Choosing a Public DNS Resolver

A lot of technically experienced readers said the obvious answer for them is to run their own recursive resolver with Unbound, dnsdist, dnsmasq, or AdGuard Home. That avoids outsourcing trust, gives you local policy control, and works well in practice for many home setups. The catch is that self-hosting does not hide your queries from your ISP unless you tunnel them to a remote resolver with DoH, DoT, or DoQ, and recursive resolution still leaks some metadata further upstream because authoritative DNS is not universally encrypted. So the trust question never disappears. You are deciding whether to trust your ISP, a public DNS operator, or your own remote infrastructure. The strongest technical theme was that resolver choice can change application performance in ways the usual “faster ping to the resolver” metric misses. Several comments pointed to EDNS Client Subnet and CDN steering. Some public resolvers, notably Cloudflare, do not forward client subnet hints for privacy reasons. That can send users to worse cache nodes for services like YouTube, Akamai, or ISP-integrated caches. In the best-connected networks this is often irrelevant. In markets with poor peering or aggressive ISP routing policies, it can be very noticeable. That pushed the conversation away from blanket recommendations. A privacy-focused resolver may be slower for streaming and downloads, while an ISP resolver may be fastest but more logged, more filtered, or easier for governments and courts to coerce. Privacy claims also got a reality check. Moving away from plaintext port 53 to DoH or DoT absolutely reduces what your ISP can see about your DNS traffic. That is already useful. But it does not make browsing private end to end, because SNI still leaks destination names on many connections and ECH deployment remains incomplete. Several readers thought “DNS privacy is pointless until ECH is universal” was too cynical. The practical view that emerged is simpler: encrypted DNS is worth using today, just do not confuse it with total traffic privacy. People were also skeptical of polished marketing labels like “maximum privacy.” Bus factor, independent auditing, data protection oversight, and operator incentives matter more than a checkbox list. A one-person resolver may be fragile. A large company may be reliable but still subject to corporate data use or government access. Comments singled out independent privacy audits and clear legal accountability as more meaningful signals than branding. That same skepticism showed up around filtered resolvers. Malware and ad blocking at the DNS layer can improve browsing and mobile app experience, but false positives are common enough that many prefer either an unfiltered resolver or one they control with a whitelist. The practical mood was not anti-public-DNS so much as anti-handwaving. Managed services like NextDNS got straightforward praise from people tired of maintaining Pi-hole style setups. Quad9 got support, but also reports of blocklist mistakes and outages. Cloudflare was seen as fast and polished, but its privacy positioning and ECS choice drew scrutiny. The post’s author quickly added a DoH speed test after people asked for region-specific benchmarking, which fit the consensus nicely: you cannot choose well from a generic list alone. You have to test from your own network and optimize for your own threat model.