Your DNS is probably doing nothing to protect you — the Reel is right about that. The fix depends on what you want from it. Want ads and trackers blocked on every device with one change? AdGuard DNS or Control D's p2 tier. Want the strongest security with the least logging? Quad9. Want the fastest resolver with independently audited privacy? Cloudflare's 1.1.1.1. There is no single best DNS for privacy and security in 2026 — there is a best DNS for each job, and this guide compares all six on the same terms: what they block, what they log, and how fast they are. Every IP address below was re-checked against the providers' own documentation on 12 November 2026.
What DNS does — and why the default leaves you exposed
DNS is the internet's phone book. Every time you type a domain name, your device asks a DNS resolver to translate it into an IP address. The resolver you use is usually your internet provider's, set automatically when you connect — and that default does three things you probably do not want. First, it sees every domain you look up, and most ISP resolvers keep records of those lookups. Second, it blocks nothing: known malware, phishing and tracker domains resolve exactly like everything else. Third, plain DNS is unencrypted, so anyone on the network path — your ISP, a public Wi-Fi operator — can see which domains you request.
Switching resolvers changes all three. A filtering resolver refuses to answer for domains on its blocklists, so the ad, tracker or malware server is never contacted. A privacy-respecting resolver keeps no record tied to you. And an encrypted resolver (DNS over HTTPS, DNS over TLS or DNS over QUIC) hides the lookups themselves from the network. None of this is magic, and the limits matter — they are covered in their own section below — but for most people, changing DNS is the highest-value privacy change you can make in five minutes, because it works on every app on the device, not just the browser.
What the Reel gets right — and where it stops
Correction 2 — The Reel's "switch to AdGuard or Control D" skips two providers that win on their own terms. Quad9 blocks malware and phishing with threat intelligence from 25+ feeds, records no IP addresses, and is a Swiss nonprofit under Swiss privacy law — the strongest privacy story of any free resolver. Cloudflare's 1.1.1.1 is the fastest resolver in most tests and the only free one whose logging claims are independently audited by KPMG. Neither blocks ads, which is presumably why the Reel left them out — but a guide that only names the ad-blockers hides the two best answers for security and speed.
Correction 3 — The Reel's IP addresses check out, with one important clarification. AdGuard 94.140.14.14, Quad9 9.9.9.9, Cloudflare 1.1.1.1 and Google 8.8.8.8 are all correct. Control D's 76.76.2.2 is also correct — but it is specifically the p2 tier (malware + ads + trackers), not "Control D" in general: Control D publishes a different address for each filter level, and using the wrong one gives you a different filter. The Reel also shows CleanBrowsing without an address; its Security filter is 185.228.168.9 and 185.228.169.9. Every address in this article was verified against the providers' own pages before writing.
AdGuard DNS — best for blocking ads and trackers
AdGuard DNS is a free public resolver that blocks ads, trackers and malicious domains at the DNS level, before they load — no app to install, no account needed. It runs three public servers that differ only in how much they block, and you must use both addresses of the same server: never mix a Default address with a Family address, because devices do not query resolvers in strict order and the filter would leak.
Default (ads, trackers, phishing): 94.140.14.14 and 94.140.15.15. Android Private DNS hostname: dns.adguard-dns.com. Family protection (the above, plus adult sites and enforced Safe Search): 94.140.14.15 and 94.140.15.16, hostname family.adguard-dns.com. Non-filtering (nothing blocked, encryption only): 94.140.14.140 and 94.140.14.141, hostname unfiltered.adguard-dns.com. All three support DNS over HTTPS, DNS over TLS and DNS over QUIC. On logging, AdGuard says its public servers keep no personal data — only aggregated anonymous statistics. The honest weakness: in the BitLaunch DoH latency test below, AdGuard was the slowest of the six at 107.9 ms average round-trip — a datacenter test, so your own connection may differ, but it is the one resolver here that can feel slow. And like every DNS filter, it cannot remove ads served from the site's own domain.
Control D — best for picking a preset filter level
Control D comes from the Toronto-based team behind the Windscribe VPN, and its free service is built around preset tiers: you point a device at one address and get that filter, nothing more. The tiers, from Control D's own documentation: p0 — Unfiltered: 76.76.2.0 and 76.76.10.0. p1 — Malware only: 76.76.2.1 and 76.76.10.1. p2 — Ads and tracking (plus malware): 76.76.2.2 and 76.76.10.2 — this is the address in the Reel, and it is the right one if ads are what you want gone. p3 — Social (adds social media blocking): 76.76.2.3 and 76.76.10.3. Family (malware, ads, trackers, adult and drug sites): 76.76.2.4 and 76.76.10.4, hostname family.freedns.controld.com. Encrypted endpoints follow the pattern https://freedns.controld.com/p2 for DoH and p2.freedns.controld.com for DoT and DoQ. On logging, Control D states its free resolvers store no logs — no browsing history, no timestamps, no query logs. The paid plans (Some Control at $3 a month, Full Control at $6 a month) add custom rules, per-device profiles and a proxy. Best for: anyone who wants a ready-made filter level without an account, or the most control if you are willing to pay.
Quad9 — best for security and privacy
Quad9 is the security pick, and the privacy pick, of this list. It is a Swiss nonprofit foundation — the Quad9 Foundation — operating under Swiss privacy law, with no commercial incentive to log what you look up. Its addresses are 9.9.9.9 and 149.112.112.112, and the Android Private DNS hostname is dns.quad9.net. It blocks known-malicious and phishing domains using threat intelligence from 25+ feeds, including IBM X-Force, and validates DNSSEC on all responses. What it does not do is block ads: if ad blocking is the goal, Quad9 is the wrong pick, and AdGuard or Control D p2 is the right one. On logging, Quad9 states it does not collect or record user IP addresses. It was also the fastest resolver in the BitLaunch DoH test below, at 10.1 ms average round-trip. One warning with a date on it: on 22 October 2026, Quad9 announced it will stop serving users located in France on 24 November 2026, after a Paris court ordered it to block 58 domains in a case brought by the sports broadcaster beIN. Quad9 refuses to alter its answers for anyone, an appeal is pending, and it says about 20 similar cases are waiting in France. If you are in France, switch to another resolver from this guide before 24 November; outside France, nothing changes.
Cloudflare — best for speed, with audited privacy
Cloudflare's 1.1.1.1 is the resolver most people reach for first, and for two good reasons: it is the fastest public resolver in most global tests, and its privacy claims are the only ones here checked by an independent auditor. The addresses are 1.1.1.1 and 1.0.0.1, and the Android Private DNS hostname is one.one.one.one. The catch is the one the Reel glosses over: the base 1.1.1.1 filters nothing — no ad blocking, no tracker blocking. If you want filtering from Cloudflare, use the Families variants: 1.1.1.2 blocks malware, and 1.1.1.3 blocks malware plus adult content. On logging, Cloudflare truncates client IP addresses and deletes the truncated address within 25 hours, never sells or shares resolver data, and submits its practices to KPMG — the most recent examination report was published in 2026 and covers calendar 2024. In the BitLaunch DoH test it measured 10.9 ms, effectively tied with Quad9. Best for: anyone who wants a fast, audited resolver and does not need ad blocking — or who pairs it with a browser ad blocker for the ads.
CleanBrowsing — best for family filtering
CleanBrowsing is a US-based filtering service built for households and schools, with three free filters of rising strictness. Security filter (malware, phishing, spam — no adult filtering): 185.228.168.9 and 185.228.169.9, hostname security-filter-dns.cleanbrowsing.org. Adult filter (adult content plus all security threats): 185.228.168.10 and 185.228.169.10. Family filter (strictest — adult content, enforced SafeSearch, plus VPN, proxy and mixed-content domains): 185.228.168.168 and 185.228.169.168, hostname family-filter-dns.cleanbrowsing.org. All three support DoH and DoT. On logging, CleanBrowsing states it logs no IP addresses, though anonymised aggregate query data may be kept. Two practical notes: the free service is throttled and has no support, and you must never pair a CleanBrowsing address with an unfiltered secondary such as 8.8.8.8 — devices send lookups to either server, so blocked sites would load some of the time. Best for: a household that wants set-and-forget filtering for kids.
Google DNS — fast and reliable, but not a privacy pick
Google Public DNS — 8.8.8.8 and 8.8.4.4 — is the oldest and most widely used public resolver, and it is genuinely fast and reliable. It blocks nothing and filters nothing: no ads, no trackers, no malware. On logging, Google says it deletes IP-linked query logs within roughly 24–48 hours, but it is still a Google service, and the resolver sees every domain you look up. That makes it a performance pick, not a privacy pick: use it when raw reliability matters and you do not care about blocking, and choose Quad9 or Cloudflare when privacy is the point. It is in this guide because the Reel shows it, and because it is the default many people already have — knowing what it does not do is the point.
The six compared, side by side
| Provider | IPv4 (primary) | Blocks ads | Blocks malware | Logging | Best for |
|---|---|---|---|---|---|
| AdGuard DNS | 94.140.14.14 | Yes | Yes | No personal data; aggregated anonymous stats only | Ad + tracker blocking |
| Control D p2 | 76.76.2.2 | Yes | Yes | No logs on free tier | Preset filter levels |
| Quad9 | 9.9.9.9 | No | Yes | No IP addresses recorded | Security + privacy |
| Cloudflare | 1.1.1.1 | No (1.1.1.2/1.1.1.3: malware only) | Only on 1.1.1.2 / 1.1.1.3 | Truncated IPs deleted within 25h; KPMG-audited | Speed + audited privacy |
| CleanBrowsing Security | 185.228.168.9 | No | Yes | No IP logging; anonymised aggregate data kept | Family filtering |
| Google DNS | 8.8.8.8 | No | No | IP-linked logs deleted within ~24–48h | Raw reliability |
How fast is each one?
Speed matters, but it is the most location-dependent number in DNS: the fastest resolver from one city is rarely the fastest from another. The best public comparison comes from BitLaunch, which ran DNS-over-HTTPS tests from 22 of its VPS servers across 17 countries. The average round-trip latency, lowest first: Quad9 10.1 ms, NextDNS 10.5 ms, Cloudflare 10.9 ms, Control D 27.7 ms, OpenDNS 38.4 ms, Google 64.2 ms, CleanBrowsing 64.7 ms, AdGuard 107.9 ms. Treat this as one test's results, not a universal ranking — BitLaunch notes the tests ran from datacenters, not home connections, so they may not match your real-world experience. The practical reading: Quad9 and Cloudflare are fast everywhere, Control D is mid-pack, and AdGuard trades speed for its filtering.
The pick, by need
Maximum security, minimum logging: Quad9 (9.9.9.9). A Swiss nonprofit that records no IP addresses, blocks malware and phishing from 25+ threat feeds, and validates DNSSEC — with the France exception above. If you live in France, Cloudflare 1.1.1.2 is the closest replacement.
Fastest, with proof: Cloudflare 1.1.1.1. Effectively tied with Quad9 on speed, and the only free resolver whose logging claims are independently audited. Use 1.1.1.2 if you also want malware blocking, and pair it with a browser ad blocker for the ads it does not touch.
Kids and the household: CleanBrowsing Family (185.228.168.168) or AdGuard Family (94.140.14.15). CleanBrowsing is the stricter of the two — it also blocks VPN and proxy sites — while AdGuard Family adds ad blocking on top of adult filtering.
Maximum control: Control D's paid plans, which add custom rules and per-device profiles. The other well-known custom-rules option is NextDNS, which measured 10.5 ms in the same BitLaunch test. Either way, you are paying for control, not for better blocking.
How to change your DNS, step by step
Changing DNS is a settings change, not an install, and it is reversible in seconds. Pick your provider from the sections above, then use both of its addresses — primary and secondary — from the same filter, never one filtered address and one unfiltered address.
Windows 11: Settings → Network & internet → Wi-Fi (or Ethernet) → your network → DNS server assignment → Edit → Manual → turn on IPv4 → enter the primary and secondary addresses → Save.
macOS: System Settings → Network → Wi-Fi → Details next to your network → DNS → click + under DNS Servers → enter both addresses → OK.
Android: Settings → Network & internet → Private DNS → Private DNS provider hostname → type the provider's hostname (dns.adguard-dns.com, dns.quad9.net, one.one.one.one, p2.freedns.controld.com or security-filter-dns.cleanbrowsing.org) → Save. This encrypts DNS across every network, including mobile data.
iPhone: Settings → Wi-Fi → tap the (i) next to your network → Configure DNS → Manual → Add Server → enter both addresses → Save. iOS has no system-wide Private DNS hostname like Android, so this is per network; for encrypted DNS on iOS, use the provider's app or a configuration profile.
Router (covers every device on the network): open the router admin page, find the WAN or Internet DNS settings, replace the ISP addresses with your chosen pair, and save. This is the best option for a household: one change protects every device, including smart TVs and consoles that have no DNS setting of their own.
What DNS filtering cannot do
DNS filtering is powerful, but it works at the name level — and that sets hard limits. It cannot remove first-party ads. DNS sees domain names, not full URLs, so an ad served from the site's own domain (YouTube ads are the classic example) passes straight through. For those, you still need a browser content blocker. It does not hide your browsing from your ISP unless the transport is encrypted. Plain DNS queries are visible on the network; use DNS over HTTPS or DNS over TLS — Android's Private DNS setting, your browser's secure DNS option, or a router that supports DoT — to close that gap. It is not a VPN. Changing DNS does not hide your IP address, change your location, or encrypt your traffic; a VPN is a different tool for a different job. And it can break things. Over-aggressive blocklists occasionally block a site or app you need. The fix is to drop one tier — Control D p1 instead of p2, AdGuard Default instead of Family — or to use the provider's non-filtering variant while you check.
One service that no longer belongs on any recommendation list: Mullvad DNS shut down on 2 November 2026. Mullvad announced the closure on 3 September 2026 and now points its users to Quad9, which it financially supports. If you still have a Mullvad DNS address configured anywhere, replace it with one of the six above.
Related reading: uv: the Python package manager that replaces pip, venv, pyenv and pip-tools · Gemini API CLI: the complete guide · Asad Webs free tools
Frequently asked questions
Which DNS is best for privacy?
Quad9, for the strongest story: a Swiss nonprofit that records no IP addresses and blocks malware. Cloudflare 1.1.1.1 is the runner-up, with the advantage that its logging claims are independently audited by KPMG. If you also want ads blocked, AdGuard DNS or Control D p2 trade a little privacy paperwork for a lot of blocking — both state they keep no logs on their free tiers.
Does changing DNS block YouTube ads?
No. YouTube serves its ads from its own domains, and DNS can only block by domain name, not by URL. DNS filtering stops third-party ad and tracker domains across every app; for YouTube ads specifically, you need a browser content blocker.
Is changing DNS safe?
Yes. It is a settings change that takes seconds to reverse — put the old addresses back, or set the field back to automatic. The only risk is typing an address wrong, so copy the pair from the provider's own page, and always use both addresses from the same filter.
Will changing DNS make my internet faster?
Sometimes, slightly. A faster resolver answers lookups a few milliseconds sooner, which can make pages feel snappier — but the big wins from switching DNS are blocking and privacy, not raw speed. If your current DNS is already fast, you will not notice a speed difference.
Should I set the same DNS on my phone and my router?
Yes, if you can. The router setting covers every device at home, including ones with no DNS setting of their own. On Android, the Private DNS hostname also covers mobile data when you leave the house. Set the same provider in both places so the filter behaves the same everywhere.
What happened to Mullvad DNS?
Mullvad shut its public DNS service down on 2 November 2026 and now points users to Quad9. If you still have a Mullvad DNS address configured, replace it with one of the six resolvers in this guide.
Be the first to share a useful question or thought.