Operator documentation

Public DNS resolvers compared

Eight public DNS resolvers, from their operators’ own pages: the addresses to enter, the encrypted endpoints, what each one logs, whether it passes part of your IP address to other DNS servers, and whether it checks DNSSEC.

At a glance

“Passes your subnet” is EDNS Client Subnet: the resolver tells the website’s DNS server roughly where you are, which speeds up CDNs and reveals part of your address. Details and sources are in each resolver’s section.

Resolver	IPv4	What it logs	Passes your subnet	DNSSEC	Filtering options
Cloudflare 1.1.1.1	`1.1.1.1`	No full IP stored	No	Validates	2
Google Public DNS	`8.8.8.8`	Full IP for 24-48 h	Yes, truncated	Validates	—
Quad9	`9.9.9.9`	No IP stored	Only on 9.9.9.11	Validates	3
Cisco OpenDNS	`208.67.222.222`	Not stated for DNS	Opt-in domains only	Validates	2
AdGuard DNS	`94.140.14.14`	Anonymous, 24 h	Substituted subnet	Not stated	3
Control D	`76.76.2.0`	Not stated for free	Off by default	Validates	5
CleanBrowsing	`185.228.168.168`	No IP stored	Not stated	Contradictory	3
NextDNS	Per account	Off unless enabled	Yes, without your IP	Offered	—

Cloudflare 1.1.1.1

Cloudflare, Inc. · United States

IPv4: 1.1.1.1
1.0.0.1
IPv6: 2606:4700:4700::1111
2606:4700:4700::1001
DNS over HTTPS: https://cloudflare-dns.com/dns-query
DNS over TLS: one.one.one.one

What it logs: The client IP is never written to disk in full: Cloudflare truncates it and deletes the truncated address within 25 hours. developers.cloudflare.com Read 21 Oct 2026
Passes your subnet (ECS): Does not pass your subnet (EDNS Client Subnet) to other DNS servers. developers.cloudflare.com Read 21 Oct 2026
DNSSEC: Checks DNSSEC signatures before answering when the domain is signed. developers.cloudflare.com Read 21 Oct 2026
Independent audit: Cloudflare says one of the four largest accounting firms audited its resolver privacy practices; the page does not name the firm. developers.cloudflare.com Read 21 Oct 2026

Filtering options

Option	IPv4	What it does
1.1.1.1 for Families - Block malware	`1.1.1.2` `1.0.0.2`	Blocks known malware and phishing
1.1.1.1 for Families - Block malware and adult content	`1.1.1.3` `1.0.0.3`	Blocks malware and adult content

Operator documentation · Cloudflare IP ranges

Google Public DNS

Google LLC · United States

IPv4: 8.8.8.8
8.8.4.4
IPv6: 2001:4860:4860::8888
2001:4860:4860::8844
DNS over HTTPS: https://dns.google/dns-query
DNS over TLS: dns.google

What it logs: Temporary logs keep the full client IP and are deleted within 24 to 48 hours; longer-lived logs keep aggregated data without the IP. developers.google.com Read 21 Oct 2026
Passes your subnet (ECS): Passes a shortened client subnet to other DNS servers: at most the first 24 bits of an IPv4 address and 56 bits of IPv6. developers.google.com Read 21 Oct 2026
DNSSEC: A validating resolver since January 2013. developers.google.com Read 21 Oct 2026
Independent audit: not stated on the operator’s pages.

Operator documentation · Google IP ranges

Quad9

Quad9 · Switzerland

IPv4: 9.9.9.9
149.112.112.112
IPv6: 2620:fe::fe
2620:fe::9
DNS over HTTPS: https://dns.quad9.net/dns-query
DNS over TLS: dns.quad9.net

What it logs: Does not store client IP addresses; it does record the approximate location (city, state, country) of the querying system for threat analysis. quad9.net Read 21 Oct 2026
Passes your subnet (ECS): EDNS Client Subnet is offered on the separate 9.9.9.11 service; the default 9.9.9.9 service does not list it. quad9.net Read 21 Oct 2026
DNSSEC: DNSSEC validation is enabled on all resolver addresses. quad9.net Read 21 Oct 2026
Independent audit: not stated on the operator’s pages.

Filtering options

Option	IPv4	What it does
Recommended (9.9.9.9)	`9.9.9.9` `149.112.112.112`	Malware blocking with DNSSEC validation; the default service
Secured w/ECS	`9.9.9.11` `149.112.112.11`	Malware blocking and DNSSEC validation, with ECS enabled
Unsecured	`9.9.9.10` `149.112.112.10`	No malware blocking; labelled 'for experts only'

Operator documentation · Quad9 IP ranges

Cisco OpenDNS

Cisco Systems, Inc. · United States

IPv4: 208.67.222.222
208.67.220.220
IPv6: 2620:119:35::35
2620:119:53::53
DNS over HTTPS: https://dns.opendns.com/dns-query
DNS over TLS: —

What it logs: The privacy statement OpenDNS links is Cisco's general one, with no DNS-specific retention period. www.opendns.com Read 21 Oct 2026
Passes your subnet (ECS): Sends the client's /24 only to authoritative servers whose owners opted in. www.cisco.com Read 21 Oct 2026
DNSSEC: Umbrella resolvers, which also answer for OpenDNS, validate DNSSEC. umbrella.cisco.com Read 21 Oct 2026
Independent audit: not stated on the operator’s pages.

Filtering options

Option	IPv4	What it does
FamilyShield	`208.67.222.123` `208.67.220.123`	Preset DNS content filtering that blocks adult-content sites
Sandbox	`208.67.222.2` `208.67.220.2`	Not stated in the source table; only the name and addresses are listed

Operator documentation · OpenDNS IP ranges

AdGuard DNS

AdGuard Software Limited · Cyprus

IPv4: 94.140.14.14
94.140.15.15
IPv6: 2a10:50c0::ad1:ff
2a10:50c0::ad2:ff
DNS over HTTPS: https://dns.adguard-dns.com/dns-query
DNS over TLS: dns.adguard-dns.com

What it logs: The public servers keep an anonymous list of domains requested in the last 24 hours and aggregate counters, not linked to a user. adguard-dns.io Read 21 Oct 2026
Passes your subnet (ECS): Supports EDNS Client Subnet but passes an address from roughly the same location instead of your own subnet. adguard-dns.io Read 21 Oct 2026
DNSSEC: not stated on the operator’s pages. Checked adguard-dns.io
Independent audit: not stated on the operator’s pages.

Filtering options

Option	IPv4	What it does
Default	`94.140.14.14` `94.140.15.15`	Blocks ads and trackers; the privacy policy adds malware
Non-filtering	`94.140.14.140` `94.140.14.141`	No blocking
Family protection	`94.140.14.15` `94.140.15.16`	Blocks ads, trackers and adult content, and enforces Safe Search / Safe Mode

Operator documentation · AdGuard DNS IP ranges

Control D

ControlD Inc · Canada

IPv4: 76.76.2.0
76.76.10.0
IPv6: 2606:1a40::0
2606:1a40:1::0
DNS over HTTPS: https://freedns.controld.com/p0
DNS over TLS: p0.freedns.controld.com

What it logs: Account profiles store per-query data only with Full Analytics on; the free resolvers' page makes no logging statement. docs.controld.com Read 21 Oct 2026
Passes your subnet (ECS): On account profiles EDNS Client Subnet is off unless the user turns it on; the free resolvers' behaviour is not stated. docs.controld.com Read 21 Oct 2026
DNSSEC: Validates by default; a profile option can switch validation off for troubleshooting. docs.controld.com Read 21 Oct 2026
Independent audit: not stated on the operator’s pages.

Filtering options

Option	IPv4	What it does
Malware (p1)	`76.76.2.1` `76.76.10.1`	Malware blocklist (name only)
Ads & Tracking (p2)	`76.76.2.2` `76.76.10.2`	Ads and tracking blocklist (name only)
Social (p3)	`76.76.2.3` `76.76.10.3`	Social media blocklist (name only)
Family Friendly	`76.76.2.4` `76.76.10.4`	Family-friendly filtering (name only)
Uncensored	`76.76.2.5` `76.76.10.5`	Uncensored resolver (name only)

The addresses above are the free unfiltered resolver (p0); the filtered presets follow.

Operator documentation

CleanBrowsing

CleanBrowsing · United States

IPv4: 185.228.168.168
185.228.169.168
IPv6: 2a0d:2a00:1::
2a0d:2a00:2::
DNS over HTTPS: https://doh.cleanbrowsing.org/doh/family-filter/
DNS over TLS: family-filter-dns.cleanbrowsing.org

What it logs: The free filters do not log personally identifiable information such as the client IP; only anonymous aggregate data is processed. cleanbrowsing.org Read 21 Oct 2026
Passes your subnet (ECS): not stated on the operator’s pages. Checked cleanbrowsing.org
DNSSEC: One CleanBrowsing page says its resolvers validate DNSSEC on all queries; another says DNSSEC does not apply to resolver services. cleanbrowsing.org Read 21 Oct 2026
Independent audit: not stated on the operator’s pages.

Filtering options

Option	IPv4	What it does
Family Filter	`185.228.168.168` `185.228.169.168`	Blocks adult content, proxy/VPN domains and mixed-content sites, enforces SafeSearch, and blocks malicious and phishing domains
Adult Filter	`185.228.168.10` `185.228.169.11`	Blocks adult content and malicious domains, but not proxies/VPNs or mixed-content sites
Security Filter	`185.228.168.9` `185.228.169.9`	Security only: phishing, spam, malware and malicious domains; does not block adult content

Every free CleanBrowsing resolver filters; there is no unfiltered one. The addresses above are the Family Filter.

Operator documentation

NextDNS

NextDNS Inc. · Not stated

IPv4: —
IPv6: —
DNS over HTTPS: https://dns.nextdns.io
DNS over TLS: —

What it logs: Nothing is logged unless the user turns logs on; retention runs from one hour to two years and the storage region is the user's choice. nextdns.io Read 21 Oct 2026
Passes your subnet (ECS): Uses its own EDNS Client Subnet implementation which, NextDNS says, does not expose the client IP to authoritative servers. nextdns.io Read 21 Oct 2026
DNSSEC: DNSSEC validation is listed as a feature; whether it is on by default is not stated. nextdns.io Read 21 Oct 2026
Independent audit: not stated on the operator’s pages.

Account-based: each configuration gets its own DoH path, DoT hostname and addresses, shown after sign-in. 45.90.28.0 appears in NextDNS's own documentation only as an example bootstrap address.

Operator documentation

Which resolver am I using?

Your device, browser or VPN can each choose a resolver, and the one that answers is not always the one you set. The DNS Leak Test shows which resolvers actually answered for this browser and who runs them; with a VPN on, they should belong to the VPN.

Sources

Every statement above comes from the operator’s own documentation, read 21 Oct 2026, and links to it. “Not stated” means we looked on the linked page and found nothing; it is not a finding about the service. A script re-reads each source weekly. How the data pages are built.