Article
The article presents a filterable comparison workflow for 29 global public DNS resolvers, letting users narrow by factors such as privacy, malware blocking, parental controls, speed, IPv6, and jurisdiction, then compare transports, DNSSEC status, logging, and features side by side. It summarizes peer-reviewed evidence that encrypted transports (DoH, DoT) usually add small overhead in page loading but can be slower on lossy links or compared with plain DNS, and notes that performance is provider- and region-dependent. It highlights operational risk: a large encrypted-DNS study found many DoT setups issuing invalid TLS certificates, so resolver quality is uneven. It also stresses that any resolver learns queried domains, so no-logging operators or ODoH designs are the strongest privacy options when minimizing data concentration. DNSSEC validation is treated as a reliability baseline because it is the only mechanism that blocks spoofed records, and it reports that major providers including Google, Cloudflare, and Quad9 handled the KSK rollover correctly. The article also compares EDNS Client Subnet behavior, indicating a privacy versus CDN geolocation trade-off, and notes legal jurisdiction affects compulsion and logging exposure. It discusses protocol choices, citing that DoQ can be faster than DoT/DoH but may incur QUIC address-validation delays, while DNSCrypt avoids plaintext leakage at first packet and CA dependence. It adds caveats that traffic analysis can still infer queries, and that resolvers differ materially in Extended DNS Error behavior, which impacts troubleshooting quality.
Commenters praise the practical value of the framework more than the specific list and emphasize that experienced users can replicate many filtering features themselves with self-hosted DNS infrastructure. They are skeptical of trust signals, pointing out that some entries reveal regulatory control while many omit operator transparency, and they question resilience and governance assumptions such as low bus factor or opaque ownership. Several note regulatory exposure beyond obviously sensitive regions and cite operational reliability as a real criterion, referencing outages and geographic availability limits in some services. One commenter requests local network-based benchmark numbers, especially median and P90 query latency, as a missing piece for real-world selection. Another describes a concrete setup using Unbound with built-in DoH and hourly prefetching, showing that local control can improve debugging, flexibility, and confidence. The thread also contains a practical preference cluster: Quad9 is accepted as a reasonable default, while another states 9.9.9.9/1.1.1.1 suffices, reinforcing that users still converge on defaults despite nuanced comparisons.