Pick a DNS in One Paragraph
Mainland China: Prefer 223.5.5.5 (AliDNS) or 119.29.29.29 (DNSPod) for the fastest, most reliable access to domestic sites. For Privacy: Choose 1.1.1.1 (Cloudflare) or 9.9.9.9 (Quad9) — both back their no-logging claims with third-party audits. Family Filtering: Choose 1.1.1.3 (Cloudflare Family) or 185.228.168.168 (CleanBrowsing Family) to block adult and malicious content. Ad Blocking: Choose 94.140.14.14 (AdGuard DNS). Fastest Worldwide: Cloudflare 1.1.1.1 (330 PoPs) and Quad9 (245 PoPs) offer the widest coverage.
1. What Is Public DNS? How Is It Different from Your ISP's DNS?
DNS (Domain Name System) translates domain names into IP addresses. When you visit google.com, your operating system asks a recursive resolver: "What's the IP for google.com?" — that resolver is the DNS server.
By default, you're using your ISP's DNS (the one assigned by your home broadband). The problems with this:
- Ad hijacking — many ISPs hijack NXDOMAIN (domain not found) responses and redirect them to ad pages
- Log monetization — every domain you look up is logged by the ISP, potentially used for ad profiling or sold
- Slow speed — smaller carriers have low DNS cache hit rates, with resolution times of hundreds of milliseconds
- DNS poisoning — some mainland China ISPs poison DNS responses for overseas domains
Public DNS is a free or paid resolver run by a third party that solves these problems — just point your device at one IP address (e.g., 1.1.1.1) instead of your ISP's DNS.
2. Comparison Table: 15+ Popular Public DNS Services
Sorted from "international" to "mainland China / Hong Kong-Taiwan". Anycast PoP counts are taken from each provider's recent official figures.
| Brand / Product | IPv4 Primary/Secondary | IPv6 | Filtering Policy | DoH / DoT | PoP | China Reachability |
|---|---|---|---|---|---|---|
| Cloudflare 1.1.1.1 | 1.1.1.1 / 1.0.0.1 | 2606:4700:4700::1111 / 2606:4700:4700::1001 | None Unfiltered, raw resolution | DoHDoT | 330 | Intermittent |
| Cloudflare 1.1.1.2 / 1.1.1.3 (Family) | 1.1.1.2 / 1.0.0.2 / 1.1.1.3 / 1.0.0.3 | 2606:4700:4700::1112 / 2606:4700:4700::1002 | Family 1.1.1.2 blocks malware domains; 1.1.1.3 also blocks adult content | DoHDoT | 330 | Intermittent |
| Google Public DNS | 8.8.8.8 / 8.8.4.4 | 2001:4860:4860::8888 / 2001:4860:4860::8844 | None Unfiltered | DoHDoT | 200 | Unreachable |
| Quad9 9.9.9.9 | 9.9.9.9 / 149.112.112.112 | 2620:fe::fe / 2620:fe::9 | Malware Blocks known malicious domains by default (based on multi-source threat feeds including IBM X-Force) | DoHDoT | 245 | Intermittent |
| Cisco OpenDNS OpenDNS Home | 208.67.222.222 / 208.67.220.220 | 2620:119:35::35 / 2620:119:53::53 | Malware Blocks phishing sites and malware domains; add parental controls after signing up | DoHDoT | 35 | Intermittent |
| Control D Public DNS | 76.76.2.0 / 76.76.10.0 | 2606:1a40:: / 2606:1a40:1:: | None Unfiltered by default; sign up for an account to choose from 40+ filtering profiles | DoHDoT | 270 | Intermittent |
| AdGuard AdGuard DNS | 94.140.14.14 / 94.140.15.15 | 2a10:50c0::ad1:ff / 2a10:50c0::ad2:ff | Ads Blocks ads, trackers, and malware domains | DoHDoT | 60 | Intermittent |
| CleanBrowsing Family Filter | 185.228.168.168 / 185.228.169.168 | 2a0d:2a00:1:: / 2a0d:2a00:2:: | Family Blocks adult content and malware domains; enforces Google/Bing SafeSearch | DoHDoT | 12 | Intermittent |
| Verisign Public DNS | 64.6.64.6 / 64.6.65.6 | 2620:74:1b::1:1 / 2620:74:1c::2:2 | None Unfiltered, emphasizes stability | DoHDoT | 26 | Intermittent |
| Lumen / CenturyLink Level3 DNS | 4.2.2.1 / 4.2.2.2 | — | None Unfiltered, a long-standing Tier-1 ISP DNS service | DoHDoT | 10 | Intermittent |
| Alibaba Cloud (AliDNS) AliDNS | 223.5.5.5 / 223.6.6.6 | 2400:3200::1 / 2400:3200:baba::1 | None Unfiltered, stable nationwide across mainland China | DoHDoT | 50 | Stable |
| Tencent (DNSPod) DNSPod Public DNS+ | 119.29.29.29 / 182.254.116.116 | 2402:4e00:: / 2402:4e00:1:: | None Unfiltered, operated by Tencent | DoHDoT | 40 | Stable |
| 114DNS 114DNS | 114.114.114.114 / 114.114.115.115 | — | None Unfiltered by default (the 114DNS Secure edition at 114.114.114.119 blocks phishing) | DoHDoT | 8 | Stable |
| 360 360 Secure DNS | 101.226.4.6 / 218.30.118.6 | — | Malware Blocks phishing, trojan, and malware-injected sites | DoHDoT | 6 | Stable |
| Chunghwa Telecom (HiNet) HiNet DNS | 168.95.1.1 / 168.95.192.1 | 2001:b000:168::1 / 2001:b000:168::2 | None Unfiltered, Taiwan ISP DNS | DoHDoT | 4 | Intermittent |
Click any IP in the table to jump to its CleanIP IP intelligence page: 1.1.1.1, 8.8.8.8, 9.9.9.9, 223.5.5.5, 119.29.29.29.
3. Choosing DNS by Use Case — 5 Scenarios
3.1 For Speed / Global Coverage
Cloudflare 1.1.1.1 is widely regarded as the fastest, with 330 PoPs reaching nearly every major city. Quad9 (245 PoPs) is a close second. For real-world rankings by region, check dnsperf.com for live results in your area.
3.2 For Privacy / No Logging
Cloudflare 1.1.1.1 has an independent audit agreement with KPMG and commits to deleting all query logs within 24 hours. Quad9 is a Swiss nonprofit subject to stricter privacy regulations. Note: Google 8.8.8.8 retains performance logs; see AdGuard, AliDNS, and DNSPod's official sites for their respective policies.
3.3 For Blocking Malware / Phishing
Quad9 (9.9.9.9) automatically blocks malicious domains by default using 16 threat feeds including IBM X-Force, making it friendly for elderly or younger users. OpenDNS and CleanBrowsing offer similar capabilities.
3.4 Parental Controls / Blocking Adult Content
Cloudflare 1.1.1.3 + 1.0.0.3 (Family) or CleanBrowsing 185.228.168.168 (Family) — these don't just block malicious domains, they also enforce Google/Bing SafeSearch. Great for schools and home routers.
3.5 Blocking Ads / Trackers
AdGuard DNS (94.140.14.14) — blocks ads at the network level, no browser extension needed, works across every device on your network.
3.6 Stability First for Mainland China
AliDNS (223.5.5.5) is the top domestic choice, operated by Alibaba Cloud with excellent routing for domestic ISPs.DNSPod (119.29.29.29) is operated by Tencent with a similar positioning. 114DNS (114.114.114.114) is a long-established, well-known service but doesn't support IPv6.
4. How to Configure Public DNS
4.1 Router-Level (Recommended) — Applies to Every Device
- Log in to your router's admin panel (usually 192.168.1.1 / 192.168.0.1)
- Find "DHCP Settings" / "LAN Settings" / "DNS Server"
- Change the primary/secondary DNS to your chosen IPs (e.g., primary 1.1.1.1, secondary 1.0.0.1)
- Save and restart the router — every device on the network will automatically use the new DNS
4.2 System-Level — Current Device Only
- Windows: Settings → Network & Internet → current network → DNS server assignment → Edit (change both IPv4 and IPv6)
- macOS: System Settings → Network → Details → DNS → Add DNS Server
- iOS: Settings → Wi-Fi → current Wi-Fi → Configure DNS → Manual
- Android: Settings → Network → Private DNS → enter a hostname (e.g.,
dns.alidns.com)
4.3 Browser DoH (DNS-over-HTTPS)
The browser encrypts DNS itself, bypassing the operating system's DNS settings. This offers the strongest privacy, but only affects traffic within the browser.
- Chrome: Settings → Privacy and Security → Security → Use secure DNS → choose Cloudflare / Google / Custom
- Firefox: Settings → Privacy → Enable DNS-over-HTTPS → defaults to Cloudflare
- Edge: Settings → Privacy → Use secure DNS
5. What's the Difference Between DoH and DoT? Why Does It Matter?
Traditional DNS transmits queries in plaintext over UDP port 53 — ISPs, hackers, and public WiFi can all see what domains you're looking up. DoH (DNS-over-HTTPS) wraps queries inside HTTPS (port 443), blending them with normal web traffic, making them hard to censor or block. DoT (DNS-over-TLS) also encrypts queries, but uses a dedicated port 853 — making it easier for firewalls to identify and block.
For any DNS in the table above that supports DoH, we recommend using DoH to connect.
Want to verify DoH is actually working? Use ourDNS Leak Test: your browser queries our own authoritative nameservers directly, revealing who your real resolver's egress actually is.
6. Common Misconceptions
- "Changing DNS lets you bypass censorship" — False. DNS only resolves domain names; it doesn't change routing. Slow access to Google from mainland China is mainly an international bandwidth issue, not a DNS issue.
- "Foreign DNS is always faster than domestic DNS" — False. Using foreign DNS to access domestic sites from within China can actually be slower, because CDN routing may pick the wrong node based on the resolver's IP.
- "Changing DNS hides your real IP" — False. DNS only affects the query process; it doesn't change the egress IP exposed when you visit a website. To hide your IP, use a VPN or proxy.
- "114DNS is the best" — That was true 10 years ago. Today, AliDNS and DNSPod are more advanced in both node coverage and DoH support.