Public DNS Resolvers
The resolvers our DNS propagation check asks, with the details their operators publish, and whether each one answers right now.
| Resolver | Addresses | Encrypted DNS | Validates DNSSEC | Answer from our server |
|---|---|---|---|---|
| Cloudflare |
| yes | 18 ms | |
| Google Public DNS |
| yes | 18 ms | |
| Quad9 |
| yes | 8 ms | |
| Cisco OpenDNS |
| yes | 17 ms | |
| AdGuard DNS (non-filtering) |
| yes | 21 ms | |
| Control D (unfiltered) |
| yes | 19 ms |
Measured from our server at Oct 30, 2026, 8:42 PM, at most every five minutes: the round trip for ietf.org to each resolver's first IPv4 address, and DNSSEC validation — a validating resolver authenticates ietf.org and refuses dnssec-failed.org, whose signatures are deliberately broken. It says whether a service answers, not how fast it will be for you: your queries reach the nearest node of each operator's anycast network.
Addresses and encrypted-DNS endpoints as published by each operator (checked October 2026). Where an operator also runs filtering addresses, the unfiltered ones are listed.
Your provider's resolvers
Unless you change it, your router or phone uses the resolvers your internet provider hands out with DHCP. Their addresses differ by network and are not listed here. The DNS lookup tool shows which resolver answered our own query; to see yours, run a lookup on your device (nslookup example.com, or resolvectl status on Linux).
Choosing a resolver
A resolver sees every name your devices look up. Prefer an operator whose privacy policy you have read, use DNS over HTTPS or TLS where your device supports it, and pick a validating resolver if you rely on DNSSEC. Some networks — workplaces, schools, hotel and public Wi-Fi — require their own resolver; changing it there can break access.
A recursive resolver is the DNS server that answers your device’s questions: it walks from the root zone down to the domain’s own name servers, caches the answer and hands it back. Every website visit starts with one.
By default your device uses the resolver your internet provider assigns. Public resolvers are an alternative run by other operators. They differ in four ways that matter:
- Addresses. Each has easy IPv4 and IPv6 addresses, announced by anycast from many locations, so you reach a nearby node.
- Encryption. Classic DNS travels unencrypted over UDP port 53. DNS over TLS (DoT, port 853) and DNS over HTTPS (DoH) encrypt the questions between your device and the resolver.
- DNSSEC validation. A validating resolver checks DNSSEC signatures and refuses tampered answers for signed zones. It cannot help for unsigned zones — including every name under .ae, which is not signed today.
- Filtering. Some addresses block malware or adult content; the ones listed here are the operators’ unfiltered addresses where they offer a choice.
The live column is measured from our server, not from you, and only tells you whether each service answers right now.
Frequently asked questions
Will a public resolver make my internet faster?
Sometimes slightly, often not. Your provider's resolver is usually closer; a public one may have a warmer cache. Measure from your own device before deciding.
Does changing DNS hide my browsing?
Encrypted DNS hides the names you look up from the network in between, but the resolver operator still sees them, and your provider still sees the addresses you connect to.
Can I use these resolvers in the UAE?
Network policies differ between providers and networks, and some networks require their own resolver. Check your provider's terms and your organisation's IT policy.