Serious Discussion DNS Providers for Home Users – Still Cloudflare/Quad9, or Did NextDNS/Control D Finally Win?

What DNS provider(s) do you force on your home network / PC?

  • Cloudflare 1.1.1.1 (or 1.1.1.2/3) – speed king

  • Quad9 – best free malware/phishing blocking

  • Google 8.8.8.8 – I don’t care, just works

  • NextDNS – worth the config time and (sometimes) the $20/year

  • Control D – NextDNS but better UI and free tier actually good

  • AdGuard DNS – most aggressive ad/tracker blocking for free

  • Mullvad DNS / DNSCrypt – paranoid zero-log gang

  • My ISP’s DNS – yes I’m that guy

  • Self-hosted (Pi-hole, AdGuard Home, Technitium, etc.)

  • Mix – different DNS per device/profile


Results are only viewable after voting.
ControlD uses a feed of domains registered daily.
They will not perform a real time whois on all domains, as this will be costly, unreliable and very slow.

The feeds come from a third-party supplier.

If the supplier has issues such as delays, technical problems, poor coverage and so on, ControlD inevitably fails at blocking NRD.

Cloudflare has much better partnerships than ControlD.

However, the standard 1.1.1.1 with malware blocking is the mediocrity itself.
 
You can use:
Thanks
ControlD uses a feed of domains registered daily.
They will not perform a real time whois on all domains, as this will be costly, unreliable and very slow.

The feeds come from a third-party supplier.

If the supplier has issues such as delays, technical problems, poor coverage and so on, ControlD inevitably fails at blocking NRD.

Cloudflare has much better partnerships than ControlD.

However, the standard 1.1.1.1 with malware blocking is the mediocrity itself.
This is very informative, thanks. I set up a free account to try Cloudflare Zero Trust, and it seems to offer more content and security filtering options than ControlD. However, ControlD has AI-based malware filtering and supports third-party blocklists from Hagezi. CFZT portal also includes network filtering and HTTP filtering settings but I'm not sure of their effectiveness.
 
You can use:
This test shows which DNS you're using, not if the DNS filtering is working.

If someone wants to test if their DNS filtering is working correctly, they can either visit a domain present in the blocklist one uses, or manually block some domain in the control panel and then try to visit it. If you can't access the website under blocked domain, then the filtering works. If you can still visit the website, then something went wrong.
 
Last edited:
  • +Reputation
Reactions: simmerskool
This test shows which DNS you're using, not if the DNS filtering is working.

It shows that the request is sent properly to the DNS resolver. This method is recommended by Control D.
This method cannot show what Control D is doing with the request. The method posted by you also cannot be used to confirm if all aspects of filtering work well. This would require more comprehensive testing on URLs.
 
It shows that the request is sent properly to the DNS resolver. This method is recommended by Control D.
Actually, what these DNS leak testing sites do is fire up bunch of requests in order to find out which DNS resolvers resolved the query. The purpose of these sites is to show you if any requests were answered by DNS resolver that you didn't set or use.
The method posted by you also cannot be used to confirm if all aspects of filtering work well. This would require more comprehensive testing on URLs.
Correct method would be test all blocked domains, but it's hella lot of work and testing few random domains will do the job. Beside, you can always look at logs to see what was blocked and what not.
 

You may also like...