DNS Test
74.82.42.422001:470:20::2ordns.he.nethttps://ordns.he.net/dns-queryBrowsers can only estimate UDP and DoT. On a VPS, a Linux box or a router, this command measures all five protocols and compares your current DNS.
curl -fsSL https://dns.1ms.dog/i | sh -s -- run -r he,google
CloudflareUDPDoTDoH✓1.1.1.1 1.0.0.12606:4700:4700::1111 2606:4700:4700::1001one.one.one.onehttps://cloudflare-dns.com/dns-query
GoogleUDPDoTDoH✓8.8.8.8 8.8.4.42001:4860:4860::8888 2001:4860:4860::8844dns.googlehttps://dns.google/dns-query
Quad9UDPDoTDoH✓9.9.9.9 149.112.112.1122620:fe::fe 2620:fe::9dns.quad9.nethttps://dns.quad9.net/dns-query
OpenDNSUDPDoTDoH✓208.67.222.222 208.67.220.2202620:119:35::35 2620:119:53::53dns.opendns.comhttps://doh.opendns.com/dns-query
AdGuard DNSUDPDoTDoHDoQ✓94.140.14.14 94.140.15.152a10:50c0::ad1:ff 2a10:50c0::ad2:ffdns.adguard-dns.comhttps://dns.adguard-dns.com/dns-queryquic://dns.adguard-dns.com
AdGuard UnfilteredUDPDoTDoHDoQ✓94.140.14.140 94.140.14.1412a10:50c0::1:ff 2a10:50c0::2:ffunfiltered.adguard-dns.comhttps://unfiltered.adguard-dns.com/dns-queryquic://unfiltered.adguard-dns.com
NextDNSUDPDoTDoHDoQ✓45.90.28.0 45.90.30.02a07:a8c0:: 2a07:a8c1::dns.nextdns.iohttps://dns.nextdns.io/quic://dns.nextdns.io
Control DUDPDoTDoHDoQ✓76.76.2.0 76.76.10.02606:1a40:: 2606:1a40:1::p0.freedns.controld.comhttps://freedns.controld.com/p0quic://p0.freedns.controld.com
MullvadDoTDoH✓dns.mullvad.nethttps://dns.mullvad.net/dns-query
DNS.SBUDPDoTDoH✓185.222.222.222 45.11.45.112a09:: 2a11::dot.sbhttps://doh.dns.sb/dns-query
Hurricane ElectricUDPDoTDoH✓74.82.42.422001:470:20::2ordns.he.nethttps://ordns.he.net/dns-query
Wikimedia DNSDoTDoH✓wikimedia-dns.orghttps://wikimedia-dns.org/dns-query
CleanBrowsingUDPDoTDoH–185.228.168.9 185.228.169.92a0d:2a00:1::2 2a0d:2a00:2::2security-filter-dns.cleanbrowsing.orghttps://doh.cleanbrowsing.org/doh/security-filter/
Rethink DNSDoTDoH✓max.rethinkdns.comhttps://sky.rethinkdns.com/dns-query
AliDNSUDPDoTDoHDoQ–223.5.5.5 223.6.6.62400:3200::1 2400:3200:baba::1dns.alidns.comhttps://dns.alidns.com/dns-queryquic://dns.alidns.com
DNSPodUDPDoTDoH–119.29.29.292402:4e00::dot.pubhttps://doh.pub/dns-query
360 DNSUDPDoTDoH–101.226.4.6 218.30.118.6dot.360.cnhttps://doh.360.cn/dns-query
Yandex DNSUDPDoTDoH–77.88.8.8 77.88.8.12a02:6b8::feed:0ff 2a02:6b8:0:1::feed:0ffcommon.dot.dns.yandex.nethttps://common.dot.dns.yandex.net/dns-query
DNS4EUUDPDoTDoH✓86.54.11.100 86.54.11.2002a13:1001::86:54:11:100 2a13:1001::86:54:11:200unfiltered.joindns4.euhttps://unfiltered.joindns4.eu/dns-query
CIRA Canadian ShieldUDPDoTDoH✓149.112.121.10 149.112.122.102620:10a:80bb::10 2620:10a:80bc::10private.canadianshield.cira.cahttps://private.canadianshield.cira.ca/dns-query
CZ.NIC ODVRUDPDoTDoH✓193.17.47.1 185.43.135.12001:148f:ffff::1 2001:148f:fffe::1odvr.nic.czhttps://odvr.nic.cz/doh
SWITCHDoTDoH✓dns.switch.chhttps://dns.switch.ch/dns-query
Digitale GesellschaftDoTDoH✓dns.digitale-gesellschaft.chhttps://dns.digitale-gesellschaft.ch/dns-query
DNSForgeUDPDoTDoH✓176.9.93.198 176.9.1.1172a01:4f8:151:34aa::198 2a01:4f8:141:316d::117dnsforge.dehttps://dnsforge.de/dns-query
UncensoredDNSUDPDoTDoH✓91.239.100.100 89.233.43.712001:67c:28a4:: 2a01:3a0:53:53::anycast.uncensoreddns.orghttps://anycast.uncensoreddns.org/dns-query
Applied PrivacyDoTDoH✓dot1.applied-privacy.nethttps://doh.applied-privacy.net/query
NjallaUDPDoTDoH✓95.215.19.532001:67c:2354:2::53dns.njal.lahttps://dns.njal.la/dns-query
DNS4ALLUDPDoTDoH✓194.0.5.32001:678:8::3dot.dns4all.euhttps://doh.dns4all.eu/dns-query
LibreDNSDoTDoH–dot.libredns.grhttps://doh.libredns.gr/dns-query
Comss.one DNSDoTDoH–dns.comss.onehttps://dns.comss.one/dns-query
XfinityDoH✓https://doh.xfinity.com/dns-query
TiarapUDPDoTDoH✓174.138.21.128dot.tiar.apphttps://doh.tiar.app/dns-query
IIJ Public DNSDoTDoH✓public.dns.iij.jphttps://public.dns.iij.jp/dns-queryThe image and the link are made here in your browser; nothing is uploaded. The link carries the numbers only.
curl -fsSL https://dns.1ms.dog/i | shcurl -fsSL https://dns.1ms.dog/i | sh -s -- runwget -qO- https://dns.1ms.dog/i | shdnstest -p udp,dot,doqdnstest -r cloudflare,google,alidnsdnstest -6dnstest --json > dns.jsonirm https://dns.1ms.dog/i.ps1 | iexWith a proxy on, the resolvers are reached through it and the test times the proxy's route. These rules send only the addresses the test asks DIRECT; nothing else changes.
Then reload the proxy's config and test again.
Hurricane Electric DNS is a free public DNS service run by Hurricane Electric (United States). It answers plain DNS on 74.82.42.42 (IPv6: 2001:470:20::2), and encrypted DNS: DoT, DoH. Its servers are in many places around the world, and your queries go to the nearest one.
It validates DNSSEC: answers whose signatures don't check out are refused. It doesn't filter: every name resolves as it is.
What to enter to use Hurricane Electric DNS:
DNS (IPv4) 74.82.42.42
DNS (IPv6) 2001:470:20::2
DoT / Private DNS ordns.he.net
DoH https://ordns.he.net/dns-query
Settings → Network & internet → Wi‑Fi or Ethernet → Hardware properties → DNS server assignment → Edit → Manual. Turn on IPv4 and enter 74.82.42.42. To encrypt, set DNS over HTTPS to On (manual template) with https://ordns.he.net/dns-query.
System Settings → Network → Wi‑Fi (or Ethernet) → Details → DNS: press + and add 74.82.42.42. Encrypted DNS (https://ordns.he.net/dns-query) needs a configuration profile.
Settings → Wi‑Fi → ⓘ next to the network → Configure DNS → Manual, and add 74.82.42.42. This is for that Wi‑Fi only; for encrypted DNS on every network, install a DNS profile for https://ordns.he.net/dns-query.
Settings → Network & internet → Private DNS → Private DNS provider hostname: ordns.he.net. It works on every network and is encrypted (DoT). The menu differs a little by brand: search Settings for “Private DNS”.
In the router's admin page (WAN or DHCP settings), set the DNS servers to 74.82.42.42: every device on the network then uses it.
Chrome: Settings → Privacy and security → Security → Use secure DNS → Custom: https://ordns.he.net/dns-query. Edge has the same under Privacy, search, and services. Firefox: Settings → Privacy & Security → DNS over HTTPS → Max Protection → Custom: https://ordns.he.net/dns-query.
With systemd-resolved: put DNS=74.82.42.42 in /etc/systemd/resolved.conf, then run systemctl restart systemd-resolved. For DoT, write the address as 74.82.42.42#ordns.he.net and add DNSOverTLS=yes.
Its plain DNS usually answers, but more slowly, since the servers are outside mainland China, and answers for blocked sites can be forged on the way. Encrypted DNS (DoH, DoT) to it is often blocked or unstable. Run the test on this page: a row with no answer means it isn't reachable from your network.
Neither is faster everywhere: what counts is how far each one's nearest server is from you and how your provider routes there. This page times both, and every other DNS in the list, from your own network in about 20 seconds; the top of the page shows where Hurricane Electric DNS ranks and how far it is behind the fastest.
Usually distance: its nearest server is far away, or your provider routes there the long way. A proxy or VPN carries the queries too, and then the test measures the proxy's route (the direct rules fix that). Some networks slow down or block encrypted DNS. And a name nobody has asked it for yet always takes longer (the Uncached column). If another DNS in the list is clearly faster, switch to it.
Your browser asks every resolver directly; nothing goes through this site. First it opens a connection to each and asks three popular names once, which puts them in the resolver's cache; none of that counts. Then come 10 rounds: in each, every resolver is asked once more, in a new random order, a few at a time, so a burst of trouble on your network hits all of them alike. Every other round also asks a random name that doesn't exist anywhere.
The numbers are medians, so a single slow query doesn't move them. Times come from the browser's own network timing for each request where it has it, which this page's scripts can't delay. Every URL is new and fetched past any cache, so only the resolver itself can answer.
Browsers can only make HTTPS requests. They can't send a UDP query to port 53, open a TLS connection to port 853 (DoT) or speak DoQ, and no website can do that from your network. Any site that shows those numbers measures from its own server or guesses.
What the page can do: send DNS over HTTPS to the very server that answers UDP and DoT (for example https://1.1.1.1/dns-query). On an open connection, a query costs one round trip to that server plus the resolver's work, which is exactly what a UDP or DoT query costs; HTTP adds well under a millisecond. Hence ≈. Where a resolver's plain DNS server has no HTTPS, there's a – instead of a number.
What an estimate can't see: a network that blocks, slows or tampers with port 53 or 853 but leaves HTTPS alone.
To measure UDP, DoT and DoQ for real, run the command-line tool (the command under the table) on a server, a Linux box or a router: it speaks every protocol and uses the same resolver list.
The timing method is described under the first question. On top of that, the list is checked with scripts/verify.mjs (in the repository) from more than one continent: every address must answer this exact kind of query with a real DNS answer, and DNSSEC validation is tested rather than taken from the resolvers' own claims.
Where a resolver allows it (Cloudflare, Google, Quad9, Control D, DNS.SB, DNS4EU, IIJ), the page also reads each answer and only counts real ones. For the others the browser can time the answer but not read it.
Run the test a couple of times, at different hours if you can: what is fastest at night on your network may not be at peak time.
Not by default: with a proxy or VPN on, your browser reaches the resolvers through it, and the test measures the proxy's route (all the resolvers abroad then look about as fast as your proxy server). The resolver you set on your device or router is usually asked directly, so that's not what you'd get.
To test your own network, add the direct rules (the button next to the progress): they send exactly the addresses this test asks straight out, by exact host name and single IP, and nothing else. Clash/Mihomo, Surge, Shadowrocket, Quantumult X, Loon, sing-box and Xray are covered; most can load the rules from this site so they stay current.
Popular names are already in every busy resolver's cache, so asking for them is quick everywhere. A name nobody asked for recently makes the resolver ask that site's own DNS servers first. The test uses random names under a zone hosted on Cloudflare's DNS, which has servers almost everywhere except mainland China.
That cost depends on where each site's DNS servers are, which differs from site to site, so it's shown but not ranked. Resolvers in mainland China look slow here because the zone's servers are abroad; for Chinese sites, whose DNS servers are in China, they are fast.
The fastest one at the top is a good default. If it's close (a few ms), prefer what else matters to you: Quad9 and OpenDNS block known malware and phishing sites; Mullvad, Quad9 and Wikimedia keep no logs of who asked what; resolvers that validate DNSSEC refuse forged answers on signed domains.
If your device only lets you enter plain DNS server addresses (most routers, older systems), look at the UDP column: the line under the winner names the fastest plain DNS when it's a different one.
For privacy from your network and ISP, use the DoT or DoH address: plain DNS travels unencrypted.
Android 9+: Settings → Network → Private DNS → enter the DoT host (for example one.one.one.one).
iPhone and Mac: per Wi-Fi network, enter the DNS servers; for encrypted DNS install a configuration profile from the resolver's website.
Windows 11: Settings → Network → your connection → DNS server assignment → Manual, enter the servers and set DNS over HTTPS to On.
Router: put the DNS servers in its DHCP or WAN settings and every device on the network uses them.
Browser only: Chrome, Edge and Firefox have a Secure DNS setting where you pick a provider or paste the DoH address.
Click any address on this page to copy it.
DNSSEC lets a domain sign its DNS records. A validating resolver checks the signatures and refuses answers that don't match, so nobody on the way can hand you a forged address for a signed domain. The page shows ✓ for resolvers that do (checked with a deliberately broken domain, dnssec-failed.org, which they must refuse). It only helps for domains that are signed, but costs nothing.
They offer plain DNS only, and their servers don't answer HTTPS at all, so a browser can't reach them in any way. Quad101 (Taiwan) was left out because its DoH didn't answer from abroad in our checks.
EDNS Client Subnet: some resolvers tell a site's DNS servers part of your address, so a CDN can pick a server near you rather than near the resolver. It can make downloads and video faster, at a small cost in privacy.
It isn't in the table because it isn't a fixed property: in our checks the same resolver passed a subnet from some places and protocols and not from others, so any single yes or no would mislead.
No. The queries go straight from your browser to each resolver, and the names asked are popular public sites and random names; nothing about you is in them. This site receives no results. Each resolver sees your address, as with any DNS query; their own privacy policies apply. The code is open source on GitHub.