Skip to main content
guides

Seven new public DNS resolvers in the comparison (and the ones we left out)

· 7 min read

In short

The dnsgratis.com comparison grows from 14 to 21 providers. The seven newcomers are UncensoredDNS (Denmark, encrypted only, no logs), LibreDNS (Greece, encrypted only, with an ad-free endpoint), Digitale Gesellschaft (Switzerland, encrypted only), DNS.SB (Germany, anycast on 30 nodes, works in a router), Hurricane Electric (US backbone, unfiltered) and China's two big ones, AliDNS and DNSPod. We picked them after testing 21 candidates that show up in popular lists: dns0.eu shut down in January 2026, UltraDNS Public lost its official page, and FreeDNS, Freenom, puntCAT and GreenTeamDNS no longer answer. Three of the newcomers (LibreDNS, AliDNS and DNSPod) do not validate DNSSEC, and we say so. Also, xdp.es now publishes a primary/secondary pair for each profile.

Until today the comparison listed 14 providers. As of today it lists 21. This post explains where the seven newcomers come from, how we tested them and, above all, which of the names that circulate in “best DNS” lists we left out and why. There is also a change at xdp.es that matters if you already use it.

How we chose

We started from six widely quoted lists (two Spanish tech sites, a security vendor, a GitHub gist, the DNS4EU website and a VPN blog) and pulled out every service we did not have: 21 candidates. Each IP got three questions via dig: does it answer, does it validate DNSSEC (by querying dnssec-failed.org, a domain deliberately signed wrong) and does it block ads (by querying pagead2.googlesyndication.com). Then we tested port 853 with openssl for DoT and DoH with curl. For the ones still standing, we went to the official website to read what they promise about logging, jurisdiction and filtering.

That last step is the one that knocks out most candidates. Lists copy from each other and drag along addresses of services that closed years ago.

The seven newcomers

UncensoredDNS (Denmark). Run by one person, Thomas Steen Rasmussen, since 2009 with his own money. It logs nothing and filters nothing. It switched off port 53 in 2022, so it only answers encrypted queries: DoT, DoH and, since October 2025, DoQ and DoH3. One anycast node (91.239.100.100) and one in Copenhagen (89.233.43.71). It is the second encrypted-only provider in the comparison, after Mullvad.

LibreDNS (Greece). An activist project by LibreOps. No logs, DoH and DoT only, plus a second endpoint (noads.libredns.gr) that blocks ads and trackers with a crowdsourced list. One caveat: it does not validate DNSSEC. It forwards queries to OpenNIC, which does not either.

Digitale Gesellschaft (Switzerland). The resolver of the association of the same name, based in Basel. No logs, no blocklists, DNSSEC validation, and DoT and DoH only. The interesting part is the jurisdiction: Swiss, outside the EU. It is run by volunteers, and they say it plainly: best effort, no availability guarantee.

DNS.SB (Germany). Operated by xTom GmbH of Düsseldorf on an anycast network of 30 nodes across six continents. Its privacy policy is among the clearest we have read: it does not record queried domains or IP addresses, and it does not send your subnet to authoritative servers (no ECS). It validates DNSSEC and answers on port 53, DoT and DoH. This is the one we would put in a router if privacy is the goal. Addresses: 185.222.222.222 and 45.11.45.11.

Hurricane Electric (United States). The public resolver of one of the largest backbones in the world and the largest on IPv6. A single anycast address, 74.82.42.42 (and 2001:470:20::2), which from Madrid answers from its Lisbon node. No filtering, DNSSEC validation, and DoT, DoH, DoQ and DoH3 at ordns.he.net. What it lacks is a published logging policy for this service, and the page says exactly that: “not published”.

AliDNS and DNSPod (China). The two most used public resolvers in China, from Alibaba Cloud (223.5.5.5 and 223.6.6.6) and Tencent Cloud (119.29.29.29, with DoH and DoT at doh.pub and dot.pub). They are here for readers of the Chinese edition of this site: from there they are the fast option, with ECS so CDNs serve content from nearby. From Europe they offer no advantage. Neither validates DNSSEC and both keep logs.

The ones left out

This is the useful part if you have just read a “15 best DNS servers” list.

  • dns0.eu shut down on 15 January 2026 for lack of resources. The project itself recommended moving to DNS4EU or NextDNS.
  • UltraDNS Public, which lists cite under three names (Verisign, Neustar and UltraDNS), still answers at 64.6.64.6, but DigiCert has removed its official page and publicdns.neustar does not load. Without live documentation it stays out: the note “addresses verified against official documentation” on every provider page would be a lie.
  • FreeDNS, Freenom World, puntCAT, GreenTeamDNS, Fourth Estate and SmartViper: none of their addresses answer. Freenom collapsed with the loss of .tk in 2023; we would have liked puntCAT for the Catalan edition of the site, but 109.69.8.51 is dead.
  • Alternate DNS is no longer at the IPs the lists give (76.76.19.19); today it is a single address on Amazon with no DoH, no DoT and no published policy. Too fragile.
  • Dyn (Oracle) and Level3 (4.2.2.2): they answer, but Oracle retired the product and Level3’s was never an official public service. Publishing ownerless addresses is what happened to us with DNS.WATCH.
  • CyberGhost, Unlocator and ExpressVPN: paid VPN or Smart DNS products, not public resolvers.
  • SafeDNS and FlashStart: commercial; the free part is a trial.
  • OpenNIC: a volunteer network with changing addresses; three of the four the lists give are dead. There is no fixed IP to publish.

And three of the six lists had wrong addresses for providers we do have: Quad9’s secondary was missing a digit, AdGuard appeared with the IPs it retired in 2020, and OpenDNS FamilyShield with an incomplete address. If you copy a DNS server from an article, check the IP against the provider’s website.

Three that do not validate DNSSEC

The test is simple and you can repeat it: dig @IP dnssec-failed.org A. That domain is deliberately signed with an invalid signature. A DNSSEC-validating resolver answers SERVFAIL; a non-validating one returns the address as if everything were fine. LibreDNS, AliDNS and DNSPod returned it, on port 53 and over DoH as well. Some lists credit them with DNSSEC; we publish what the server answers. The site’s DNSSEC checker runs the same check on any domain.

xdp.es gets secondary addresses

xdp.es, the Spanish public resolver, used to publish a single IP per profile. As of today each profile has a pair: the primary stays in Madrid (85.208.114.51 with ad blocking, 85.208.114.52 unfiltered) and the secondary sits on Oracle’s network (51.170.52.10 and 51.170.54.40, with IPv6 2603:c027:8703:d400::10 and ::40). We checked that each secondary filters exactly like its primary, so do not mix profiles. If you had it configured with the IP repeated, you can now enter the real pair.

Latency: in the next measurement

The four newcomers that answer on port 53 (DNS.SB, Hurricane Electric, AliDNS and DNSPod) are not yet in the latency table of the comparison. We tried to measure them today from the usual line and the connection was congested: a ping to 1.1.1.1 ranged from 5 to 577 ms. On that network every resolver came out four times slower than in August, and publishing that would be misleading. The table will be completed as soon as there is a clean measurement, with its date. In the meantime, the speed test measures from your own connection, which is the one that matters in the end.

What happens when a resolver shuts down

With 21 providers it is only a matter of time before one closes; dns0.eu lasted three years. From today the rule is that a published page is never deleted: it is marked as closed with the date, drops to the bottom of the comparison and stops appearing among similar providers. Its addresses live in thousands of tutorials and configurations; whoever comes looking for them should find the notice, not a 404. DNS.WATCH, which has been answering intermittently since August, will probably be the first.

Sources

Frequently asked questions

Which of the seven newcomers should go in a router?
DNS.SB or Hurricane Electric: both answer on port 53, the only thing a home router understands. UncensoredDNS, LibreDNS and Digitale Gesellschaft only serve DoH and DoT, so they belong in the operating system or the browser, not the router. AliDNS and DNSPod work on port 53 too, but only make sense from inside China.
Why isn't UltraDNS (formerly Verisign and Neustar) listed?
Because it no longer has official documentation. The addresses 64.6.64.6 and 64.6.65.6 still answer, but DigiCert, the current owner, redirects the service page to its enterprise product and publicdns.neustar does not respond. A resolver nobody documents can vanish without notice, and we do not publish addresses we cannot check against their source.
What happened to dns0.eu?
It shut down on 15 January 2026 for lack of resources, as the project itself announced, recommending users move to DNS4EU or NextDNS. Both are in the comparison.
How do you know a resolver does not validate DNSSEC?
By querying a domain deliberately signed with a broken signature, dnssec-failed.org. A validating resolver answers SERVFAIL; a non-validating one returns the address as if nothing were wrong. LibreDNS, AliDNS and DNSPod returned it, both on port 53 and over DoH. You can repeat the test with dig or with this site's DNSSEC checker.
What do you do when a provider shuts down?
We do not delete it. The page stays up with a shutdown notice and the date, drops to the bottom of the comparison and stops being recommended. Its addresses live in thousands of tutorials, and whoever looks them up should find the notice, not a page that no longer exists.

← All articles

Ready to improve your DNS?

Choose the best free DNS server for your needs and configure it in minutes.

View Full Comparison Configuration Guide