{
 "name": "Public DNS resolvers",
 "description": "Addresses, DoH/DoT endpoints, filtering variants and the operators' statements on logging, ECS and DNSSEC.",
 "license": "https://creativecommons.org/licenses/by/4.0/",
 "rights": "MyIPScan's work under CC BY 4.0; quoted text belongs to its source.",
 "attribution": "MyIPScan (https://myipscan.net/ip-ranges/public-dns-resolvers/); quoted evidence belongs to its source",
 "page": "https://myipscan.net/ip-ranges/public-dns-resolvers/",
 "url": "https://myipscan.net/ip-ranges/public-dns-resolvers.json",
 "dateModified": "2026-10-21",
 "records": 8,
 "data": {
  "checked": "2026-10-21",
  "facts": [
   {
    "resolver": "cloudflare",
    "claim": "logging",
    "evidence": "Cloudflare will delete the truncated IP address within 25 hours.",
    "source_url": "https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "cloudflare",
    "claim": "ecs",
    "evidence": "1.1.1.1 is a privacy-focused resolver and does not include client IP information in its queries",
    "source_url": "https://developers.cloudflare.com/1.1.1.1/faq/",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "cloudflare",
    "claim": "dnssec",
    "evidence": "1.1.1.1 validates the signatures before returning the answer",
    "source_url": "https://developers.cloudflare.com/1.1.1.1/faq/",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "cloudflare",
    "claim": "audit",
    "evidence": "retained one of the top four accounting firms to audit our practices",
    "source_url": "https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "cloudflare",
    "claim": "variant:1.1.1.1 for Families - Block malware",
    "evidence": "1.1.1.1 for Families adds automatic filtering to block known malware, phishing, and (optionally) adult content",
    "source_url": "https://developers.cloudflare.com/1.1.1.1/ip-addresses/",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "cloudflare",
    "claim": "variant:1.1.1.1 for Families - Block malware and adult content",
    "evidence": "Block malware and adult content",
    "source_url": "https://developers.cloudflare.com/1.1.1.1/ip-addresses/",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "cloudflare",
    "claim": "addresses",
    "evidence": "The standard resolver provides fast, private DNS lookups with no content filtering.",
    "source_url": "https://developers.cloudflare.com/1.1.1.1/ip-addresses/",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "cloudflare",
    "claim": "operator",
    "evidence": "C=US,ST=California,L=San Francisco,O=Cloudflare",
    "source_url": "https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-tls/",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "google-public-dns",
    "claim": "logging",
    "evidence": "These logs are subject to our deletion processes within 24-48 hours.",
    "source_url": "https://developers.google.com/speed/public-dns/privacy",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "google-public-dns",
    "claim": "ecs",
    "evidence": "the first 24/56 bits or less for IPv4/IPv6 respectively",
    "source_url": "https://developers.google.com/speed/public-dns/faq",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "google-public-dns",
    "claim": "dnssec",
    "evidence": "As of January 2013, Google Public DNS fully supports DNSSEC.",
    "source_url": "https://developers.google.com/speed/public-dns/docs/security",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "google-public-dns",
    "claim": "addresses",
    "evidence": "The Google Public DNS IP addresses (IPv4) are as follows:",
    "source_url": "https://developers.google.com/speed/public-dns/docs/using",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "google-public-dns",
    "claim": "operator",
    "evidence": "for all other users, Google LLC, with offices at 1600 Amphitheatre Parkway, Mountain View",
    "source_url": "https://developers.google.com/speed/public-dns/terms",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "quad9",
    "claim": "logging",
    "evidence": "Quad9 does not store IP address data of clients.",
    "source_url": "https://quad9.net/support/faq/",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "quad9",
    "claim": "ecs",
    "evidence": "Secured w/ECS: Malware blocking, DNSSEC Validation,",
    "source_url": "https://quad9.net/service/service-addresses-and-features/",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "quad9",
    "claim": "dnssec",
    "evidence": "DNSSEC validation is enabled on all resolver addresses",
    "source_url": "https://quad9.net/service/service-addresses-and-features/",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "quad9",
    "claim": "variant:Recommended (9.9.9.9)",
    "evidence": "Recommended: Malware Blocking, DNSSEC Validation (this is the most typical configuration)",
    "source_url": "https://quad9.net/service/service-addresses-and-features/",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "quad9",
    "claim": "variant:Secured w/ECS",
    "evidence": "Secured w/ECS: Malware blocking, DNSSEC Validation,",
    "source_url": "https://quad9.net/service/service-addresses-and-features/",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "quad9",
    "claim": "variant:Unsecured",
    "evidence": "Unsecured: No Malware blocking, DNSSEC validation (for experts only!)",
    "source_url": "https://quad9.net/service/service-addresses-and-features/",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "quad9",
    "claim": "addresses",
    "evidence": "Recommended: Malware Blocking, DNSSEC Validation (this is the most typical configuration)",
    "source_url": "https://quad9.net/service/service-addresses-and-features/",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "quad9",
    "claim": "operator",
    "evidence": "is the Swiss foundation Quad9, c/o SWITCH, Werdstrasse 2",
    "source_url": "https://quad9.net/privacy/policy/",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "opendns",
    "claim": "logging",
    "evidence": "We will retain your Personal Data as needed to fulfill the purposes",
    "source_url": "https://www.opendns.com/privacy-policy/",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "opendns",
    "claim": "ecs",
    "evidence": "Cisco Umbrella supports ECS for authoritative DNS resolvers based on an opt-in basis",
    "source_url": "https://www.cisco.com/c/en/us/support/docs/security/umbrella/224852-configure-umbrella-and-ecs.html",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "opendns",
    "claim": "dnssec",
    "evidence": "Cisco Umbrella now supports DNSSEC by performing validation on queries sent from Umbrella resolvers",
    "source_url": "https://umbrella.cisco.com/blog/what-is-dnssec-and-why-is-it-important",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "opendns",
    "claim": "variant:FamilyShield",
    "evidence": "helps block access to websites commonly categorized as adult content",
    "source_url": "https://www.cisco.com/c/en/us/support/docs/security/umbrella/225803-understand-opendns-familyshield.html",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "opendns",
    "claim": "addresses",
    "evidence": "Our nameservers are always:",
    "source_url": "https://www.opendns.com/setupguide/",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "opendns",
    "claim": "operator",
    "evidence": "Cisco Systems, Inc., Privacy Office, 170 West Tasman Dr., San Jose, CA 95134, USA",
    "source_url": "https://www.opendns.com/privacy-policy/",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "adguard-dns",
    "claim": "logging",
    "evidence": "We keep and store an anonymous database of domains requested in the last 24 hours.",
    "source_url": "https://adguard-dns.io/en/privacy.html",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "adguard-dns",
    "claim": "ecs",
    "evidence": "The AdGuard DNS servers now support EDNS Client Subnet (ECS).",
    "source_url": "https://adguard-dns.io/en/blog/private-dns-v0-3-beta.html",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "adguard-dns",
    "claim": "variant:Default",
    "evidence": "AdGuard DNS will block ads and trackers.",
    "source_url": "https://adguard-dns.io/en/public-dns.html",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "adguard-dns",
    "claim": "variant:Non-filtering",
    "evidence": "AdGuard DNS will not block ads, trackers, or any other DNS requests.",
    "source_url": "https://adguard-dns.io/en/public-dns.html",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "adguard-dns",
    "claim": "variant:Family protection",
    "evidence": "will block ads, trackers, adult content, and enable Safe Search",
    "source_url": "https://adguard-dns.io/en/public-dns.html",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "adguard-dns",
    "claim": "addresses",
    "evidence": "AdGuard DNS will block ads and trackers.",
    "source_url": "https://adguard-dns.io/en/public-dns.html",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "adguard-dns",
    "claim": "operator",
    "evidence": "ADGUARD SOFTWARE LIMITED is a company registered in Limassol, Cyprus",
    "source_url": "https://adguard-dns.io/en/privacy.html",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "control-d",
    "claim": "logging",
    "evidence": "We never store it unless you choose to select Full Analytics.",
    "source_url": "https://docs.controld.com/docs/analytics",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "control-d",
    "claim": "ecs",
    "evidence": "By default, the ECS toggle is Off, meaning no ECS information will be sent.",
    "source_url": "https://docs.controld.com/docs/ecs-custom-subnet",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "control-d",
    "claim": "dnssec",
    "evidence": "Turning it on removes validation of DNSSEC signatures for this Profile.",
    "source_url": "https://docs.controld.com/docs/disable-dnssec-option",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "control-d",
    "claim": "variant:Malware (p1)",
    "evidence": "We expose multiple blocklist presets as distinct resolver endpoints.",
    "source_url": "https://docs.controld.com/docs/free-dns",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "control-d",
    "claim": "variant:Ads & Tracking (p2)",
    "evidence": "We expose multiple blocklist presets as distinct resolver endpoints.",
    "source_url": "https://docs.controld.com/docs/free-dns",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "control-d",
    "claim": "variant:Social (p3)",
    "evidence": "We expose multiple blocklist presets as distinct resolver endpoints.",
    "source_url": "https://docs.controld.com/docs/free-dns",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "control-d",
    "claim": "variant:Family Friendly",
    "evidence": "We expose multiple blocklist presets as distinct resolver endpoints.",
    "source_url": "https://docs.controld.com/docs/free-dns",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "control-d",
    "claim": "variant:Uncensored",
    "evidence": "We expose multiple blocklist presets as distinct resolver endpoints.",
    "source_url": "https://docs.controld.com/docs/free-dns",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "control-d",
    "claim": "addresses",
    "evidence": "We expose multiple blocklist presets as distinct resolver endpoints.",
    "source_url": "https://docs.controld.com/docs/free-dns",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "control-d",
    "claim": "operator",
    "evidence": "a company registered in the province of Ontario, Canada",
    "source_url": "https://controld.com/terms",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "cleanbrowsing",
    "claim": "logging",
    "evidence": "we do not log or store any personally identifiable information",
    "source_url": "https://cleanbrowsing.org/privacy",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "cleanbrowsing",
    "claim": "dnssec",
    "evidence": "DNS resolvers perform DNSSEC validation on all queries",
    "source_url": "https://cleanbrowsing.org/learn/what-is-dnssec",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "cleanbrowsing",
    "claim": "variant:Family Filter",
    "evidence": "Blocks access to all adult, pornographic and explicit sites.",
    "source_url": "https://cleanbrowsing.org/filters",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "cleanbrowsing",
    "claim": "variant:Adult Filter",
    "evidence": "It does not block proxy or VPNs, nor mixed-content sites.",
    "source_url": "https://cleanbrowsing.org/filters",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "cleanbrowsing",
    "claim": "variant:Security Filter",
    "evidence": "Blocks access to phishing, spam, malware and malicious domains.",
    "source_url": "https://cleanbrowsing.org/filters",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "cleanbrowsing",
    "claim": "addresses",
    "evidence": "Blocks access to all adult, pornographic and explicit sites.",
    "source_url": "https://cleanbrowsing.org/filters",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "cleanbrowsing",
    "claim": "operator",
    "evidence": "CleanBrowsing is a U.S.-based, global company.",
    "source_url": "https://cleanbrowsing.org/privacy",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "nextdns",
    "claim": "logging",
    "evidence": "If not specifically requested by the user, no data is logged.",
    "source_url": "https://nextdns.io/privacy",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "nextdns",
    "claim": "ecs",
    "evidence": "that does not expose your IP address to authoritative DNS servers",
    "source_url": "https://nextdns.io/privacy",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "nextdns",
    "claim": "dnssec",
    "evidence": "Automatically validate the authenticity of DNS answers.",
    "source_url": "https://nextdns.io/",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "nextdns",
    "claim": "addresses",
    "evidence": "a bootstrap IP can be specified as follow",
    "source_url": "https://github.com/nextdns/nextdns/wiki/Configuration",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "nextdns",
    "claim": "operator",
    "evidence": "NextDNS Inc. is an independent company 100% funded, owned and controlled by its founders",
    "source_url": "https://nextdns.io/privacy",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "cloudflare",
    "claim": "logging-exception",
    "evidence": "randomly sampled network packets captured from at most 0.05% of all traffic",
    "source_url": "https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "google-public-dns",
    "claim": "logging-exception",
    "evidence": "Google may retain temporary log information longer than 48 hours",
    "source_url": "https://developers.google.com/speed/public-dns/privacy",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "quad9",
    "claim": "ecs-default",
    "evidence": "we do not transmit that data in our default service",
    "source_url": "https://quad9.net/support/faq/",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "opendns",
    "claim": "dot",
    "evidence": "support for DoT is live on all Umbrella resolvers globally",
    "source_url": "https://umbrella.cisco.com/blog/enhancing-support-dns-encryption-with-dns-over-https",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "adguard-dns",
    "claim": "variant:Default purpose",
    "evidence": "Default server is for blocking ads, trackers, malware and phishing websites",
    "source_url": "https://adguard-dns.io/kb/public-dns/overview/",
    "verified_at": "2026-10-21"
   },
   {
    "resolver": "control-d",
    "claim": "logging-free",
    "evidence": "Not store logs (no individual browsing history, timestamps, or query logs)",
    "source_url": "https://docs.controld.com/docs/free-dns",
    "verified_at": "2026-10-21"
   }
  ],
  "resolvers": [
   {
    "slug": "cloudflare",
    "name": "Cloudflare 1.1.1.1",
    "operator": "Cloudflare, Inc.",
    "country": "United States",
    "ipv4": [
     "1.1.1.1",
     "1.0.0.1"
    ],
    "ipv6": [
     "2606:4700:4700::1111",
     "2606:4700:4700::1001"
    ],
    "doh": "https://cloudflare-dns.com/dns-query",
    "dot": "one.one.one.one",
    "docs": "https://developers.cloudflare.com/1.1.1.1/",
    "ip_ranges_page": "/ip-ranges/cloudflare/",
    "variants": [
     {
      "name": "1.1.1.1 for Families - Block malware",
      "ipv4": [
       "1.1.1.2",
       "1.0.0.2"
      ],
      "ipv6": [
       "2606:4700:4700::1112",
       "2606:4700:4700::1002"
      ],
      "purpose": "Blocks known malware and phishing"
     },
     {
      "name": "1.1.1.1 for Families - Block malware and adult content",
      "ipv4": [
       "1.1.1.3",
       "1.0.0.3"
      ],
      "ipv6": [
       "2606:4700:4700::1113",
       "2606:4700:4700::1003"
      ],
      "purpose": "Blocks malware and adult content"
     }
    ],
    "claims": {
     "logging": {
      "short": "Truncated IP, 25 h",
      "text": "Cloudflare truncates the client IP and deletes the truncated address within 25 hours. The exception is randomly sampled packets, at most 0.05% of traffic to its network, kept for troubleshooting and DoS mitigation.",
      "source_url": "https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/"
     },
     "ecs": {
      "short": "No, one exception",
      "text": "Does not pass your subnet (EDNS Client Subnet) to other DNS servers; Cloudflare names one exception, an Akamai debugging domain.",
      "source_url": "https://developers.cloudflare.com/1.1.1.1/faq/"
     },
     "dnssec": {
      "short": "Validates",
      "text": "Checks DNSSEC signatures before answering when the domain is signed.",
      "source_url": "https://developers.cloudflare.com/1.1.1.1/faq/"
     },
     "audit": {
      "short": "Yes, firm not named",
      "text": "Cloudflare says one of the four largest accounting firms audited its resolver privacy practices; the page does not name the firm.",
      "source_url": "https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/"
     }
    },
    "sources": [
     "https://developers.cloudflare.com/1.1.1.1/ip-addresses/",
     "https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/make-api-requests/",
     "https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-tls/",
     "https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/",
     "https://developers.cloudflare.com/1.1.1.1/faq/"
    ],
    "ip_ranges_label": "Cloudflare"
   },
   {
    "slug": "google-public-dns",
    "name": "Google Public DNS",
    "operator": "Google LLC (Google Ireland Limited for users in Europe)",
    "country": "United States (Ireland for European users)",
    "ipv4": [
     "8.8.8.8",
     "8.8.4.4"
    ],
    "ipv6": [
     "2001:4860:4860::8888",
     "2001:4860:4860::8844"
    ],
    "doh": "https://dns.google/dns-query",
    "dot": "dns.google",
    "docs": "https://developers.google.com/speed/public-dns/docs/using",
    "ip_ranges_page": "/ip-ranges/google-cloud/",
    "variants": [],
    "claims": {
     "logging": {
      "short": "Full IP 24-48 h, longer for abuse",
      "text": "Temporary logs keep the full client IP and are deleted within 24 to 48 hours, except data Google keeps longer to handle security or abuse. Permanent logs are a sample with city- or region-level location instead of the IP.",
      "source_url": "https://developers.google.com/speed/public-dns/privacy"
     },
     "ecs": {
      "short": "Yes, truncated",
      "text": "Passes a shortened client subnet to other DNS servers: at most the first 24 bits of an IPv4 address and 56 bits of IPv6.",
      "source_url": "https://developers.google.com/speed/public-dns/faq"
     },
     "dnssec": {
      "short": "Validates",
      "text": "A validating resolver since January 2013.",
      "source_url": "https://developers.google.com/speed/public-dns/docs/security"
     },
     "audit": {
      "short": "None found",
      "text": null
     }
    },
    "sources": [
     "https://developers.google.com/speed/public-dns/docs/using",
     "https://developers.google.com/speed/public-dns/docs/secure-transports",
     "https://developers.google.com/speed/public-dns/privacy",
     "https://developers.google.com/speed/public-dns/faq",
     "https://developers.google.com/speed/public-dns/docs/security",
     "https://developers.google.com/speed/public-dns/terms"
    ],
    "ip_ranges_label": "Google"
   },
   {
    "slug": "quad9",
    "name": "Quad9",
    "operator": "Quad9",
    "country": "Switzerland",
    "ipv4": [
     "9.9.9.9",
     "149.112.112.112"
    ],
    "ipv6": [
     "2620:fe::fe",
     "2620:fe::9"
    ],
    "doh": "https://dns.quad9.net/dns-query",
    "dot": "dns.quad9.net",
    "docs": "https://quad9.net/service/service-addresses-and-features/",
    "ip_ranges_page": "/ip-ranges/quad9/",
    "variants": [
     {
      "name": "Recommended (9.9.9.9)",
      "ipv4": [
       "9.9.9.9",
       "149.112.112.112"
      ],
      "ipv6": [
       "2620:fe::fe",
       "2620:fe::9"
      ],
      "doh_url": "https://dns.quad9.net/dns-query",
      "dot_host": "dns.quad9.net",
      "purpose": "Malware blocking with DNSSEC validation; the default service"
     },
     {
      "name": "Secured w/ECS",
      "ipv4": [
       "9.9.9.11",
       "149.112.112.11"
      ],
      "ipv6": [
       "2620:fe::11",
       "2620:fe::fe:11"
      ],
      "doh_url": "https://dns11.quad9.net/dns-query",
      "dot_host": "dns11.quad9.net",
      "purpose": "Malware blocking and DNSSEC validation, with ECS enabled"
     },
     {
      "name": "Unsecured",
      "ipv4": [
       "9.9.9.10",
       "149.112.112.10"
      ],
      "ipv6": [
       "2620:fe::10",
       "2620:fe::fe:10"
      ],
      "doh_url": "https://dns10.quad9.net/dns-query",
      "dot_host": "dns10.quad9.net",
      "purpose": "No malware blocking; labelled 'for experts only'"
     }
    ],
    "claims": {
     "logging": {
      "short": "No IP stored",
      "text": "Does not store client IP addresses; it does record the approximate location (city, state, country) of the querying system for threat analysis.",
      "source_url": "https://quad9.net/support/faq/"
     },
     "ecs": {
      "short": "Only on 9.9.9.11",
      "text": "Quad9 says its default service does not send EDNS Client Subnet; the separate 9.9.9.11 service does.",
      "source_url": "https://quad9.net/service/service-addresses-and-features/",
      "source_url2": "https://quad9.net/support/faq/"
     },
     "dnssec": {
      "short": "Validates",
      "text": "DNSSEC validation is enabled on all resolver addresses.",
      "source_url": "https://quad9.net/service/service-addresses-and-features/"
     },
     "audit": {
      "short": "None found",
      "text": null
     }
    },
    "sources": [
     "https://quad9.net/service/service-addresses-and-features/",
     "https://quad9.net/support/faq/",
     "https://quad9.net/privacy/policy/"
    ],
    "ip_ranges_label": "Quad9"
   },
   {
    "slug": "opendns",
    "name": "Cisco OpenDNS",
    "operator": "Cisco Systems, Inc.",
    "country": "United States",
    "ipv4": [
     "208.67.222.222",
     "208.67.220.220"
    ],
    "ipv6": [
     "2620:119:35::35",
     "2620:119:53::53"
    ],
    "doh": "https://dns.opendns.com/dns-query",
    "dot": null,
    "docs": "https://www.opendns.com/setupguide/",
    "ip_ranges_page": "/ip-ranges/opendns/",
    "variants": [
     {
      "name": "FamilyShield",
      "ipv4": [
       "208.67.222.123",
       "208.67.220.123"
      ],
      "ipv6": [
       "2620:119:35::123",
       "2620:119:53::123"
      ],
      "doh_url": "https://familyshield.opendns.com/dns-query",
      "purpose": "Preset DNS content filtering that blocks adult-content sites"
     },
     {
      "name": "Sandbox",
      "ipv4": [
       "208.67.222.2",
       "208.67.220.2"
      ],
      "ipv6": [
       "2620:0:ccc::2",
       "2620:0:ccd::2"
      ],
      "doh_url": "https://sandbox.opendns.com/dns-query",
      "purpose": "Other published resolver; Cisco does not state its purpose",
      "other": true
     }
    ],
    "claims": {
     "logging": {
      "short": "Not stated for DNS",
      "text": "The privacy statement OpenDNS links is Cisco's general one, with no DNS-specific retention period.",
      "source_url": "https://www.opendns.com/privacy-policy/"
     },
     "ecs": {
      "short": "Opt-in domains only",
      "text": "Sends the client's /24 only to authoritative servers whose owners opted in.",
      "source_url": "https://www.cisco.com/c/en/us/support/docs/security/umbrella/224852-configure-umbrella-and-ecs.html"
     },
     "dnssec": {
      "short": "Validates",
      "text": "Umbrella resolvers, which also answer for OpenDNS, validate DNSSEC.",
      "source_url": "https://umbrella.cisco.com/blog/what-is-dnssec-and-why-is-it-important"
     },
     "audit": {
      "short": "None found",
      "text": null
     }
    },
    "sources": [
     "https://www.opendns.com/setupguide/",
     "https://umbrella.cisco.com/blog/enhancing-support-dns-encryption-with-dns-over-https",
     "https://securitydocs.cisco.com/docs/umbrella-dns/olh/146422.dita",
     "https://www.cisco.com/c/en/us/support/docs/security/umbrella/224852-configure-umbrella-and-ecs.html",
     "https://umbrella.cisco.com/blog/what-is-dnssec-and-why-is-it-important",
     "https://community.cisco.com/t5/umbrella-announcements/dnssec-general-availability/ta-p/5191601",
     "https://www.opendns.com/privacy-policy/",
     "https://www.cisco.com/c/en/us/support/docs/security/umbrella/225803-understand-opendns-familyshield.html"
    ],
    "ip_ranges_label": "OpenDNS",
    "dot_note": "No hostname published; Cisco says DoT runs on TCP port 853 of the addresses above.",
    "dot_note_url": "https://umbrella.cisco.com/blog/enhancing-support-dns-encryption-with-dns-over-https"
   },
   {
    "slug": "adguard-dns",
    "name": "AdGuard DNS",
    "operator": "AdGuard Software Limited",
    "country": "Cyprus",
    "ipv4": [
     "94.140.14.14",
     "94.140.15.15"
    ],
    "ipv6": [
     "2a10:50c0::ad1:ff",
     "2a10:50c0::ad2:ff"
    ],
    "doh": "https://dns.adguard-dns.com/dns-query",
    "dot": "dns.adguard-dns.com",
    "docs": "https://adguard-dns.io/kb/public-dns/overview/",
    "ip_ranges_page": "/ip-ranges/adguard-dns/",
    "variants": [
     {
      "name": "Default",
      "ipv4": [
       "94.140.14.14",
       "94.140.15.15"
      ],
      "ipv6": [
       "2a10:50c0::ad1:ff",
       "2a10:50c0::ad2:ff"
      ],
      "doh_url": "https://dns.adguard-dns.com/dns-query",
      "dot_host": "dns.adguard-dns.com",
      "purpose": "Blocks ads, trackers, malware and phishing"
     },
     {
      "name": "Non-filtering",
      "ipv4": [
       "94.140.14.140",
       "94.140.14.141"
      ],
      "ipv6": [
       "2a10:50c0::1:ff",
       "2a10:50c0::2:ff"
      ],
      "doh_url": "https://unfiltered.adguard-dns.com/dns-query",
      "dot_host": "unfiltered.adguard-dns.com",
      "purpose": "No blocking"
     },
     {
      "name": "Family protection",
      "ipv4": [
       "94.140.14.15",
       "94.140.15.16"
      ],
      "ipv6": [
       "2a10:50c0::bad1:ff",
       "2a10:50c0::bad2:ff"
      ],
      "doh_url": "https://family.adguard-dns.com/dns-query",
      "dot_host": "family.adguard-dns.com",
      "purpose": "Blocks ads, trackers and adult content, and enforces Safe Search / Safe Mode"
     }
    ],
    "claims": {
     "logging": {
      "short": "Anonymous, 24 h",
      "text": "The public servers keep an anonymous list of domains requested in the last 24 hours and aggregate counters, not linked to a user.",
      "source_url": "https://adguard-dns.io/en/privacy.html"
     },
     "ecs": {
      "short": "Substituted (2022 note)",
      "text": "In a 2022 Private AdGuard DNS beta changelog, AdGuard said its DNS servers support ECS and pass an address near yours instead of your own; its public-DNS pages do not mention ECS.",
      "source_url": "https://adguard-dns.io/en/blog/private-dns-v0-3-beta.html"
     },
     "dnssec": {
      "short": "Not stated",
      "text": null,
      "looked_at": "https://adguard-dns.io/kb/public-dns/overview/"
     },
     "audit": {
      "short": "None found",
      "text": null
     }
    },
    "sources": [
     "https://adguard-dns.io/en/public-dns.html",
     "https://adguard-dns.io/en/privacy.html",
     "https://adguard-dns.io/en/blog/private-dns-v0-3-beta.html",
     "https://adguard-dns.io/en/versions/dns/release.html",
     "https://adguard-dns.io/kb/public-dns/overview/"
    ],
    "ip_ranges_label": "AdGuard DNS"
   },
   {
    "slug": "control-d",
    "name": "Control D",
    "operator": "ControlD Inc",
    "country": "Canada",
    "ipv4": [
     "76.76.2.0",
     "76.76.10.0"
    ],
    "ipv6": [
     "2606:1a40::0",
     "2606:1a40:1::0"
    ],
    "doh": "https://freedns.controld.com/p0",
    "dot": "p0.freedns.controld.com",
    "docs": "https://docs.controld.com/docs/free-dns",
    "ip_ranges_page": null,
    "variants": [
     {
      "name": "Malware (p1)",
      "ipv4": [
       "76.76.2.1",
       "76.76.10.1"
      ],
      "ipv6": [
       "2606:1a40::1",
       "2606:1a40:1::1"
      ],
      "doh_url": "https://freedns.controld.com/p1",
      "dot_host": "p1.freedns.controld.com",
      "purpose": "Malware blocklist (name only)"
     },
     {
      "name": "Ads & Tracking (p2)",
      "ipv4": [
       "76.76.2.2",
       "76.76.10.2"
      ],
      "ipv6": [
       "2606:1a40::2",
       "2606:1a40:1::2"
      ],
      "doh_url": "https://freedns.controld.com/p2",
      "dot_host": "p2.freedns.controld.com",
      "purpose": "Ads and tracking blocklist (name only)"
     },
     {
      "name": "Social (p3)",
      "ipv4": [
       "76.76.2.3",
       "76.76.10.3"
      ],
      "ipv6": [
       "2606:1a40::3",
       "2606:1a40:1::3"
      ],
      "doh_url": "https://freedns.controld.com/p3",
      "dot_host": "p3.freedns.controld.com",
      "purpose": "Social media blocklist (name only)"
     },
     {
      "name": "Family Friendly",
      "ipv4": [
       "76.76.2.4",
       "76.76.10.4"
      ],
      "ipv6": [
       "2606:1a40::4",
       "2606:1a40:1::4"
      ],
      "doh_url": "https://freedns.controld.com/family",
      "dot_host": "family.freedns.controld.com",
      "purpose": "Family-friendly filtering (name only)"
     },
     {
      "name": "Uncensored",
      "ipv4": [
       "76.76.2.5",
       "76.76.10.5"
      ],
      "ipv6": [
       "2606:1a40::5",
       "2606:1a40:1::5"
      ],
      "doh_url": "https://freedns.controld.com/uncensored",
      "dot_host": "uncensored.freedns.controld.com",
      "purpose": "Uncensored resolver (name only)"
     }
    ],
    "claims": {
     "logging": {
      "short": "No logs (free)",
      "text": "Control D says its free resolvers store no logs: no browsing history, timestamps or query logs. On account profiles, per-query data is stored only when Full Analytics is selected.",
      "source_url": "https://docs.controld.com/docs/free-dns",
      "source_url2": "https://docs.controld.com/docs/analytics"
     },
     "ecs": {
      "short": "Off by default",
      "text": "On account profiles EDNS Client Subnet is off unless the user turns it on; the free resolvers' behaviour is not stated.",
      "source_url": "https://docs.controld.com/docs/ecs-custom-subnet"
     },
     "dnssec": {
      "short": "Profiles validate",
      "text": "Account profiles validate DNSSEC unless the user turns on the Disable DNSSEC option; the free resolvers' page does not mention DNSSEC.",
      "source_url": "https://docs.controld.com/docs/disable-dnssec-option"
     },
     "audit": {
      "short": "None found",
      "text": null
     }
    },
    "sources": [
     "https://docs.controld.com/docs/free-dns",
     "https://docs.controld.com/docs/ecs-custom-subnet",
     "https://docs.controld.com/docs/disable-dnssec-option",
     "https://docs.controld.com/docs/analytics",
     "https://controld.com/terms",
     "https://controld.com/privacy"
    ],
    "note": "The addresses above are the free unfiltered resolver (p0); Control D's own filtered presets follow. Its page also lists 13 free resolvers built on third-party blocklists (OISD, StevenBlack, 1Hosts, Hagezi, AdGuard) on 76.76.2.32-48 and 76.76.10.32-48.",
    "variants_label": "5 + 13 third-party"
   },
   {
    "slug": "cleanbrowsing",
    "name": "CleanBrowsing",
    "operator": "CleanBrowsing",
    "country": "United States",
    "ipv4": [
     "185.228.168.168",
     "185.228.169.168"
    ],
    "ipv6": [
     "2a0d:2a00:1::",
     "2a0d:2a00:2::"
    ],
    "doh": "https://doh.cleanbrowsing.org/doh/family-filter/",
    "dot": "family-filter-dns.cleanbrowsing.org",
    "docs": "https://cleanbrowsing.org/filters",
    "ip_ranges_page": null,
    "variants": [
     {
      "name": "Family Filter",
      "ipv4": [
       "185.228.168.168",
       "185.228.169.168"
      ],
      "ipv6": [
       "2a0d:2a00:1::",
       "2a0d:2a00:2::"
      ],
      "doh_url": "https://doh.cleanbrowsing.org/doh/family-filter/",
      "dot_host": "family-filter-dns.cleanbrowsing.org",
      "purpose": "Blocks adult content, proxy/VPN domains and mixed-content sites, enforces SafeSearch, and blocks malicious and phishing domains"
     },
     {
      "name": "Adult Filter",
      "ipv4": [
       "185.228.168.10",
       "185.228.169.11"
      ],
      "ipv6": [
       "2a0d:2a00:1::1",
       "2a0d:2a00:2::1"
      ],
      "doh_url": "https://doh.cleanbrowsing.org/doh/adult-filter/",
      "dot_host": "adult-filter-dns.cleanbrowsing.org",
      "purpose": "Blocks adult content and malicious domains, but not proxies/VPNs or mixed-content sites"
     },
     {
      "name": "Security Filter",
      "ipv4": [
       "185.228.168.9",
       "185.228.169.9"
      ],
      "ipv6": [
       "2a0d:2a00:1::2",
       "2a0d:2a00:2::2"
      ],
      "doh_url": "https://doh.cleanbrowsing.org/doh/security-filter/",
      "dot_host": "security-filter-dns.cleanbrowsing.org",
      "purpose": "Security only: phishing, spam, malware and malicious domains; does not block adult content"
     }
    ],
    "claims": {
     "logging": {
      "short": "No IP stored",
      "text": "The free filters do not log personally identifiable information such as the client IP; only anonymous aggregate data is processed.",
      "source_url": "https://cleanbrowsing.org/privacy"
     },
     "ecs": {
      "short": "Not stated",
      "text": null,
      "looked_at": "https://cleanbrowsing.org/filters"
     },
     "dnssec": {
      "short": "Contradictory",
      "text": "One CleanBrowsing page says its resolvers validate DNSSEC on all queries; another, about encrypted DNS, says DNSSEC does not apply directly to resolver services.",
      "source_url": "https://cleanbrowsing.org/learn/what-is-dnssec"
     },
     "audit": {
      "short": "None found",
      "text": null
     }
    },
    "sources": [
     "https://cleanbrowsing.org/filters",
     "https://cleanbrowsing.org/privacy",
     "https://cleanbrowsing.org/learn/what-is-dnssec",
     "https://cleanbrowsing.org/articles/safe-dns-encrypting-dns-for-a-safe-online-experience"
    ],
    "note": "Every free CleanBrowsing resolver filters; there is no unfiltered one. The addresses above are the Family Filter."
   },
   {
    "slug": "nextdns",
    "name": "NextDNS",
    "operator": "NextDNS Inc.",
    "country": "Not stated",
    "ipv4": [],
    "ipv6": [],
    "doh": "https://dns.nextdns.io",
    "dot": null,
    "docs": "https://github.com/nextdns/nextdns/wiki/Configuration",
    "ip_ranges_page": null,
    "variants": [],
    "claims": {
     "logging": {
      "short": "Off unless enabled",
      "text": "Nothing is logged unless the user turns logs on. The user picks retention from one hour to two years and the storage region.",
      "source_url": "https://nextdns.io/privacy",
      "source_url2": "https://nextdns.io/"
     },
     "ecs": {
      "short": "Yes, without your IP",
      "text": "Uses its own EDNS Client Subnet implementation which, NextDNS says, does not expose the client IP to authoritative servers.",
      "source_url": "https://nextdns.io/privacy"
     },
     "dnssec": {
      "short": "Offered",
      "text": "DNSSEC validation is listed as a feature; whether it is on by default is not stated.",
      "source_url": "https://nextdns.io/"
     },
     "audit": {
      "short": "None found",
      "text": null
     }
    },
    "sources": [
     "https://nextdns.io/privacy",
     "https://nextdns.io/",
     "https://github.com/nextdns/nextdns/wiki/Configuration"
    ],
    "note": "Account-based: each configuration gets its own DoH path, DoT hostname and addresses, shown after sign-in. 45.90.28.0 appears in NextDNS's own documentation only as an example bootstrap address."
   }
  ]
 }
}