For most users, Cloudflare 1.1.1.1 is faster than Google 8.8.8.8 based on independent global benchmarks that measure average DNS response time across hundreds of vantage points worldwide. The practical gap is usually under 10 milliseconds per query, but a single web page can trigger 20 or more DNS lookups, so the difference compounds across a browsing session. Your result depends on your location and ISP — the commands below let you measure it directly in under a minute.

What these resolvers actually are

Both 1.1.1.1 and 8.8.8.8 are recursive DNS resolvers — free public services that accept DNS queries from any device and return the corresponding IP address. When you type a domain into a browser, your OS sends a query to whichever resolver is configured. That resolver walks the DNS hierarchy from root servers downward, caches the answer, and returns it. Your ISP assigns a resolver by default, but you can override it on your router or individual devices at any time.

Google Public DNS (8.8.8.8, secondary 8.8.4.4) launched in December 2009 as the first widely-used alternative to ISP resolvers. For technical details on how it operates, see the Google Public DNS documentation. Cloudflare 1.1.1.1 (secondary 1.0.0.1) launched in April 2018, built directly on top of Cloudflare's existing global anycast network. Independent performance tracking placed it as the fastest average public resolver almost immediately after launch, and it has held that position in most regions since.

Why one resolver can be faster than the other

  1. Anycast network density: Both resolvers announce the same IP address from dozens of data centres simultaneously, and your query routes to the nearest one. Cloudflare operates one of the densest anycast networks on the internet, with nodes co-located inside major internet exchanges. Fewer network hops to the nearest node means lower round-trip time.
  2. Cache hit rate: A resolver that has already answered a query returns the cached result in single-digit milliseconds. Both Google and Cloudflare handle billions of queries per day, giving both very high cache hit rates. On a cache miss — a rarely-requested domain — both resolvers must recurse through root and authoritative nameservers, a process that takes roughly the same time regardless of which resolver you use.
  3. Your ISP's peering relationships: Your ISP may have a direct interconnect with Cloudflare but reach Google over a transit provider, or vice versa. This is entirely outside either resolver's control. It is also the main reason results vary between users in the same city — the only way to know which resolver wins on your specific connection is to test it directly.

Check your current DNS resolver first

Before benchmarking or switching anything, confirm what resolver your device is currently using. This shows whether you are on an ISP-assigned resolver or have previously configured a custom one.

# Linux — systemd-resolved resolvectl status | grep DNS # Linux — legacy cat /etc/resolv.conf # macOS scutil --dns | grep nameserver # Windows (Command Prompt) ipconfig /all # Look for DNS Servers under your active adapter

If the result is a private IP address (192.168.x, 10.x, or 172.16–31.x), your router is acting as a DNS forwarder. Log in to your router admin panel and check the WAN or DNS settings to find the actual upstream resolver it is forwarding to.

How to benchmark 1.1.1.1 vs 8.8.8.8 from your machine

Test against a domain you actually visit rather than google.com. Very popular domains are almost always cached by both resolvers, which hides the cold-query latency difference. A moderately popular news or media domain gives a more realistic reading.

Linux and macOS

# Five queries — Cloudflare for i in {1..5}; do dig @1.1.1.1 bbc.com +noall +stats 2>&1 | grep "Query time"; done # Five queries — Google for i in {1..5}; do dig @8.8.8.8 bbc.com +noall +stats 2>&1 | grep "Query time"; done

The Query time line is in milliseconds. Average the five results for each resolver. If both come within 5 ms of each other, treat them as equivalent on your connection and base your choice on privacy and features instead.

Windows (PowerShell)

Measure-Command { Resolve-DnsName -Name bbc.com -Server 1.1.1.1 } | Select-Object TotalMilliseconds Measure-Command { Resolve-DnsName -Name bbc.com -Server 8.8.8.8 } | Select-Object TotalMilliseconds
Tip: Run each benchmark three to five times and take the median, not the minimum. First-query results include connection overhead and can be unrepresentative. After switching resolvers, use our DNS Propagation Checker to verify your own domains are resolving correctly through both networks.

Privacy: a meaningful difference

Cloudflare 1.1.1.1 commits to not selling query data or using it for advertising and to purging all logs within 24 hours. This commitment is independently audited by KPMG and the audit reports are published publicly on the 1.1.1.1 product page.

Google 8.8.8.8 does not tie DNS queries to individual Google accounts and does not use them for ad targeting directly. Query data is stored temporarily and used in aggregate to improve the service. If you are already embedded in Google's infrastructure — Workspace, Android, Google Cloud — using 8.8.8.8 adds no meaningful new exposure. If limiting your DNS data footprint is a priority, Cloudflare's independently audited commitment is the stronger option.

Features beyond basic resolution

Encrypted DNS: DoH and DoT

Both resolvers support DNS over HTTPS (DoH) and DNS over TLS (DoT), which encrypt queries between your device and the resolver. Without encryption, every domain name you look up is visible to your ISP and any network intermediary — even when the destination site itself uses HTTPS.

  • Cloudflare DoH endpoint: https://cloudflare-dns.com/dns-query
  • Cloudflare DoT hostname: one.one.one.one (port 853)
  • Google DoH endpoint: https://dns.google/dns-query
  • Google DoT hostname: dns.google (port 853)

In 2026, Windows 11 (22H2 and later), macOS 13 and later, Android 9 and later, and iOS 14 and later all support DoH or DoT natively without additional software. Enabling encrypted DNS is a one-time setting change that also closes the ISP visibility gap that plain DNS leaves open.

Filtering variants

Cloudflare publishes two filtered resolver addresses alongside 1.1.1.1:

  • 1.1.1.2 — blocks known malware and phishing domains
  • 1.1.1.3 — blocks malware, phishing, and adult content

Google 8.8.8.8 does not have a DNS-layer equivalent. Google Safe Browsing operates inside Chrome at the browser level, not at the DNS level, so it covers only Chrome — not smart TVs, game consoles, or any other device on your network. For whole-network malware blocking with no software to install, 1.1.1.2 is a one-IP-address change that covers every device on the network.

DNSSEC validation

Both resolvers perform full DNSSEC validation by default. If a domain's DNS records are cryptographically signed and those signatures do not match, both resolvers return SERVFAIL rather than the tampered response. This protects against DNS cache poisoning attacks with no configuration required on your end.

IPv6 resolver addresses

  • Cloudflare: 2606:4700:4700::1111 and 2606:4700:4700::1001
  • Google: 2001:4860:4860::8888 and 2001:4860:4860::8844

On dual-stack (IPv4 + IPv6) networks, configure both address families. Your OS will use whichever protocol it prefers and fall back to the other if needed.

How to switch your DNS resolver

Set DNS at the router level to cover every device on your network automatically. Set it at the OS or adapter level to change only one machine.

Router (recommended for home networks)

Log in to your router admin panel. Access URLs vary by brand:

  • TP-Link: tplinkwifi.net or 192.168.0.1
  • Netgear (non-Orbi): routerlogin.net or 192.168.1.1
  • Netgear Orbi: orbilogin.com or 192.168.1.1
  • Asus: asusrouter.com or 192.168.1.1
  • Linksys: linksyssmartwifi.com or 192.168.1.1
  • Xiaomi MiWifi: miwifi.com or 192.168.31.1

Navigate to the WAN or Internet section and find the DNS server fields. Some routers have a separate DNS entry under LAN or DHCP settings that controls what gets pushed to client devices — set both to your chosen resolver. Menu labels vary by firmware version; look for anything labelled Primary DNS, DNS Server 1, or Custom DNS.

On OpenWrt: edit /etc/config/dhcp, update the option server lines under the dnsmasq section, then run service dnsmasq restart. On DD-WRT: go to Setup > Basic Setup > Network Address Server Settings and enter the IPs in the Static DNS fields.

Windows 10 and 11

1. Settings > Network & Internet 2. Click your active connection > Hardware properties 3. Click Edit next to DNS server assignment 4. Switch dropdown to Manual 5. Toggle IPv4 on > Preferred DNS: 1.1.1.1 > Alternate DNS: 1.0.0.1 6. Windows 11 22H2+: set DNS over HTTPS to On (automatic template) 7. Click Save

macOS Ventura and later

1. System Settings > Network 2. Select your active connection > Details 3. Click the DNS tab 4. Click + and add 1.1.1.1, then add 1.0.0.1 5. Remove any old DNS entries 6. Click OK, then Apply

Linux — systemd-resolved

sudo nano /etc/systemd/resolved.conf # Under [Resolve], add or update: DNS=1.1.1.1 1.0.0.1 FallbackDNS=8.8.8.8 8.8.4.4 sudo systemctl restart systemd-resolved resolvectl status

On NetworkManager-based systems such as Ubuntu Desktop or Fedora, you can also set DNS per-connection: nmcli con mod "Your Connection" ipv4.dns "1.1.1.1 1.0.0.1" followed by nmcli con up "Your Connection".

Android 9 and later

Settings > Network & internet > Advanced > Private DNS Select: Private DNS provider hostname Enter: one.one.one.one (Cloudflare with DoT) or: dns.google (Google with DoT) Tap Save

This setting is system-wide and applies to cellular data as well as Wi-Fi. It uses DoT automatically, so your mobile carrier cannot see your DNS queries.

iOS and iPadOS

  1. Per Wi-Fi network (no encryption): Settings > Wi-Fi > tap the (i) next to your network > Configure DNS > Manual > Add Server: 1.1.1.1
  2. System-wide with DoH: Install the free Cloudflare 1.1.1.1 app. It installs a DNS configuration profile that covers all networks including cellular, with no VPN or jailbreak required.
Tip: After any DNS change, flush the local cache so stale records do not linger. Windows: run ipconfig /flushdns in an elevated Command Prompt. macOS: run sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponder. Linux: run resolvectl flush-caches. Then use the DNS Lookup tool to confirm your domain resolves to the expected IP address through the new resolver.

How to confirm the change worked

# Linux / macOS — which resolver is actually answering? dig google.com # Look for the SERVER: line in the output # Test Cloudflare's whoami endpoint dig whoami.cloudflare.com TXT @1.1.1.1 # Returns the source IP Cloudflare sees for your queries # Windows — check active resolver nslookup google.com # First output line reads Server: — should match what you configured

If the active resolver shown is still your ISP's IP after the change, your router may be intercepting DNS queries via DHCP override. Either change DNS at the router level, or use DoH or DoT at the OS level — encrypted DNS bypasses the DHCP-assigned resolver entirely because it does not use port 53.

Common misdiagnoses

  • "I switched DNS but pages still load at the same speed." DNS is one component of page load time. After the IP address is resolved, TCP connection setup, TLS handshake, and server response time dominate. Faster DNS saves milliseconds per lookup, not seconds per page — the improvement is real but not dramatic.
  • "1.1.1.1 is blocked on my network." Some corporate firewalls intercept port 53 traffic and redirect it to an internal resolver regardless of what IP you configure. Use DoH (port 443) to bypass this — encrypted DNS traffic to cloudflare-dns.com or dns.google over HTTPS is indistinguishable from ordinary web traffic.
  • "Changing DNS on my device didn't work — the router overrides it." Routers running a local DNS forwarder (common on ISP gateway devices and Pi-hole setups) pass all client queries through themselves first, ignoring per-device settings. Change DNS at the router, or use DoH or DoT at the OS level to bypass the forwarder.
  • "Google 8.8.8.8 must be more reliable because it has been around longer." Both resolvers operate with global anycast and redundant infrastructure. Neither has a reliability advantage over the other that is relevant to everyday use.

Which resolver should you use?

Start with 1.1.1.1 as primary and 8.8.8.8 as secondary. This gives you Cloudflare's performance edge and stronger privacy commitment as the first-choice resolver, with Google's independent global network as a genuine fallback — two separate anycast infrastructures, not two addresses on the same one. Enable DoH or DoT where your platform supports it natively to close the ISP visibility gap. For households or small offices wanting DNS-layer malware blocking with no additional software or hardware, substitute 1.1.1.2 for 1.1.1.1. If the benchmark test above shows Google winning on your specific connection, use 8.8.8.8 as primary without hesitation — measured data from your own network matters more than any general recommendation.