it down countrywide.

• OpenDNS: setup and addresses

NextDNS

Addresses

Account required; the addresses depend on your own configuration ID

NextDNS Inc., Delaware, USA. The service is not a finished resolver but a construction kit: you configure the filter lists, schedules and logging yourself. The privacy policy states verbatim: “If not specifically requested by the user, no data is logged.” Anyone wanting analytics switches logging on themselves and picks the retention period and region. What speaks against it is who runs it: a for-profit US corporation with no transparency report, no independent audit and a privacy policy carrying no date and no version history. Even with a European log region, the operator remains a US company.

• NextDNS: privacy policy

Control D

Addresses

Free profiles: 76.76.2.0 unfiltered, 76.76.2.1 malware, 76.76.2.2 ads and trackers

Control D offers several fixed profiles without an account, each with its own addresses and DoH paths, including an unfiltered one. The company runs a public compliance portal with downloadable SOC 2 and ISO 27001 attestation reports, which is unusual among the services named here. The flip side appears in the same portal: “If Analytics is enabled, we log DNS queries and metadata (e.g. source IP, hostname, MAC address).” Whether analytics is off in the delivered state is not stated in the documentation.

• Control D: free profiles

Unbound BSD 3-Clause

What it is

Full validating recursive resolver

Published by

NLnet Labs, Netherlands

Unbound resolves from the root servers itself instead of handing a query to somebody else’s resolver. That removes the central observer: no single operator sees the full query history any more. DNSSEC validation is built in and active in the default configuration, but it requires a configured trust anchor. The manual page states explicitly: “You must also set trust-anchors for validation to be useful.” Unbound can also run as a forwarder over DoT if you would rather not do the recursion yourself.

The carrier is NLnet Labs, a Dutch non-profit recognised as a public benefit organisation by the Dutch tax authorities. On continuity it commits to announcing any end of software maintenance at least two years in advance.

• NLnet Labs: Unbound

Knot Resolver GPL-3.0-or-later

What it is

Full validating recursive resolver

Published by

CZ.NIC, Czechia

Knot Resolver comes from CZ.NIC, the operator of the Czech country domain .cz. DNSSEC validation has been on by default since version 4.0. What stands out is the honesty of its own documentation. It explicitly warns against equating encrypted DNS with privacy: “Latest research has proven that encrypting DNS traffic is not sufficient to protect the users' privacy. Therefore, we recommend all users to use a full VPN instead of encrypting just DNS queries.” A project that names the limits of its own product deserves more trust than one that hides them.

Because of the GPL, Knot Resolver, unlike Unbound, cannot readily be embedded in closed devices. For self-hosting that makes no difference.

• CZ.NIC: Knot Resolver

Pi-hole EUPL v1.2

What it is

DNS sinkhole for filtering, not a resolver of its own

Published by

Pi-hole, LLC

Pi-hole is a DNS sinkhole, not a recursive resolver. It checks queries against block lists and forwards everything else to a configured upstream. The technical base is a dnsmasq derivative called FTL.

Two points that are often misrepresented. First, the default upstream is Google 8.8.8.8. Anyone who installs Pi-hole and changes nothing still sends every unblocked query to Google, merely bundled through a single IP. Second, DNSSEC validation is built in but switched off by default.

Pi-hole ships no encrypted transport, neither towards the clients nor towards the upstream. If you want real recursion, you additionally install Unbound and enter it as a local upstream. The recursion is then done by Unbound, not by Pi-hole.

• Pi-hole: Unbound as a recursive upstream

AdGuard Home GPL-3.0

What it is

A standalone DNS server with filtering; operates as a forwarder

Published by

AdGuard Software Limited, Cyprus

Unlike Pi-hole, AdGuard Home is not a layer on top of dnsmasq but a standalone DNS server written in Go. It can offer DoH, DoT and DoQ to its own clients without extra software. That is its practical advantage over Pi-hole: mobile devices can reach the home filter over an encrypted connection from anywhere.

One point that is frequently overstated: the “Enable DNSSEC” option does not mean AdGuard Home validates by itself. It sets the DO bit and relies on the upstream. Anyone who wants genuine local validation needs a validating resolver in front of or behind it.

AdGuard Home does not work recursively. A chosen upstream still sees every unblocked query.

• AdGuard Home: repository and documentation

Technitium DNS Server GPL-3.0

What it is

Authoritative server and recursive resolver in one

Published by

Technitium

Technitium covers both: its own recursion from the root servers including QNAME minimisation per RFC 9156, or forwarder operation over DoT, DoH and DoQ to a public resolver. It ships a web console, block lists, a DHCP server and an HTTP API, and can itself offer DoT, DoH and DoQ to its own clients, with DoH over HTTP/1.1, HTTP/2 and HTTP/3.

For a home network or a small office this is the most complete single solution in this list.

• Technitium DNS Server: Repository

dnscrypt-proxy ISC

What it is

Local encrypting proxy, not a resolver

Published by

Frank Denis

dnscrypt-proxy accepts unencrypted DNS on a local socket and sends it encrypted to a public resolver. It supports DNSCrypt, DoH and, unlike most alternatives, Anonymized DNSCrypt and Oblivious DoH per RFC 9230. Those two separate the question of “who is asking” from “what is being asked” by inserting a relay that cannot see the content, while the resolver cannot see the client address.

The substantive difference between DNSCrypt and DoH is not the strength of the encryption but the trust anchor. DNSCrypt uses a hard-coded provider public key with no certificate authority. DoH uses the usual certificate chain and a hostname that, without Encrypted Client Hello, travels in the clear. With DoH an observer therefore usually sees which provider you use.

The project states the limit itself: “one still has to trust non-logging DNS servers for actually doing what they pretend to do.”

• dnscrypt-proxy: repository and wiki