Every time you open a website, your device first asks a DNS server to turn the name into an address. That server sees every site you visit, can be slow or fast, and decides whether you can reach a site at all. Most people have never chosen theirs. It was picked for them by their internet provider or their router.
Here is how to find out which one you are using, how to see the one that really answers, and how the popular public options compared when we tested them.
Find your DNS server on every device
Windows
Open Command Prompt and run:
ipconfig /all
Find your active connection (Wi-Fi or Ethernet) and read the DNS Servers line. In PowerShell this gives a shorter list:
Get-DnsClientServerAddress -AddressFamily IPv4
Or go through Settings: Network and internet, choose your connection, then Hardware properties, and look for DNS server assignment.
Mac
Open System Settings, choose Network, click your connection, then Details, then the DNS tab. Addresses shown in grey were handed out by the network. Addresses in black were set by hand.
In Terminal:
scutil --dns | grep nameserver
Linux
On most current distributions, which use systemd-resolved:
resolvectl status
Look for Current DNS Server. On older setups, cat /etc/resolv.conf shows the nameserver lines.
iPhone and iPad
Open Settings, tap Wi-Fi, tap the blue info button next to your network, and scroll to Configure DNS. The addresses listed are the ones the network assigned. On mobile data there is no screen for this; use the method in the next section.
Android
Android shows Private DNS under Settings, Network and internet (the exact menu name varies by brand). If it says Off or Automatic, your phone uses whatever the network provides, and most phones do not show that address anywhere in the settings. Use the method below to find it.
Your router
Most devices show the router as the DNS server, often 192.168.0.1 or 192.168.1.1. Log in to the router's admin page (that same address in a browser) and look under WAN, Internet or DNS settings to see where it forwards your lookups.
See the resolver that really answers
The address in your settings is often just your router, which passes everything to another server. To see the server that actually does the work, ask a domain that reports back who asked.
nslookup whoami.akamai.net
The address in the answer is the outgoing address of the resolver that queried Akamai on your behalf. Look it up with our IP lookup and you will see whether it belongs to your internet provider, your VPN, Google, Cloudflare or someone else.
Google runs a similar check that also shows how much of your own address the resolver passes along:
nslookup -type=TXT o-o.myaddr.l.google.com
The first answer is the resolver's address. If a second answer starts with edns0-client-subnet, the resolver is forwarding part of your IP address to the servers it asks. More on that below.
If you use a VPN, the DNS leak test is the quicker route: it shows every resolver your lookups reach and flags the ones that do not belong to the VPN. Our guide on how to check for a DNS leak explains the results.
How the big public resolvers compared
We tested four public resolvers on 23 October 2026 through their DNS over HTTPS services, the same way a browser with secure DNS turned on reaches them. Three questions mattered:
- Do they validate DNSSEC? We asked each one for dnssec-failed.org, a domain whose security signatures are broken on purpose. A resolver that checks signatures must refuse to answer.
- Do they pass part of your IP address on? Some resolvers include the first part of your address (a "client subnet") when they ask a website's DNS servers, so the site can pick a nearby server. It helps speed a little and costs a little privacy.
- Do they answer normal queries correctly? All of them did.
| Resolver | Addresses | Refused broken DNSSEC domain | Passed part of your IP on | Filtering |
|---|---|---|---|---|
| Google Public DNS | 8.8.8.8, 8.8.4.4 | Yes | Yes, your /24 | None |
| Cloudflare | 1.1.1.1, 1.0.0.1 | Yes | No | None (1.1.1.2 blocks malware, 1.1.1.3 adds adult content) |
| AdGuard DNS | 94.140.14.14, 94.140.15.15 | Yes | A /24, but not ours | Blocks ads and trackers |
| Quad9 | 9.9.9.9, 149.112.112.112 | Not tested | Not sent on 9.9.9.9, per Quad9 | Blocks known malicious domains |
A few notes on what we saw:
- Google forwarded our real /24. The test answer contained our own network's first three numbers. That is documented behaviour: Google sends a client subnet so content networks can choose a server close to you.
- Cloudflare forwarded nothing. Its answer contained only Cloudflare's own address.
- AdGuard sent a subnet that was not ours. The answer included a /24 from a completely different network. It appears AdGuard sends an approximate location instead of your real address, which gives some of the speed benefit without exposing your network.
- Quad9 could not be reached from our test connection. Quad9's own documentation says 9.9.9.9 does not send client subnet data and 9.9.9.11 does, so you can choose.
Speed depends almost entirely on where you are, so we are not publishing a speed ranking from one location. The fastest resolver for you is usually the one with a server in your city. If you want to compare, run nslookup example.com 1.1.1.1 and the same with 8.8.8.8 and 9.9.9.9 a few times each and see which comes back quickest.
When it is worth changing your DNS server
- Sites do not load, or load slowly, but your connection is fine. Your provider's resolver may be overloaded or broken. Switching usually fixes it at once.
- You want fewer ads or some protection from malicious sites. AdGuard DNS, Quad9 or Cloudflare's 1.1.1.2 filter at the DNS level, with no software to install.
- You do not want your provider to see every site you visit. Change the resolver and turn on DNS over HTTPS in your browser or system settings, otherwise the lookups still travel in plain text.
- Leave it alone at work or school. Those networks often rely on their own DNS to reach internal systems.
The bottom line
Your DNS server is listed in your network settings, but that is often just your router. To see the resolver that really answers, run nslookup whoami.akamai.net and look up the address it returns. If you are choosing a public resolver, our test found that Cloudflare's 1.1.1.1 passed none of your IP on to websites, Google passed your /24, and Google, Cloudflare and AdGuard all checked DNSSEC signatures properly. To see which resolvers your lookups reach right now, including through a VPN, run our DNS leak test.