Private DNS Without the Hype: Quad9 vs Cloudflare vs NextDNS

Every time a device needs to reach a domain name, it usually asks a Domain Name System resolver for an address. The resolver can observe those questions. Your internet provider's default resolver is one option; Quad9, Cloudflare 1.1.1.1 and NextDNS are alternatives with different policies and controls.

“Private DNS” is an imprecise label. Encryption can protect a query between your device and the resolver from casual observation or alteration in transit. The resolver still handles the query. The destination may still see your connection. Your browser, account, device, VPN and network operator remain separate parts of the privacy boundary.

What changing DNS does—and does not do

A resolver translates a requested name into network information and may cache the result. A filtering resolver can refuse to answer for domains on a threat or policy list. DNS over HTTPS and DNS over TLS encrypt the connection from the client to the configured resolver when the operating system, browser or router actually uses those protocols.

That does not encrypt ordinary web traffic by itself; HTTPS does that. It does not hide the destination IP address from the networks carrying the connection. It does not prevent a signed-in service from knowing who you are. It does not remove malware already on a device. Treat DNS as one control, not a privacy invisibility cloak.

Compare the policy before the brand

1. Logging. What query and source-address data is retained, for how long and for which stated purpose?
2. Filtering. Is blocking limited to known security threats, expanded to content categories or entirely configurable?
3. Encryption. Does your exact device or router support DoH or DoT, and can applications bypass it?
4. Account model. Does the service work without an account, or do customization and logs create a persistent profile?
5. Failure behavior. What happens if the resolver, profile or filtering rule breaks?
6. Jurisdiction and governance. Which entity operates the service and under what published policy?
7. Maintenance. Who will review blocklists, false positives, devices and recovery instructions?

Quad9: simple security filtering with no account

Quad9 is operated by a Swiss nonprofit foundation. Its standard service uses the memorable addresses 9.9.9.9 and 149.112.112.112 and blocks domains associated with security threats. Quad9 says this protection is about malicious hostnames, not advertising or general content filtering. It also offers variants with different features, so copy the exact addresses from its current service page.

Quad9's privacy policy, version 1.1 published June 24, 2026, says the reply-to IP address needed to answer a query is held briefly in volatile memory and not copied to permanent storage. Read the policy and its anomalous-conditions boundary rather than reducing it to “no logs.”

Fits: a household that wants a low-maintenance resolver with security-domain blocking and no personal dashboard. Tradeoff: it is not an ad blocker, family-content filter or custom policy engine. False positives can still happen, and the security list is a judgment made by upstream threat intelligence.

Cloudflare 1.1.1.1: a general resolver with documented retention

Cloudflare's standard 1.1.1.1 resolver does not block content. Its separate 1.1.1.2 service blocks malware, while 1.1.1.3 adds adult-content filtering; each has paired addresses documented in the official setup guide.

Cloudflare says it does not sell or share Public Resolver personal data or use it to target advertising. Its policy says the source IP is not retained in nonvolatile storage, while truncated IP and other limited transaction data are deleted within 25 hours. It also describes limited APNIC access to anonymized research data. Those details are more informative than the word “private.”

Fits: people who want a straightforward public resolver and prefer a large operator with extensive documentation. Tradeoff: standard 1.1.1.1 adds no filtering, and using a major infrastructure provider concentrates another part of network activity with that provider.

NextDNS: granular policy with an account-shaped tradeoff

NextDNS is built around configurable profiles. Users can select threat protection, privacy lists, parental controls, allowlists, denylists and logging choices. Its privacy page says query logging is disabled by default unless a user enables features that require it; users can configure retention and storage location and can export or delete stored logs.

The official pricing page listed a free tier of 300,000 queries per month when checked. After the limit, the service continues as classic, nonblocking DNS for the remainder of that period. A paid Pro tier removes the query limit. Prices and plan boundaries are volatile; check the official page before choosing.

Fits: a household or individual willing to maintain custom policy and troubleshoot blocked services. Tradeoff: customization creates work and may create account-linked data, depending on the settings chosen. More blocklists are not automatically better; overlapping lists increase breakage without proving greater protection.

The safe setup sequence

1. Write down the current DNS setting and take a screenshot of the router or device configuration.
2. Choose one goal: threat blocking, transport encryption, custom filtering or resolver-policy preference.
3. Start on one noncritical device, not the whole router. Use the provider's official instructions.
4. Confirm which protocol is active. A plain IP address entered in a router may not mean encrypted DNS.
5. Test ordinary browsing, software updates, streaming, work login and any school or smart-home service you depend on.
6. Review the provider's test page and check for unexpected resolver leakage, while remembering that browser and OS behavior can differ.
7. Run the test for a week. Record false positives and whether anyone bypassed the configuration.
8. Move to the router only if household-wide policy is worth the troubleshooting burden. Keep per-device exceptions documented.

Common failure modes

• The encryption assumption: entering resolver IP addresses does not guarantee DoH or DoT.
• The browser override: a browser can use its own secure-DNS setting instead of the operating system or router choice.
• The VPN override: a VPN may provide DNS or handle queries differently while connected.
• The blocklist pile: enabling every list makes failures hard to attribute and repair.
• The forgotten profile: a custom endpoint tied to an old account or configuration silently stops matching current needs.
• The anonymity claim: moving DNS trust does not conceal account activity or destination connections.

The no-buy and no-change options

All three services can be used without buying hardware, and Quad9 and Cloudflare do not require a consumer account for basic resolution. You may not need to change anything. If the real problem is invasive websites, start with a more private browser configuration. If it is account takeover, use a password manager and strong second factor. If it is retained personal information, work through data minimization.

Official sources and volatile details

• Quad9, service addresses and features, threat blocking and privacy policy.
• Cloudflare, 1.1.1.1 setup and Public DNS Resolver privacy policy.
• NextDNS, privacy and pricing.

Network settings vary by device, router, browser, VPN and administrator policy. In a workplace or school, do not bypass required network controls.