Every time you visit a website, your device first asks a DNS resolver a question (“what’s the IP of wikipedia.org?”). By default, that resolver belongs to your ISP. It sees every domain you visit, often logs it, and sometimes hijacks typos into ad pages.
Swapping it for a public resolver is a one-line change, and here’s why it’s worth pairing with encryption:
The question and the answer cross the wire in clear text. Your ISP can log every domain you visit, or rewrite the answer, whichever resolver you picked.
The ISP sees one TLS connection to the resolver, nothing else. Only the resolver you chose learns which domains you visit.
The contenders
The only real decision is: do you want the resolver to filter anything?
The last digit is a mode switch
Quad9 confuses people because 9.9.9.9, 9.9.9.10 and 9.9.9.11 sound like three different places. They’re the same infrastructure: the last octet just flips features on and off (official list):
- Malware blocklist
- DNSSEC validation
- ECS (faster CDN routing)
The default. Refuses to resolve domains on its threat-intel blocklist.
Cloudflare copied the pattern: 1.1.1.2 and 1.1.1.3 are 1.1.1.1 with blocklists bolted on.
Which one
What do you want from it?
Set it
Otherwise, set it per-machine in your OS network settings, and enable “secure DNS” (DoH) in the browser so queries are encrypted in transit. That’s the toggle from the demo above.
Prove it
# Who is resolving my queries?dig +short resolver.dnscrypt.info txt
# DNSSEC validation on? An answer here means NO. It must fail.dig +short dnssec-failed.org
# Malware filter live? Blocked on 9.9.9.9, resolves on 9.9.9.10.dig +short isitblocked.org @9.9.9.9dig +short isitblocked.org @9.9.9.10No terminal: on.quad9.net for Quad9, one.one.one.one/help for Cloudflare.
When things break
- dns.google/cache / one.one.one.one/purge-cache: flush a stale record after a DNS change
- quad9.net/result: is Quad9 blocking this domain, and why
- zonemaster.net: full health check of a zone you own
For how DNS works, see the series starting at How DNS works. For the exhaustive version (jurisdictions, logging policies, protocols) see Privacy Guides. This is deliberately the short one.