1.1.1.1 vs 8.8.8.8: We Benchmarked 10 Public and ISP DNS Resolvers

👁 128 reads

We measured the response times of 10 DNS resolvers from a broadband connection: Cloudflare 1.1.1.1 and the local ISP resolver finished nearly neck and neck (median 19.6-21.3 ms), Quad9 and Netia were right behind them, while Google 8.8.8.8 took more than twice as long (45-48 ms). On “cold” queries - when the resolver must perform full iterative lookups from scratch - Cloudflare’s lead over Google widened even further. Read more about the provider in our Cloudflare guide.

Why DNS Speed Matters

Every web visit begins with a question to a DNS resolver: “what is the IP address for this domain?”. If the resolver responds in 20 ms, you will never notice. If it takes 80 ms and a web page pulls assets across 15 separate domains, those lookups add up to noticeable latency, especially on your first visit. By default, your connection uses your internet service provider’s DNS. The question searched thousands of times every month - “Cloudflare DNS vs Google DNS” - comes down to whether switching is truly worth the effort.

Our Testing Methodology

We wrote a Python script utilizing the dnspython library to query each target resolver directly, entirely bypassing the local operating system cache:

• 50 popular domains - top regional and global destinations (including youtube.com, chatgpt.com, onet.pl, allegro.pl, and others). Resolvers usually hold these active in their cache, making this a test of raw network routing distance to the server.
• 50 “cold” queries - a randomized, non-existent subdomain for each domain (generated uniquely for every resolver). Because nobody has requested these hostnames before, the resolver must walk the entire DNS hierarchy from the root servers down. This tests resolver engine performance.
• Resolver order was randomized on every single domain query to prevent sequential bias.
• Two separate rounds conducted roughly 20 minutes apart.

Benchmark Results: Popular Domains

Benchmark Results: Cold Cache Queries

Here is how quickly each resolver resolves a domain name that is entirely absent from its cache:

Round 2 showed a very similar distribution: 1.0.0.1 recorded 28.1 ms, Orange 30.8 and 35.1 ms, 1.1.1.1 recorded 32.6 ms, Netia 35.1 ms, Quad9 39.6 ms, and Google 59.4 and 62.5 ms. The worst single-query outliers reached up to 1.6 s for AdGuard, 0.4 s for Google, and 0.34 s for 1.1.1.1.

Key Takeaways

1. Cloudflare and local ISP DNS are a statistical tie. The 1-2 ms differences fall within normal measurement noise. Remember that testing occurred directly on the Orange network - an ISP’s DNS enjoys a home-field advantage inside its own infrastructure. For users connecting from different networks, that ISP’s resolvers would perform much worse.
2. Google 8.8.8.8 is over twice as slow as Cloudflare for popular domains and 30-35 ms slower on cold lookups from this location. If you configured it simply because someone on a forum suggested 8.8.8.8 years ago, migrating to 1.1.1.1 offers an immediate, tangible improvement.
3. Quad9 is a compelling security choice - it provides built-in malware blocking while remaining competitive on popular domains, though cold queries incur a modest speed penalty.
4. AdGuard DNS trades speed for ad-blocking - it came in slowest overall and was the only resolver to experience request timeouts.
5. Real-world gains are subtle. Saving 20-25 ms on an initial lookup matters, but subsequent requests are served out of your browser or local OS cache anyway. Do not expect faster download speeds - this improves snappy domain negotiation, not overall bandwidth.

How to Change Your DNS to 1.1.1.1

Windows 11

1. Navigate to Settings → Network & internet → Ethernet or Wi-Fi → connection properties.
2. Next to “DNS server assignment”, click Edit and switch the dropdown to Manual.
3. Toggle IPv4 to On, enter 1.1.1.1 (Preferred) and 1.0.0.1 (Alternate). Set DNS encryption to “Encrypted only (DNS over HTTPS)”.
4. For IPv6: use 2606:4700:4700::1111 and 2606:4700:4700::1001.

Android

1. Open Settings → Network & internet → Private DNS.
2. Select “Private DNS provider hostname” and type one.one.one.one.

iPhone

iOS lacks a universal native setting for cellular DNS. The cleanest path is downloading the official 1.1.1.1 app and toggling the connection to “1.1.1.1” mode (DNS only, without WARP routing).

Router

Setting custom DNS servers directly on your router protects every device on your local network automatically. Look for the WAN or DHCP configuration section inside your admin interface and locate the “Primary DNS” and “Secondary DNS” entries. If your ISP-provided gateway locks these fields down, configure DNS on individual devices instead.

Filtered DNS Versions

• 1.1.1.2 and 1.0.0.2 - automatically block recognized malware domains.
• 1.1.1.3 and 1.0.0.3 - block both malware and adult content (useful for parental controls).

Privacy and Security

Your DNS resolver sees every single domain name you look up. Cloudflare states that it does not retain client IP addresses permanently and purges query logs within 25 hours - commitments audited by independent third-party assessors. Your ISP can still monitor network traffic destinations by IP address, so changing DNS does not make you anonymous, but enabled DNS-over-HTTPS (DoH) keeps the plaintext lookup queries away from snooping ISP monitors. Since September 10, 2026, 1.1.1.1 also supports post-quantum DNSSEC signatures using the ML-DSA-44 algorithm.

Test Limitations

• Single ISP connection (Orange), single European location, two rounds during one morning. Results will vary depending on your geographic region and peering.
• Third-party ISP resolvers (such as Play, T-Mobile, or Vectra) generally restrict access to their own subscribers. Publicly cited forum addresses - 151.80.103.98, 213.158.199.1, 31.11.202.254, and 62.233.233.233 - refused all external inbound queries.
• Measurements evaluated plain DNS over UDP. Encrypted protocols (DoH, DoT) introduce a few milliseconds of initial TLS handshake overhead.

Google · Your sourcesQuantslant higher in your Google - one clickAdd to preferred sources →

Sources

• Original benchmark data from October 5, 2026 (Python script + dnspython, ~2,000 total queries).
• Cloudflare - 1.1.1.1 Public Resolver
• Cloudflare - 1.1.1.1 Privacy Policy
• Cloudflare - Post-Quantum DNSSEC in 1.1.1.1 (September 10, 2026)

Kinetyra