Free public DNS servers you can use instead of your internet provider's, including Canada's own CIRA Canadian Shield.
Last verified October 16, 2026. Each address below answered a live DNS query, and its owner was confirmed in the regional internet registry. Want to see them side by side? Run any domain through the DNS propagation checker, which queries 12 of these resolvers at once.
Run by CIRA, the Canadian non-profit that operates the .ca registry. Three tiers, each with two addresses.
| Service | IPv4 | IPv6 | Notes |
|---|---|---|---|
| CIRA Canadian Shield, Private | 149.112.121.10149.112.122.10 | 2620:10a:80bb::102620:10a:80bc::10 | No filtering |
| CIRA Canadian Shield, Protected | 149.112.121.20149.112.122.20 | 2620:10a:80bb::202620:10a:80bc::20 | Blocks malware and phishing |
| CIRA Canadian Shield, Family | 149.112.121.30149.112.122.30 | 2620:10a:80bb::302620:10a:80bc::30 | Blocks malware, phishing and adult content |
The most widely used public resolvers. Fast, reliable and available almost everywhere.
| Service | IPv4 | IPv6 | Notes |
|---|---|---|---|
| Google Public DNS | 8.8.8.88.8.4.4 | 2001:4860:4860::88882001:4860:4860::8844 | No filtering |
| Cloudflare | 1.1.1.11.0.0.1 | 2606:4700:4700::11112606:4700:4700::1001 | No filtering |
| Quad9 | 9.9.9.9149.112.112.112 | 2620:fe::fe2620:fe::9 | Blocks known malicious domains; run by a Swiss non-profit |
| Cisco OpenDNS | 208.67.222.222208.67.220.220 | 2620:119:35::352620:119:53::53 | No filtering on these addresses |
Resolvers that block ads, trackers or malicious sites before they load.
| Service | IPv4 | IPv6 | Notes |
|---|---|---|---|
| AdGuard DNS (default) | 94.140.14.1494.140.15.15 | 2a10:50c0::ad1:ff2a10:50c0::ad2:ff | Blocks ads, trackers and malicious domains |
| AdGuard DNS (non-filtering) | 94.140.14.14094.140.14.141 | 2a10:50c2::1:ff2a10:50c2::2:ff | No filtering |
| CleanBrowsing (Security filter) | 185.228.168.9185.228.169.9 | 2a0d:2a00:1::22a0d:2a00:2::2 | Blocks malicious domains |
| Control D (unfiltered) | 76.76.2.076.76.10.0 | 2606:1a40::2606:1a40:1:: | No filtering |
Resolvers that also support encrypted DNS (DNS-over-HTTPS and DNS-over-TLS).
| Service | IPv4 | IPv6 | Notes |
|---|---|---|---|
| DNS.SB | 185.222.222.22245.11.45.11 | 2a09::2a11:: | Supports DoH and DoT |
General-purpose resolvers run by large network operators.
| Service | IPv4 | IPv6 | Notes |
|---|---|---|---|
| Verisign Public DNS | 64.6.64.664.6.65.6 | 2620:74:1b::1:12620:74:1c::2:2 | General-purpose |
| Hurricane Electric | 74.82.42.42 | 2001:470:20::2 | General-purpose |
| UltraDNS Public (Vercara) | 156.154.70.1156.154.71.1 | Not listed | General-purpose |
Public resolvers operated from other countries. They work worldwide, but answers can be slower from Canada.
| Service | IPv4 | IPv6 | Notes |
|---|---|---|---|
| Yandex DNS (Russia) | 77.88.8.877.88.8.1 | 2a02:6b8::feed:0ff2a02:6b8:0:1::feed:0ff | No filtering on these addresses |
| AliDNS (China) | 223.5.5.5223.6.6.6 | 2400:3200::12400:3200:baba::1 | General-purpose |
| KT (South Korea) | 168.126.63.1168.126.63.2 | Not listed | Run by Korea Telecom |
For most people, CIRA Canadian Shield, Cloudflare or Google is a safe, fast default. Pick Protected or Quad9 if you want malware blocking, or an AdGuard filtering resolver if you want ad and tracker blocking. Always enter both addresses of a service (primary and secondary), and write down your old settings so you can switch back. Our step-by-step guides cover Windows 11, macOS, iPhone and Chromebook.
A public DNS server (or public resolver) is a DNS service anyone can use instead of their internet provider's. You enter its addresses in your router or device, and it answers the lookups that turn website names into IP addresses.
Not by default. The operator can see which domains you look up, so choose one whose privacy policy you accept. Resolvers that support DNS-over-HTTPS or DNS-over-TLS also hide your lookups from other people on the network. See our guide to DNS-over-HTTPS.
It depends on your provider and location, so measure instead of guessing. Our propagation checker shows each resolver's response time from our servers, and our guide to the fastest public DNS servers explains how to benchmark from your own connection.
Yes. CIRA Canadian Shield is run by CIRA, the not-for-profit that manages the .ca registry. See our Canadian Shield setup guide.
Most ISP resolvers only answer queries from their own customers, so they are not public. Addresses you find for them online are often outdated or wrong. To see the resolver your connection is using right now, check your router's status page or run ipconfig /all (Windows) or scutil --dns (macOS).