DNS Servers: A Complete Guide to Getting the Most Out of Them

Informatec Digital » Resources » DNS Servers: A Complete Guide to Getting the Most Out of Them

If you've ever noticed that your internet is slower than usual , pages aren't loading, or certain sites are blocked for no apparent reason, it's very possible that the problem isn't with your WiFi or your router, but with the DNS servers you're using without realizing it.

What is a DNS server and how does it actually work?

DNS stands for Domain Name System . Its main function is to translate names like "xataka.com" or "olin.es" into numerical IP addresses such as 84.56.96.21, which are what computers and routers understand when they connect to each other.

Instead of remembering a bunch of numbers for each website, we can use simple names, and the DNS takes care of acting as the internet's "contacts directory" or "phone book ." This system is built as a hierarchical and distributed database spread across the globe; it's not a single giant server, but thousands of them working in a coordinated manner.

Within the DNS ecosystem we can distinguish several types of components with very specific functions, which is key to understanding how a query is resolved and where speed or security problems may appear.

On one hand, there are recursive DNS servers, or resolvers , to which your device sends the request when you type a web address. These resolvers then query the rest of the DNS infrastructure until they find the IP address of the website you want to visit. On the other hand, there are authoritative name servers , which store the official records for each domain: the root records, the top-level domain records (.com, .es, .org, etc.), and the records for each specific domain.

When you type, for example, "www.example.com", your browser sends a DNS query to the recursive server configured on your computer or router. If the server doesn't have the answer cached, it hops from authoritative server to authoritative server (root → TLD → domain) until it finds the A record (or AAAA in IPv6) with the correct IP address, returns it to the browser, and the connection to the web server is established.

In addition to the servers themselves, we can also talk about three “levels” of DNS names: user names (the domains you see every day: .es, .org, .info, etc.), name resolvers in the operating system itself (such as the /etc/hosts file in Linux or the local cache in Windows), and name servers that maintain the domain-IP tables and handle queries coming from anywhere in the world.

On a daily basis, your operating system maintains a local DNS cache : if you have recently visited a website, it stores the corresponding IP address for a while so it doesn't have to query external servers again, saving time and reducing network load.

DNS hierarchy and domain name structure

The DNS system is organized as an inverted tree . Each domain is made up of labels separated by periods, from the most generic to the most specific: for example, in "www.profesionalreview.com", "com" is the top-level domain (TLD), "profesionalreview" is the second-level domain, and "www" is a subdomain.

Each domain label is an alphanumeric string that also allows the hyphen "-". The standard limits each label to a maximum of 63 characters , and the fully qualified domain name cannot exceed 255 characters . Although it is often said that every domain name ends with a period, this final character is usually omitted in practice.

This hierarchy makes the system decentralized and scalable : each level delegates part of the responsibility to the next, so that the load is shared and millions of domains can be managed without collapsing.

Advantages, problems and evolution of modern DNS

Using DNS has a lot of advantages: the most obvious is that we can change a server's IP address without touching the domain , so if a website moves hosting or is deployed on a CDN (Content Delivery Network), traffic is redirected to the new destination without the user having to learn anything new.

Thanks to this flexibility, technologies like CDNs and load balancers can direct each user to the geographically closest server or the least congested one, improving speed and availability. Furthermore, the DNS system itself is very stable: IP addresses change frequently, but the domain remains constant, and changes are automatically propagated across the network.

The downside is security and privacy . For years, DNS requests were sent in plain text, allowing any intermediary (your ISP, an attacker on your Wi-Fi, etc.) to see which domains you query, and even manipulate the responses to redirect you to fake websites (spoofing or pharming attacks).

To improve this situation, several technologies have emerged. DNSSEC provides integrity and authenticity to records through digital signatures, preventing them from being modified in transit. More recently, two protocols have arrived that encrypt queries: DNS over HTTPS (DoH) , which encapsulates requests within standard HTTPS traffic, and DNS over TLS (DoT) , which uses a dedicated TLS channel. In both cases, your internet service provider can no longer easily read which websites you are accessing.

It's important to understand, however, that even with alternative and encrypted DNS servers, not all traces of your online activity disappear . Your destination IP address, other connection metadata, and, if you're not using a VPN, your public IP address remain visible to many parties. DNS servers are an additional layer of security and privacy, not a complete solution.

If you want to try DoH on your computer, a practical guide to enabling DNS-over-HTTPS in Windows 11 helps you improve your privacy without complications.

What can the owners of DNS servers know about you?

A standard DNS server, without DoH/DoT or additional layers, does not hide your IP address or encrypt query content by default. Therefore, the service provider can see which IP address is making the requests and which domains are being resolved.

In practice, this means that your DNS provider can log your originating IP address , the date and time of your queries, and the list of domains you resolve. With this information, fairly accurate profiles of your browsing habits can be created, even if the company claims the data is stored in an “anonymized” form.

Services like Google Public DNS clearly state in their documentation that they store your real IP address for a limited period (24-48 hours) and then retain certain aggregated or anonymized data for statistical purposes and service improvement. Whether you find this acceptable depends on your level of distrust towards companies whose primary business is advertising.

Other providers, such as Cloudflare (1.1.1.1) or Quad9 , take a clearer stance on privacy, promising not to write your IP address to disk or keep permanent logs of your queries. Technically, however, they all have the capability to do so, so it's essential to read their privacy policies and decide accordingly.

Furthermore, some DNS providers use blacklists and public and private "threat intelligence" sources to block malicious domains. This increases your security, but it means the provider cross-references your traffic with multiple external databases, something that isn't always transparent.

Why use alternative DNS instead of your ISP's?

By default, if you don't change anything, your router and devices use your internet service provider's (ISP) DNS servers . This has one advantage: they're usually located near you and, in theory, should work quite well. But in practice, there are several reasons to consider switching.

The first reason is reliability and performance . Many providers set up their DNS servers with limited resources or minimal optimization, and when there are spikes in traffic or occasional problems, you start noticing websites that don't resolve, extremely long wait times, or "the internet is slow" for no apparent reason. Public DNS servers like Google, Cloudflare, or OpenDNS typically have better infrastructure, more redundancy, and faster response times.

Secondly, there's the issue of censorship and DNS blocking . When a government orders internet service providers to block access to certain websites, the most common way to do so is by filtering DNS resolutions. If you switch to an alternative international DNS server, in many cases you can still access the site without problems because that provider doesn't apply the local block.

Security and content control also come into play . Various providers offer anti-phishing, anti-malware, parental controls, and DNS-level ad filters. For a household with children or a small business, this is much more convenient than installing software on each device: simply configure the DNS on the router.

Finally, there's the difference between free and paid DNS services . Free ones cover most home users' needs, but paid ones usually include better SLAs, more attentive customer support, more customization options, advanced reporting, or enterprise integration. For individual users, however, free options are generally more than sufficient.

Free, public, and recommended DNS servers in 2025

There's a veritable collection of free, public DNS servers to choose from. Many are general-purpose, while others focus on security, privacy, or parental controls. Let's take a look at the most well-known and best-performing ones currently available.

OpenDNS (now owned by Cisco) is one of the veterans. Its base addresses are 208.67.222.222 and 208.67.220.220, and it offers a free version geared towards home use with phishing blocking by default, very good availability, and the option to activate parental controls and content filters if you register.

Cloudflare DNS , with IPs 1.1.1.1 and 1.0.0.1, prioritizes speed and privacy . Its global network with hundreds of points of presence makes it one of the fastest DNS services in the world, and its logging policy minimizes the time it retains personal identifiers. It doesn't offer many filtering features, but that's precisely its appeal to those who simply need fast and discreet DNS resolution.

Google Public DNS (8.8.8.8 and 8.8.4.4) is probably the best-known public service. It stands out for its stability, its vast network of data centers, and the extensive documentation available for less technical users. While not the most private option, as it collects some anonymized data, it offers very robust performance.

The Quad9 service , initially associated with IBM and organizations like Packet Clearing House and the Global Cyber ​​Alliance, uses the addresses 9.9.9.9 and 149.112.112.112. Its focus is proactive security : it filters domains that appear on blacklists and threat databases, attempting to block access to malicious websites before they load. They claim not to keep logs of requests, which is very important if you prioritize privacy.

Another alternative is Verisign Public DNS (64.6.64.6 and 64.6.65.6), which doesn't always top the speed rankings, but emphasizes stability and relatively conservative privacy policies , without monetizing the service through advertising or strange redirects.

Services like FreeDNS offer public resolvers with servers distributed across various locations (Austria, Germany, Singapore, the United States, etc.) and require no registration. However, in this case, there are no additional layers of protection against malware or phishing, making it a "cleaner" option but also less secure.

NextDNS goes a step further and functions as a highly configurable cloud DNS . It allows you to block trackers, ads, and dangerous websites, and create policies tailored to each device. You need to create an account, and while it has a free plan with query limits, it's ideal if you want near-surgical control over what is resolved and what isn't on your network.

AdGuard DNS combines traditional DNS resolution functions with a strong focus on privacy and ad blocking . Its primary IPs (94.140.14.14 and 94.140.15.15) apply filters against trackers, ads, and suspicious domains, and it offers other profiles for those who want less filtering or to block adult content as well, all without needing to install browser extensions.

SafeServe , Namecheap's offering, focuses on protecting against attacks such as "Man-in-the-Middle" attacks on DNS queries. It offers servers in Europe and the United States, emphasizing security, privacy, and high availability , using the IP addresses 198.54.117.10 and 198.54.117.11.

If you're looking for enterprise-level security, IBM Quad9 deserves special mention. In addition to the standard IP address 9.9.9.9, it has variants like 9.9.9.11 with specific features such as EDNS Client Subnet for optimizing geolocation in CDN networks. All requests are cross-checked against the IBM X-Force AI engine and other databases to detect and block threats . In exchange for this level of protection, its speed isn't always the fastest on the market, where Google and Cloudflare typically lead the way.

Beyond these big names, there's a long list of alternative public DNS resolvers : Comodo Secure DNS (8.26.56.26 and 8.20.247.20), CyberGhost, UncensoredDNS (91.239.100.100), CleanBrowsing with various parental control profiles, SafeDNS, OpenNIC, Level3, DNS.WATCH, Yandex.DNS, UltraDNS, and many more. Databases like the Public DNS Server List compile thousands of public servers spread across countries, though not all are equally reliable or privacy-conscious.

Specialized DNS: security, parental control and uncensored browsing

In addition to "generalist" DNS providers, there are providers that offer very specific advanced features , geared towards specific needs such as protecting minors, filtering content in corporate environments, or avoiding censorship.

CleanBrowsing , for example, focuses on parental controls and security. Its various profiles allow you to block adult content, phishing, and malware , and implement safe search on Google or YouTube without installing anything on each device: simply configure their IP addresses on the router to protect the entire network.

Comodo Secure DNS is another option geared towards businesses and users who want a first layer of protection against advanced threats. Its free service offers categorical filtering (over 80 categories), protection outside the corporate network, and an Anycast infrastructure designed for networks with many geographically dispersed points.

If your concern is avoiding blocks and maintaining an uncensored internet, services like UncensoredDNS , run by Thomas Steen Rasmussen from Denmark, were created precisely for that purpose. They rely on secure protocols such as DNS-over-HTTPS and DNS-over-TLS and avoid giant providers like Google and Cloudflare due to distrust of their business model.

In environments where privacy is critical, using DNS services like AdGuard, Quad9, NextDNS, UncensoredDNS, or OpenNIC , combined with encrypted protocols (DoH, DoT) and, where appropriate, a good VPN, can make a significant difference compared to the typical "use everything that comes by default" approach.

How to find out which DNS you're using right now

Before changing anything, it's a good idea to check which DNS server is configured on your computer. On GNU/Linux systems, this is usually done by checking the configuration file with administrator privileges, for example with:

# cat /etc/resolv.conf

In Windows, you can open a command prompt (CMD) and run:

ipconfig / all

In the output, you'll see the network adapter in use and the "DNS Servers" lines , which will show the IPs you're using, whether it's your router's (which forwards to your ISP's servers) or public servers like 8.8.8.8. If you prefer tools that explain in detail what each check is for, see what a DNS checker is and what it's used for.

Measure and choose the fastest DNS for you

There's no single "magic" DNS that's the fastest for everyone. Actual latency depends on your location , your internet service provider, internet routing, and the overall state of the service. Therefore, if you want to fine-tune things, the best approach is to test and measure.

Tools like DNS Jumper, DNS Benchmark, NameBench, or DNSPerf allow you to compare the response time of different servers from your connection, returning a personalized ranking of which ones perform best in your specific case and allowing you to analyze the propagation of changes between servers.

Specialized platforms like DNSPerf conduct continuous global analyses and typically rank Cloudflare DNS and Google Public DNS at the top worldwide, with other options like CloudDNS gaining ground. Even so, it's always advisable to verify their recommendations with local measurements.

Among the factors you should consider when choosing a DNS are, in addition to speed, whether the provider keeps logs of your activity , whether it implements DNSSEC, whether it offers DoH/DoT, whether it has parental controls or anti-malware filtering, and of course, its reputation.

Programs and apps to manage DNS on PC and mobile

If you don't feel like digging through advanced options in your system, you can use specific applications that greatly simplify changing DNS and, in some cases, add extra features.

On Windows, DNS Jumper is one of the most popular and user-friendly tools. It's portable, available in Spanish, and allows you to choose your network adapter, select a server from a list or enter a custom one, and even automatically find the fastest DNS server for your connection, all in just a couple of clicks.

On Android, apps like DNS Changer allow you to modify DNS settings without root access, test pre-configured lists, or manually enter servers, and add features such as speed tests, more private browsing, or improvements in online games by reducing latency in resolution.

Tools like Blokada go a step further, combining DNS switching with system-level ad, tracker, and malware blocking , relying on VPN-like technologies (such as WireGuard) to encrypt traffic and filter unwanted domains across all your mobile devices.

Similarly, projects like Nebulo incorporate support for DNS-over-HTTPS, DNS-over-TLS, and even DoH3, encapsulating queries so that no one can easily spy on which domains you resolve, while allowing you to directly select servers like Google, Cloudflare, or OpenDNS.

Change DNS settings on Windows, macOS, and Linux

Setting up new DNS servers on a desktop computer isn't complicated; you just need to know which menu to access. In Windows 11 , for example, you can go to Settings > Network & Internet > your current Wi-Fi network > Edit DNS settings and switch to Manual mode to enter the new IPv4 servers.

If you want the change to affect all connections on that PC, another classic route is to use Control Panel : Network and Internet > Network and Sharing Center > Change adapter settings, choose the adapter in use, enter Properties, select "Internet Protocol Version 4 (TCP/IPv4)" and check "Use the following DNS server addresses" to enter the chosen IPs.

On macOS , this is done from System Preferences > Network, selecting the active connection (WiFi or Ethernet), clicking on "Advanced," and going to the DNS tab. There you can add or modify the servers with the "+" button.

In most Linux distributions , the standard procedure involves using your desktop environment's network manager: System > Preferences > Network Connections, selecting your network, accessing the settings gear, and manually modifying the DNS server fields in the IPv4 section (and IPv6 if applicable). On servers without a graphical environment, you will usually need to edit /etc/resolv.conf or the corresponding network manager's configuration file.

Change DNS on iOS, Android, router and consoles

On mobile phones and tablets, you can also adjust DNS settings, which is especially useful when connecting to public or shared Wi-Fi networks. On iOS (iPhone and iPad), go to Settings > Wi-Fi, tap the "i" icon next to the connected network, change the DNS setting from Automatic to Manual, and add the primary and secondary server addresses you want to use.

On Android , the process varies depending on the brand and version, but generally involves going to Settings > Network & Internet > WiFi, pressing and holding on the network or entering it to choose "Modify network", expanding the advanced options, changing the IP configuration from DHCP to Static and editing the DNS 1 and DNS 2 fields with the IPs you want.

If you want all your home or office devices to use the same servers without having to configure them individually, the best solution is to set them up on your router . To do this, access the router's web interface by entering its IP address (usually 192.168.0.1, 192.168.1.1, or similar) into your browser, log in with your username and password, and look for the "Internet Settings" or "DNS" section. There you can replace the ISP's default DNS servers with your preferred ones.

Consoles also allow this adjustment. On PlayStation 5 , from Settings > Network > Configure Internet Connection, you can access the advanced options and set the DNS to Manual to enter a primary and secondary server. On Nintendo Switch , the menu is located in System Settings > Internet > Internet Settings, where you select your network and change the DNS settings to Manual.

On Xbox , you can access this through the main guide: Profile & system > Settings > General > Network settings > Advanced settings, where you'll find the fields to set up Manual DNS. In all cases, it's a good idea to test the connection afterward to confirm that the new DNS settings are working correctly and aren't adding extra latency to your online games.

Security reinforcement: DNSCrypt and post-monitoring

If you want to add an extra layer to all of the above, you can use DNSCrypt . It's not a DNS service itself, but a protocol that encrypts and authenticates queries between your computer and the resolver, preventing responses from being forged or your requests from being easily intercepted.

DNSCrypt works by using cryptographic signatures that guarantee the response comes from your chosen server and hasn't been altered by third parties. Many implementations, such as dnscrypt-proxy or Simple DNSCrypt, are open source and offer advanced options: from blocking ads and trackers using local lists to forcing the use of TCP to encapsulate traffic within tunnels or Tor.

It's important to understand that DNSCrypt doesn't replace a VPN , but rather complements it. It protects a very specific part of the communication (DNS queries), while a VPN redirects and encrypts all network traffic. Combining them makes sense if you want to minimize metadata leakage.

After changing your DNS settings—with or without encryption—it's a good idea to spend a few days monitoring your connection's performance . You can use synthetic tests (DNSPerf, benchmark tools, speed tests) and, above all, pay attention to your actual usage: whether websites load faster, whether sporadic errors disappear, whether streaming is less buffering, or whether games experience some lag.

If you notice that the speed or stability worsens, it's perfectly fine to try another provider from the list. There are so many public and private routers these days that it's wise to experiment until you find the balance between performance, privacy, and extra features that best suits your internet usage.

Ultimately, understanding what DNS servers do, what information they handle about you, and what options you have for switching providers—from a simple 8.8.8.8 or 1.1.1.1 to more advanced solutions with parental controls, ad blocking, or end-to-end encryption—gives you enormous leeway to optimize your browsing, bypass unnecessary blocks, and strengthen the security of all your devices with an adjustment that, in most cases, will only take a few minutes.