Which one should I pick?
The one at the top is a good choice. If the top few are within a few milliseconds, pick by what else matters to you:
Blocking known malware and phishing sites: Quad9 or OpenDNS.
Privacy: Mullvad, Quad9 and Wikimedia say they don't log who looked up what.
Protection from forged answers: pick one with a ✓, which checks DNSSEC (domain signatures).
If your device only takes plain DNS server addresses (most routers, older systems), look at the UDP column. When the fastest plain DNS isn't the winner, it's named in the line under the winner.
To keep your network and internet provider from seeing which sites you look up, use the DoT or DoH address: plain DNS isn't encrypted, so the networks along the way can read it.
How do I change my DNS?
Android 9 and later: Settings → Network → Private DNS, and enter the DoT hostname (for example one.one.one.one). It works on every network and is encrypted.
iPhone and Mac: enter the DNS servers for each Wi-Fi network. For encrypted DNS, install a configuration profile from the resolver's website.
Windows 11: Settings → Network → your connection → DNS server assignment → Manual. Enter the servers and turn on DNS over HTTPS.
Router: enter the DNS servers in its DHCP or WAN settings, and every device on your network uses them.
Just your browser: Chrome, Edge and Firefox have a Secure DNS setting where you pick a provider or paste a DoH address.
Each resolver's own page has step-by-step setup. Click any address on this page to copy it.
I use a proxy. Is this still my own network's result?
Not by default. With a proxy or VPN on, your browser reaches the resolvers through it, so the test times the proxy's route, and every resolver abroad looks about as fast as your proxy server. The DNS you set on your device or router is normally reached directly, so these numbers aren't what you'd actually get.
To test your own network, add the direct rules (the button next to the progress bar). They send only the addresses this test uses straight out, matched by exact hostname and single IP, and leave all other traffic alone. Clash/Mihomo, Surge, Shadowrocket, Quantumult X, Loon, sing-box and Xray are supported, and most can load the rules from this site so they stay up to date.
How does the test work?
Your browser queries each resolver directly; nothing goes through this site.
First it connects to each one and looks up three popular names once, so they're in that resolver's cache. That part isn't scored. Then come 10 rounds: in each, every resolver is asked once, in a fresh random order, a few at a time. So if your network hiccups, it hits all of them alike, not just the one being tested at that moment. Every other round also looks up a random name that doesn't exist.
The results are medians, so one slow query doesn't drag a score down. Times come from the browser's own network timing, which the page's scripts can't slow down. Every request goes to a new URL and skips every cache, so only the resolver itself can answer.
Why are UDP and DoT estimated?
Because a browser can't measure them. Web pages can only make HTTPS requests: they can't send plain DNS over UDP (port 53), encrypted DNS over TLS (DoT, port 853) or DoQ. No website can measure those from your network; a site that shows such numbers measured from its own server, or guessed.
What this page does instead: it sends DoH, encrypted DNS over HTTPS, to the very server that answers UDP and DoT (for example https://1.1.1.1/dns-query). Once the connection is open, a query takes one round trip to that server plus its processing time. A UDP or DoT query costs exactly that too; HTTPS adds well under a millisecond. Hence the ≈. Where a resolver's plain DNS server doesn't speak HTTPS, you'll see a – rather than a made-up number.
What an estimate can't catch: a network that blocks, slows or tampers with ports 53 or 853 but leaves HTTPS alone.
To measure UDP, DoT and DoQ for real, run the command in the command-line box above the table (the Command line button by the progress bar opens it too) on a server, a Linux machine or a router. It speaks every protocol and tests the same list of resolvers.
How reliable are the results?
The way they're measured is under How does the test work? On top of that, the list is checked from more than one continent with scripts/verify.mjs (in the code repository): every address must answer this kind of query with a real DNS answer, and DNSSEC support is tested, not taken from the resolvers' own claims.
Cloudflare, Google, Quad9, Control D, DNS.SB, DNS4EU and IIJ let web pages read their answers, so the page checks each one and only counts real answers. For the others, the browser can time the answer but not read it.
Run the test a few times, ideally at different hours: what's fastest at night may not be at peak times.
What does First lookup mean?
Popular names are already in every big resolver's cache, so every resolver answers them quickly. A name nobody has looked up in a while is different: the resolver first has to ask that site's own DNS servers, then pass the answer on to you. That's a first lookup.
The test uses random names hosted on Cloudflare, whose DNS servers are almost everywhere except mainland China. This time depends on where each site's DNS servers are, which varies from site to site, so it's shown but not ranked. Resolvers in mainland China look slow in this column because these names' servers are abroad; for Chinese sites they're fast.
What is DNSSEC?
In short: domains sign their DNS records so the answers can't be forged. A resolver that checks DNSSEC verifies the signature and refuses answers that don't match, so nobody along the way can slip you a fake address. A ✓ means the resolver checks it: we test with a deliberately broken domain, dnssec-failed.org, which it must refuse. It only protects domains that are signed, but it has no downside.
What is ECS, and why isn't it in the table?
ECS (EDNS Client Subnet) means a resolver passes part of your IP address on to a site's DNS servers, so a CDN can pick a server near you rather than near the resolver. Downloads and video can be faster, at the cost of revealing a little about where you are.
It isn't in the table because it isn't fixed: in our checks, the same resolver passed it on from some places and over some protocols but not others. A single yes or no would mislead you.
Why aren't 114DNS or Baidu DNS here?
They only offer plain DNS, and their servers don't answer HTTPS at all, so a browser has no way to reach them. Quad101 (Taiwan, China) isn't included either: its DoH didn't answer from other regions when we checked.
Do you collect my data?
No results and nothing about you are kept. The test's queries go straight from your browser to each resolver, and they're for popular public sites and random names; nothing about you is in them. Your results stay in your browser. Only when you click Share are they written into the share link (each resolver's times, no IP address; including your country or region is up to you).
One thing goes to 1ms.dog's own server (in Tokyo): to show which resolver your device really uses, the page looks up a random name under l.1ms.dog, whose DNS server is ours, and after the test sends one such name through each resolver to see which of its servers answers you. That server sees the address of the resolver that asked and, if the resolver passes it on, your network (ECS: the first part of your address, such as 203.0.113.0/24). It keeps them in memory for 2 minutes for the page to fetch from api.l.1ms.dog, then forgets them; nothing is written to disk or to a log. The page shows them to you only; they are never in the share link or card.
As with any DNS query, each resolver sees your IP address, and its own privacy policy applies. The code is open source on GitHub.
Cloudflare
Google
Quad9
OpenDNS
AdGuard DNS
AdGuard Unfiltered
NextDNS
Control D
Mullvad
DNS.SB
Hurricane Electric
Wikimedia DNS
CleanBrowsing
Rethink DNS
AliDNS
DNSPod
360 DNS
Yandex DNS
DNS4EU
CIRA Canadian Shield
CZ.NIC ODVR
SWITCH
Digitale Gesellschaft
DNSForge
UncensoredDNS
Applied Privacy
Njalla
DNS4ALL
LibreDNS
Comss.one DNS
Xfinity
Tiarap
IIJ Public DNS