Most of the internet works on a layer nobody ever votes on. Every time a browser asks “where is this website”, the answer comes from somewhere. By default, that somewhere is a server your ISP chose, runs, and reads. You do not sign anything to land on it. You do not click through an agreement. You just plug in a router and the resolver follows.
The three public alternatives have become the default answer to that problem, and I switched about three years ago and never looked back. But what changed for me was not the speed. It was the realization that the default resolver is also a logging pipeline, and that the public alternatives differ mostly in how loud they admit it.
That framing matters more than the speed charts make it sound.
What the resolver actually sees
A DNS resolver (the server your computer asks when you type a website into the address bar) is the front door for every domain you visit. It does not see what you do on the site. It sees which front door you walked through, and when, and from where. That is enough data to build a profile of every household’s news cycle, shopping hours, and bedtime.
The default resolver is run by your ISP for the convenience of getting you online. Most ISPs log the queries at least temporarily. The logs are useful for them (troubleshooting, abuse complaints, occasionally selling to advertisers in aggregate, sometimes selling to law enforcement on a warrant). They are not useful to you.
You do not get a copy of your own DNS logs. You do not get to delete them. You do not get to audit how long they sit on a server in a closet.
Most people do not know DNS is a setting. Switching it does not require calling the provider. The change lives on your router or your device, takes a few minutes, and survives across power outages.
What changes once you switch is not whether the front door is logged. Every resolver logs at least temporarily. What changes is who runs the door, how long the logs persist, whether the logs are sold, and whether the door is allowed to refuse to open for sites flagged as malicious. The three public resolvers below make those four choices differently.
The three numbers you actually have to choose between
Every resolver has at least two IP addresses (a primary IPv4, a backup IPv4, and usually an IPv6 pair). For most people, the decision collapses to one question: do you want speed-and-privacy, do you want filtered, or do you already trust a specific company with everything else.
Speed-and-privacy is what you get from Cloudflare’s 1.1.1.1 (primary) and 1.0.0.1 (backup). Cloudflare runs a content delivery network, so they handle a large slice of the live web’s traffic already. They commissioned a KPMG audit to confirm that they delete the resolver logs within 24 hours and do not sell them. The audits are credible, but the structural conflict of interest is real: a resolver that already serves much of the web gets to see the DNS layer for the same web. For most people this is the right default.
Filtered is what you get from Quad9’s 9.9.9.9 (primary) and 149.112.112.112 (backup). Quad9 is a nonprofit operating out of Switzerland. They pull threat feeds from multiple intelligence sources and reject DNS queries for domains on those feeds. The blocked domains can change hour by hour. A site that loaded at 9 AM may not load at 9 PM. The blocking happens at the resolver, so apps and games that ignore the browser’s safe-browsing list are also protected. The trade is that filtering is sometimes wrong, and you sometimes hit a domain that is not actually dangerous but is flagged as such.
Everything-else is what you get from Google’s 8.8.8.8 (primary) and 8.8.4.4 (backup). Google has run public DNS since 2009 and it is fast, stable, and on every device’s fallback list through Android. The cost is that Google already operates the largest advertising business in the world. Their public DNS service logs some telemetry for performance and abuse monitoring, and a dollar of that telemetry flows back into the ad business that already knows what you searched for, what you watched, and what you bought.
The addresses that matter:
- 1.1.1.1 (Cloudflare, no filter) and 1.0.0.1 (backup)
- 1.1.1.2 (Cloudflare, with malware filter) and 1.0.0.2 (backup)
- 9.9.9.9 (Quad9, filtered) and 149.112.112.112 (backup)
- 8.8.8.8 (Google, with logs) and 8.8.4.4 (backup)
- 2606:4700:4700::1111 and 2620:fe::fe for the IPv6 versions of Cloudflare and Quad9 respectively
Pick two providers (one primary, one backup from a different company), type the addresses into the network settings, flush the local DNS cache, and run a leak-test site to confirm. Total time is roughly five minutes if you have not done it before.
What changes in practice once you switch
The first thing you notice is nothing. Pages still load. Videos still stream. That is the disappointment of any privacy fix: the upside is invisible because the cost was also invisible. Nobody ever sees the query log that did not get written.
What does change is the failure mode. Phishing links stop resolving. The browser shows a server-not-found instead of a fake login screen. That is the cleanest part of the switch and also the part you only notice when it actually fires. Bad links that would have loaded now show a block page. Some of those blocks are correct, some are wrong, and the wrong ones are the cost of the trade.
Streaming sticks, game consoles, and smart-home devices all use the router’s DNS settings, so changing it on the router covers every device in the house including the ones you forgot about. Changing it per device is fine for laptops and phones, but routers and game consoles are easier to set once and forget.
The reason most people never do any of this is that there is nothing to look at afterwards. The benefit is the absence of a log, not the addition of a feature.
How the three providers handle logs differently
The honest accounting is not “no one logs” because everyone logs at least temporarily. The accounting is who logs, how long, who can read them, and whether the company sells the aggregated data to anyone else.
Cloudflare’s published policy is that query data is purged within 24 hours, no records are kept beyond that, and KPMG audits the practice annually. The audit reports are public. They are not a perfect proof: KPMG is paid by Cloudflare, the engagement is narrow, and a malicious operator could in theory log to a side channel. But the structural incentives line up. Cloudflare makes money from selling CDN service to websites, not from selling user data, so the resolver is an entry point to their other business, not a data product in itself.
Quad9’s published policy is similar but with one extra wrinkle: the threat-feed partnership means a domain flagged as malicious gets refused at the resolver, and the block list entries needed to make that refusal work live on Quad9’s servers. Those entries are the data they keep. The block list entries are not tied to who queried them. The query itself, by Quad9’s own stated policy, is not stored in a way that links back to a user.
Google’s 8.8.8.8 publishes a privacy policy that says they keep temporary logs (sampled, not all queries) to monitor for abuse and improve performance. The temporary logs feed into the same machine-learning pipeline that improves most of Google’s other services. Google is also the operator with the most data on its users already, so adding resolver queries to that pile is incremental, not foundational.
For most people this is the cleanest decision tree:
- Already deep in Google’s services and not worried about it: 8.8.8.8 is fine. You have already traded that data.
- Want speed and a credible no-sell promise: 1.1.1.1 or 1.1.1.2 (the latter for filtered).
- Want the strongest filtering at the cost of some legitimate domains getting caught in the net: 9.9.9.9.
Any of the three is a real upgrade over the ISP default, because the ISP default is the resolver you did not choose, you cannot audit, and you have no recourse against. The best choice is the one you actually pick, configured on your router, and walked away from.
Trade-offs
Switching DNS is not free in two specific ways.
First is the in-app mismatch. Some apps hardcode their own resolver and bypass your settings. Comcast’s Xfinity app, certain smart-home skills, and a handful of enterprise VPNs route around the system DNS to enforce their own filtering or to point at a CDN edge. Those queries do not respect your router setting. The address still resolves through the app’s resolver, not yours. The impact is small but real: a few percent of your queries still go through whichever resolver the app chose.
Second is filtering false positives. If you pick Cloudflare’s 1.1.1.2 or Quad9’s 9.9.9.9, you are accepting that some legitimate domains will get flagged. A blog that just changed hosting providers may look like a phishing domain for 24 hours. A news site that used a CDN on a shared IP may look like a malware host for a week. Quad9 publishes a tool to check why a domain is blocked and to unblock individual entries, but the friction is real. Skip filtering entirely if false positives are a dealbreaker for you.
The change itself took me about five minutes the first time and about two minutes the next few times. The cost is the boring work of typing numbers into a settings panel. The benefit is that the resolver running for every device in my house is one I picked, audited the policy of, and can switch again in a Saturday morning.
If you only run one device and that device is a phone, change DNS on the phone under Wi-Fi settings. If you want to cover everything, change it on the router and flush the cache. Five minutes, no recurring cost, no subscription, no follow-up required.
If I could send a message back to the version of me before I made this change, I would say three things.
- Pick the resolver with the cleanest published logging policy, not the fastest speed test. The audit and the policy page are the actual product. Speed is incidental.
- Use two providers from different companies as primary and backup. One resolver outage will not lock you out of the internet if the backup is from a different network.
- Set a calendar reminder to recheck the policy once a year. The DNS landscape shifts slowly but it does shift. Audits get renewed. Operators change pricing. A company you trust today may not be the company you would pick in two years, and the only way to know is to look.
The default resolver is a logging pipeline you never agreed to. The fix is to pick a different one, knowing the new choice is also a logging pipeline, just one with a policy you can read.