What is CIRA Canadian Shield?
CIRA Canadian Shield is a free public DNS service run by CIRA (Canada). It answers plain DNS on 149.112.121.10, 149.112.122.10 (IPv6: 2620:10a:80bb::10, 2620:10a:80bc::10), and encrypted DNS: DoT, DoH. It mainly serves one region (Canada): close by it can be the fastest, from far away it is usually slower than the big global networks.
It validates DNSSEC: answers whose signatures don't check out are refused. It doesn't filter: every name resolves as it is. It is run as a non-profit.
CIRA Canadian Shield DNS server addresses
What to enter to use CIRA Canadian Shield:
DNS (IPv4) 149.112.121.10, 149.112.122.10
DNS (IPv6) 2620:10a:80bb::10, 2620:10a:80bc::10
DoT / Private DNS private.canadianshield.cira.ca
DoH https://private.canadianshield.cira.ca/dns-query
How to set up CIRA Canadian Shield
Windows 11
Settings → Network & internet → Wi‑Fi or Ethernet → Hardware properties → DNS server assignment → Edit → Manual. Turn on IPv4 and enter 149.112.121.10, 149.112.122.10. To encrypt, set DNS over HTTPS to On (manual template) with https://private.canadianshield.cira.ca/dns-query.
macOS
System Settings → Network → Wi‑Fi (or Ethernet) → Details → DNS: press + and add 149.112.121.10, 149.112.122.10. Encrypted DNS (https://private.canadianshield.cira.ca/dns-query) needs a configuration profile.
iPhone and iPad
Settings → Wi‑Fi → ⓘ next to the network → Configure DNS → Manual, and add 149.112.121.10, 149.112.122.10. This is for that Wi‑Fi only; for encrypted DNS on every network, install a DNS profile for https://private.canadianshield.cira.ca/dns-query.
Android
Settings → Network & internet → Private DNS → Private DNS provider hostname: private.canadianshield.cira.ca. It works on every network and is encrypted (DoT). The menu differs a little by brand: search Settings for “Private DNS”.
Router
In the router's admin page (WAN or DHCP settings), set the DNS servers to 149.112.121.10, 149.112.122.10: every device on the network then uses it.
Browser
Chrome: Settings → Privacy and security → Security → Use secure DNS → Custom: https://private.canadianshield.cira.ca/dns-query. Edge has the same under Privacy, search, and services. Firefox: Settings → Privacy & Security → DNS over HTTPS → Max Protection → Custom: https://private.canadianshield.cira.ca/dns-query.
Linux
With systemd-resolved: put DNS=149.112.121.10 149.112.122.10 in /etc/systemd/resolved.conf, then run systemctl restart systemd-resolved. For DoT, write the address as 149.112.121.10#private.canadianshield.cira.ca and add DNSOverTLS=yes.
Can CIRA Canadian Shield be used in mainland China?
Its plain DNS usually answers, but more slowly, since the servers are outside mainland China, and answers for blocked sites can be forged on the way. Encrypted DNS (DoH, DoT) to it is often blocked or unstable. Run the test on this page: a row with no answer means it isn't reachable from your network.
CIRA Canadian Shield or Quad9 DNS: which is faster?
Neither is faster everywhere: what counts is how far each one's nearest server is from you and how your provider routes there. This page times both, and every other DNS in the list, from your own network in about 20 seconds; the top of the page shows where CIRA Canadian Shield ranks and how far it is behind the fastest.
Quad9 DNS: page, addresses, setup →
Why is CIRA Canadian Shield slow for me?
Usually distance: its nearest server is far away, or your provider routes there the long way. A proxy or VPN carries the queries too, and then the test measures the proxy's route (the direct rules fix that). Some networks slow down or block encrypted DNS. And a name nobody has asked it for yet always takes longer (the Uncached column). If another DNS in the list is clearly faster, switch to it.
How does the test work?
Your browser asks every resolver directly; nothing goes through this site. First it opens a connection to each and asks three popular names once, which puts them in the resolver's cache; none of that counts. Then come 10 rounds: in each, every resolver is asked once more, in a new random order, a few at a time, so a burst of trouble on your network hits all of them alike. Every other round also asks a random name that doesn't exist anywhere.
The numbers are medians, so a single slow query doesn't move them. Times come from the browser's own network timing for each request where it has it, which this page's scripts can't delay. Every URL is new and fetched past any cache, so only the resolver itself can answer.
Why are UDP and DoT estimates?
Browsers can only make HTTPS requests. They can't send a UDP query to port 53, open a TLS connection to port 853 (DoT) or speak DoQ, and no website can do that from your network. Any site that shows those numbers measures from its own server or guesses.
What the page can do: send DNS over HTTPS to the very server that answers UDP and DoT (for example https://1.1.1.1/dns-query). On an open connection, a query costs one round trip to that server plus the resolver's work, which is exactly what a UDP or DoT query costs; HTTP adds well under a millisecond. Hence ≈. Where a resolver's plain DNS server has no HTTPS, there's a – instead of a number.
What an estimate can't see: a network that blocks, slows or tampers with port 53 or 853 but leaves HTTPS alone.
To measure UDP, DoT and DoQ for real, run the command-line tool (the command under the table) on a server, a Linux box or a router: it speaks every protocol and uses the same resolver list.
How reliable are the results?
The timing method is described under the first question. On top of that, the list is checked with scripts/verify.mjs (in the repository) from more than one continent: every address must answer this exact kind of query with a real DNS answer, and DNSSEC validation is tested rather than taken from the resolvers' own claims.
Where a resolver allows it (Cloudflare, Google, Quad9, Control D, DNS.SB, DNS4EU, IIJ), the page also reads each answer and only counts real ones. For the others the browser can time the answer but not read it.
Run the test a couple of times, at different hours if you can: what is fastest at night on your network may not be at peak time.
I use a proxy. Are the results still mine?
Not by default: with a proxy or VPN on, your browser reaches the resolvers through it, and the test measures the proxy's route (all the resolvers abroad then look about as fast as your proxy server). The resolver you set on your device or router is usually asked directly, so that's not what you'd get.
To test your own network, add the direct rules (the button next to the progress): they send exactly the addresses this test asks straight out, by exact host name and single IP, and nothing else. Clash/Mihomo, Surge, Shadowrocket, Quantumult X, Loon, sing-box and Xray are covered; most can load the rules from this site so they stay current.
What does uncached mean?
Popular names are already in every busy resolver's cache, so asking for them is quick everywhere. A name nobody asked for recently makes the resolver ask that site's own DNS servers first. The test uses random names under a zone hosted on Cloudflare's DNS, which has servers almost everywhere except mainland China.
That cost depends on where each site's DNS servers are, which differs from site to site, so it's shown but not ranked. Resolvers in mainland China look slow here because the zone's servers are abroad; for Chinese sites, whose DNS servers are in China, they are fast.
Which one should I pick?
The fastest one at the top is a good default. If it's close (a few ms), prefer what else matters to you: Quad9 and OpenDNS block known malware and phishing sites; Mullvad, Quad9 and Wikimedia keep no logs of who asked what; resolvers that validate DNSSEC refuse forged answers on signed domains.
If your device only lets you enter plain DNS server addresses (most routers, older systems), look at the UDP column: the line under the winner names the fastest plain DNS when it's a different one.
For privacy from your network and ISP, use the DoT or DoH address: plain DNS travels unencrypted.
How do I change my DNS?
Android 9+: Settings → Network → Private DNS → enter the DoT host (for example one.one.one.one).
iPhone and Mac: per Wi-Fi network, enter the DNS servers; for encrypted DNS install a configuration profile from the resolver's website.
Windows 11: Settings → Network → your connection → DNS server assignment → Manual, enter the servers and set DNS over HTTPS to On.
Router: put the DNS servers in its DHCP or WAN settings and every device on the network uses them.
Browser only: Chrome, Edge and Firefox have a Secure DNS setting where you pick a provider or paste the DoH address.
Click any address on this page to copy it.
What is DNSSEC?
DNSSEC lets a domain sign its DNS records. A validating resolver checks the signatures and refuses answers that don't match, so nobody on the way can hand you a forged address for a signed domain. The page shows ✓ for resolvers that do (checked with a deliberately broken domain, dnssec-failed.org, which they must refuse). It only helps for domains that are signed, but costs nothing.
Why aren't 114DNS or Baidu DNS tested?
They offer plain DNS only, and their servers don't answer HTTPS at all, so a browser can't reach them in any way. Quad101 (Taiwan) was left out because its DoH didn't answer from abroad in our checks.
What is ECS, and why isn't it shown?
EDNS Client Subnet: some resolvers tell a site's DNS servers part of your address, so a CDN can pick a server near you rather than near the resolver. It can make downloads and video faster, at a small cost in privacy.
It isn't in the table because it isn't a fixed property: in our checks the same resolver passed a subnet from some places and protocols and not from others, so any single yes or no would mislead.
Is my data collected?
No. The queries go straight from your browser to each resolver, and the names asked are popular public sites and random names; nothing about you is in them. This site receives no results. Each resolver sees your address, as with any DNS query; their own privacy policies apply. The code is open source on GitHub.
Cloudflare
Google
Quad9
OpenDNS
AdGuard DNS
AdGuard Unfiltered
NextDNS
Control D
Mullvad
DNS.SB
Hurricane Electric
Wikimedia DNS
CleanBrowsing
Rethink DNS
AliDNS
DNSPod
360 DNS
Yandex DNS
DNS4EU
CIRA Canadian Shield
CZ.NIC ODVR
SWITCH
Digitale Gesellschaft
DNSForge
UncensoredDNS
Applied Privacy
Njalla
DNS4ALL
LibreDNS
Comss.one DNS
Xfinity
Tiarap
IIJ Public DNS