DNS resolver privacy ratings

Public DNS resolvers that look up domain names for devices.

18 DNS resolvers are rated against 12 public criteria, and 18 have enough evidence for a letter grade. Of the 16 with a known jurisdiction, 6 are based in a Five Eyes country, and 10 in the wider Fourteen Eyes.

Open-source DNS resolvers only · Criteria for this category · Suggest an addition · Markdown

DNS resolvers privacy ratings, sorted by pick and then by grade
Name	Grade	Score	Data	Jurisdiction	Open source	No trackers or telemetry	No ads or data sales	Independent audit	Transparency report	Tells users about requests	Encrypted DNS	No query logs	DNSSEC validation	TLS configuration	Security headers	Modern web standards
Unbound Validating, recursive and caching DNS resolver from NLnet Labs for running your own resolver, with DNS over TLS and DNS over HTTPS support.	Grade B	85	100%	Netherlands Nine Eyes	Yes	Yes	Yes	Partial	Not applicable	Not applicable	Yes	Partial	Yes	Not applicable	Not applicable	Not applicable
Cloudflare Public DNS resolver from Cloudflare with DNS over HTTPS and TLS, DNSSEC validation, and privacy commitments examined by KPMG.	Grade C	72	100%	United States Five Eyes	No	No	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Partial	Not tested yet
Digitale Gesellschaft DNS Public DoH and DoT resolver run by Digitale Gesellschaft, a Swiss non-profit digital rights association. It validates DNSSEC, uses no blocklists and publishes its live configuration.	Grade C	67	100%	Switzerland Outside Eyes	Partial	Yes	Yes	No	Yes	No	Yes	Partial	Yes	Partial	Partial	Not tested yet
DNS.SB Free public DNS resolver operated by xTom GmbH in Germany on an anycast network. It supports DoH and DoT, validates DNSSEC and does not send EDNS Client Subnet.	Grade C	65	100%	Germany Fourteen Eyes	No	Yes	Yes	No	Yes	No	Yes	Partial	Yes	Yes	Partial	Not tested yet
LibreDNS Public encrypted DNS resolver run by the volunteer LibreOps collective, with DoH and DoT endpoints and an optional ad-blocking endpoint.	Grade C	65	100%	Greece Outside Eyes	Yes	Yes	Yes	No	No	No	Yes	Partial	No	Yes	Partial	Not tested yet
Quad9 Public DNS resolver run by the Swiss non-profit Quad9 Foundation that blocks known malicious domains and validates DNSSEC.	Grade C	65	100%	Switzerland Outside Eyes	No	Yes	Yes	No	Yes	No	Yes	Partial	Yes	Yes	Partial	Not tested yet
AdGuard Public DNS resolver from AdGuard that blocks ads, trackers and malicious domains, with open-source server software and DoH, DoT, DoQ and DNSCrypt support.	Grade C	64	100%	Cyprus Outside Eyes	Yes	Yes	Yes	No	No	No	Yes	Partial	Yes	Not tested yet	No	Not tested yet
Control D DNS resolver service from ControlD Inc. in Canada, founded by the team behind Windscribe. It offers free filtering resolvers and paid plans with custom rules, over legacy DNS, DoH, DoT and DNS over QUIC.	Grade C	63	100%	Canada Five Eyes	Partial	Yes	Yes	No	No	No	Yes	Partial	Yes	Yes	Partial	Not tested yet
Mullvad DNS Free encrypted DNS resolver from Mullvad with optional ad, tracker and malware blocking. Mullvad has announced it is shutting the public service down.	Grade C	63	100%	Sweden Fourteen Eyes	No	Yes	Yes	No	Partial	No	Yes	Partial	Yes	Yes	Yes	Not tested yet
NextDNS Configurable DNS resolver that blocks ads, trackers and malicious domains, with optional parental controls and per-user query logs.	Grade C	61	100%	United States Five Eyes	Partial	Yes	Yes	No	No	No	Yes	Partial	Yes	Yes	No	Not tested yet
UncensoredDNS Free public DNS resolver in Denmark, run by an individual, that does not apply censorship filters. It offers anycast and unicast servers over plain DNS, DoT and DoH.	Grade C	61	100%	Denmark Nine Eyes	No	Yes	Yes	No	Partial	No	Yes	Partial	Yes	Yes	Partial	Not tested yet
Applied Privacy DNS Public DNS over HTTPS and DNS over TLS resolver run by the Foundation for Applied Privacy, a non-profit association in Vienna. It validates DNSSEC and uses QNAME minimisation.	Grade D	57	100%	Austria Outside Eyes	No	Yes	Yes	No	No	No	Yes	Partial	Yes	Yes	Partial	Not tested yet
BlahDNS Hobby ad-blocking DNS resolver run by one person, with servers in Singapore and Germany and support for DoH, DoT, DoQ and DNSCrypt.	Grade D	54	100%	–	No	Yes	Yes	No	No	No	Yes	Partial	Yes	Yes	No	Not tested yet
Google Public DNS Free public DNS resolver run by Google at 8.8.8.8 and 8.8.4.4 that validates DNSSEC and supports DNS over HTTPS and DNS over TLS.	Grade D	45	100%	United States Five Eyes	No	No	No	No	Yes	Yes	Yes	Partial	Yes	Not tested yet	Yes	Not tested yet
Clean Browsing DNS filtering service with free family, adult and security filters and paid custom filtering, supporting DoH, DoT and DNSCrypt.	Grade D	43	100%	United States Five Eyes	No	No	Yes	No	No	No	Yes	Partial	Yes	Yes	Partial	Not tested yet
DNS4EU Public DNS resolver co-funded by the European Union and operated by a consortium led by Whalebone in the Czech Republic. It offers protective, child-safe, ad-blocking and unfiltered variants over DoH and DoT.	Grade D	41	100%	Czechia Outside Eyes	No	No	Yes	No	No	No	Yes	Partial	Yes	Yes	No	Not tested yet
OpenNIC Volunteer-run alternative DNS root with public resolvers that answer for both ICANN domains and OpenNIC's own top-level domains such as .libre and .oss.	Grade D	41	100%	–	Partial	Partial	Yes	No	No	No	Partial	Partial	Partial	Partial	No	Not tested yet
OpenDNS Public DNS resolver from Cisco at 208.67.222.222 and 208.67.220.220, with optional content filtering and a free home account for managing filters.	Grade F	37	100%	United States Five Eyes	No	No	Yes	No	Yes	Yes	Partial	No	Yes	Partial	No	Not tested yet

Questions

What is the most private option among DNS resolvers?

No pick has been made yet. The table above is sorted by score, based on public evidence.

How are DNS resolvers rated?

Each entry answers 12 questions: open source, no trackers or telemetry, no ads or data sales, independent audit, transparency report, tells users about requests, TLS configuration, security headers, modern web standards, Encrypted DNS, no query logs and DNSSEC validation. Answers need links to evidence. See the full criteria.

Does jurisdiction matter?

Jurisdiction decides which laws can compel a provider to hand over data. Each entry shows its country and whether it is in the Five, Nine or Fourteen Eyes. The data a provider can hand over depends mostly on what it stores and who holds the keys. Read about jurisdictions and the CLOUD Act.