DNS resolvers
Google Public DNS privacy rating
Free public DNS resolver run by Google at 8.8.8.8 and 8.8.4.4 that validates DNSSEC and supports DNS over HTTPS and DNS over TLS.
Summary
Google Public DNS scores 45 out of 100 (grade D) on the DNS resolvers criteria. It meets 5 of 10 criteria: transparency report, tells users about requests, security headers, Encrypted DNS and DNSSEC validation. It partly meets no query logs. It does not meet open source, no trackers or telemetry, no ads or data sales and independent audit. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: Mozilla HTTP Observatory grade A+.
Score 45 out of 100. How scoring works
Criteria
- No
-
No
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
The documentation website loads Google Analytics.
-
No
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Free service funded by Google's advertising business. The privacy page states DNS logs are not combined with other Google data for ads.
-
No
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
No independent audit is published.
-
Yes
Transparency report Weight 2 of 3
Does the provider regularly publish how many government and legal requests it receives and how it responds?
Google publishes counts of government requests for user data twice a year.
-
Yes
Tells users about requests Weight 1 of 3
Does the provider promise to tell users about requests for their data, unless a court forbids it?
Google states it notifies users before disclosing their information unless prohibited by law or in emergencies.
-
Yes
Encrypted DNS Weight 3 of 3
Are DNS over HTTPS and DNS over TLS supported?
DNS over HTTPS and DNS over TLS are both supported.
-
Partial
No query logs Weight 3 of 3
Are queries stored without IP addresses, and is this independently audited?
Temporary logs with full IP addresses are kept for 24 to 48 hours. Sampled permanent logs keep only city or region. Not audited.
-
Yes
DNSSEC validation Weight 1 of 3
Does the resolver validate DNSSEC?
Google Public DNS is a validating resolver for all DNSSEC-signed zones.
Automated tests
-
Not tested yet
TLS configuration Weight 2 of 3
Does the website pass the Qualys SSL Labs test with a grade of A or better?
Could not test: No endpoint could be graded
-
Yes
Security headers Weight 1 of 3
Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
Grade A+ (100/100+)
-
Not tested yet
Modern web standards Weight 1 of 3
Does the website score 90% or higher on the Internet.nl website test?
Not tested yet.