# DNS resolvers privacy ratings

Public DNS resolvers that look up domain names for devices.

| Name | Grade | Jurisdiction | Description |
| --- | --- | --- | --- |
| [Unbound](https://privacyratings.com/dns-resolvers/unbound/) | B (85/100) | Netherlands (Nine Eyes) | Validating, recursive and caching DNS resolver from NLnet Labs for running your own resolver, with DNS over TLS and DNS over HTTPS support. |
| [Cloudflare](https://privacyratings.com/dns-resolvers/cloudflare/) | C (72/100) | United States (Five Eyes) | Public DNS resolver from Cloudflare with DNS over HTTPS and TLS, DNSSEC validation, and privacy commitments examined by KPMG. |
| [Digitale Gesellschaft DNS](https://privacyratings.com/dns-resolvers/digitale-gesellschaft-dns/) | C (67/100) | Switzerland | Public DoH and DoT resolver run by Digitale Gesellschaft, a Swiss non-profit digital rights association. It validates DNSSEC, uses no blocklists and publishes its live configuration. |
| [DNS.SB](https://privacyratings.com/dns-resolvers/dns-sb/) | C (65/100) | Germany (Fourteen Eyes) | Free public DNS resolver operated by xTom GmbH in Germany on an anycast network. It supports DoH and DoT, validates DNSSEC and does not send EDNS Client Subnet. |
| [LibreDNS](https://privacyratings.com/dns-resolvers/libredns/) | C (65/100) | Greece | Public encrypted DNS resolver run by the volunteer LibreOps collective, with DoH and DoT endpoints and an optional ad-blocking endpoint. |
| [Quad9](https://privacyratings.com/dns-resolvers/quad9/) | C (65/100) | Switzerland | Public DNS resolver run by the Swiss non-profit Quad9 Foundation that blocks known malicious domains and validates DNSSEC. |
| [AdGuard](https://privacyratings.com/dns-resolvers/adguard/) | C (63/100) | Cyprus | Public DNS resolver from AdGuard that blocks ads, trackers and malicious domains, with open-source server software and DoH, DoT, DoQ and DNSCrypt support. |
| [Control D](https://privacyratings.com/dns-resolvers/control-d/) | C (63/100) | Canada (Five Eyes) | DNS resolver service from ControlD Inc. in Canada, founded by the team behind Windscribe. It offers free filtering resolvers and paid plans with custom rules, over legacy DNS, DoH, DoT and DNS over QUIC. |
| [Mullvad DNS](https://privacyratings.com/dns-resolvers/mullvad-dns/) | C (63/100) | Sweden (Fourteen Eyes) | Free encrypted DNS resolver from Mullvad with optional ad, tracker and malware blocking. Mullvad has announced it is shutting the public service down. |
| [NextDNS](https://privacyratings.com/dns-resolvers/nextdns/) | C (61/100) | United States (Five Eyes) | Configurable DNS resolver that blocks ads, trackers and malicious domains, with optional parental controls and per-user query logs. |
| [UncensoredDNS](https://privacyratings.com/dns-resolvers/uncensoreddns/) | C (61/100) | Denmark (Nine Eyes) | Free public DNS resolver in Denmark, run by an individual, that does not apply censorship filters. It offers anycast and unicast servers over plain DNS, DoT and DoH. |
| [Applied Privacy DNS](https://privacyratings.com/dns-resolvers/applied-privacy-dns/) | D (57/100) | Austria | Public DNS over HTTPS and DNS over TLS resolver run by the Foundation for Applied Privacy, a non-profit association in Vienna. It validates DNSSEC and uses QNAME minimisation. |
| [BlahDNS](https://privacyratings.com/dns-resolvers/blahdns/) | D (54/100) | Unknown | Hobby ad-blocking DNS resolver run by one person, with servers in Singapore and Germany and support for DoH, DoT, DoQ and DNSCrypt. |
| [Google Public DNS](https://privacyratings.com/dns-resolvers/google-public-dns/) | D (45/100) | United States (Five Eyes) | Free public DNS resolver run by Google at 8.8.8.8 and 8.8.4.4 that validates DNSSEC and supports DNS over HTTPS and DNS over TLS. |
| [Clean Browsing](https://privacyratings.com/dns-resolvers/clean-browsing/) | D (43/100) | United States (Five Eyes) | DNS filtering service with free family, adult and security filters and paid custom filtering, supporting DoH, DoT and DNSCrypt. |
| [DNS4EU](https://privacyratings.com/dns-resolvers/dns4eu/) | D (41/100) | Czechia | Public DNS resolver co-funded by the European Union and operated by a consortium led by Whalebone in the Czech Republic. It offers protective, child-safe, ad-blocking and unfiltered variants over DoH and DoT. |
| [OpenNIC](https://privacyratings.com/dns-resolvers/opennic/) | D (41/100) | Unknown | Volunteer-run alternative DNS root with public resolvers that answer for both ICANN domains and OpenNIC's own top-level domains such as .libre and .oss. |
| [OpenDNS](https://privacyratings.com/dns-resolvers/opendns/) | F (37/100) | United States (Five Eyes) | Public DNS resolver from Cisco at 208.67.222.222 and 208.67.220.220, with optional content filtering and a free home account for managing filters. |

## Criteria

- **Open source** (weight 3): Is all the source code needed to run the product public?
- **No trackers or telemetry** (weight 3): Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
- **No ads or data sales** (weight 2): Is the product funded without advertising, ad targeting or selling user data?
- **Independent audit** (weight 2): Has an independent security or privacy audit been published within the last three years?
- **Transparency report** (weight 2): Does the provider regularly publish how many government and legal requests it receives and how it responds?
- **Tells users about requests** (weight 1): Does the provider promise to tell users about requests for their data, unless a court forbids it?
- **TLS configuration** (weight 2, automated): Does the website pass the Qualys SSL Labs test with a grade of A or better?
- **Security headers** (weight 1, automated): Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
- **Modern web standards** (weight 1, automated): Does the website score 90% or higher on the Internet.nl website test?
- **Encrypted DNS** (weight 3): Are DNS over HTTPS and DNS over TLS supported?
- **No query logs** (weight 3): Are queries stored without IP addresses, and is this independently audited?
- **DNSSEC validation** (weight 1): Does the resolver validate DNSSEC?

Source: https://privacyratings.com/dns-resolvers/