Your ISP's default DNS server logs every domain you visit. Not the full URL, not the page content: the domain name for every request your device makes. Switching to a private DNS service takes under five minutes, costs nothing, and removes that log from your ISP's records. Below: what changes, what does not, and how to set it up on every major platform.
What DNS Reveals About You
Every time your browser opens a webpage, your device first queries a DNS server to resolve the domain name into an IP address. This happens before any content loads, before HTTPS encrypts anything. DNS queries are sent in plaintext by default, and the DNS server receives the full domain name for every request.
That means your ISP's DNS server (the default on most home and mobile connections) has a timestamped record of every domain you visit: news sites, health information searches, financial sites, adult content, political content, anything. ISPs in the United States have been permitted to sell aggregate browsing data since 2017 when Congress rolled back FCC broadband privacy rules. Whether your specific ISP sells individual-level DNS logs depends on their policy, but the data exists.
Switching DNS does not encrypt the content of your traffic. A site you visit over HTTPS is still encrypted regardless of DNS settings. DNS switching specifically removes the domain-level query log from your ISP's servers.
Cloudflare 1.1.1.1: Fastest Free Private DNS
Cloudflare 1.1.1.1 launched in April 2018 with a focus on speed and privacy. Independent testing by DNSPerf consistently places it as the fastest public DNS resolver globally — average response times under 15ms in most regions. Cloudflare's privacy policy commits to not logging DNS query data for advertising purposes and deletes logs within 25 hours. KPMG audits the data retention practices annually.
Setup on Windows 11: Start → Settings → Network and internet → select your active connection (Wi-Fi or Ethernet) → Hardware properties → DNS server assignment → Edit → Manual → Enable IPv4 → set Preferred DNS to 1.1.1.1, Alternate to 1.0.0.1. Enable IPv6 if your connection uses it: Preferred 2606:4700:4700::1111, Alternate 2606:4700:4700::1001. Save.
Setup on macOS: System Settings → Network → select your connection → Details → DNS tab → click + and add 1.1.1.1 and 1.0.0.1. Remove any existing ISP DNS entries. OK → Apply.
Setup on iOS (iPhone/iPad): Settings → Wi-Fi → tap the info icon next to your network → Configure DNS → Manual → remove existing entries → add 1.1.1.1 and 1.0.0.1. Note: this applies per Wi-Fi network. Mobile data DNS requires the Cloudflare iOS app, which configures a local VPN profile for DNS-only encryption.
Setup on Android: Settings → Network and internet → Private DNS → Private DNS provider hostname → enter "1dot1dot1dot1.cloudflare-dns.com". This enables DNS-over-TLS automatically across all connections, Wi-Fi and mobile data.
Cloudflare also offers 1.1.1.2 (malware blocking) and 1.1.1.3 (malware + adult content blocking) as variants. The base 1.1.1.1 does no filtering.
Quad9: Malware Blocking Plus Privacy
Quad9 (9.9.9.9) is operated by a Swiss nonprofit of the same name, incorporated under Swiss data protection law and GDPR. It aggregates threat intelligence from 25+ cybersecurity organizations including IBM X-Force, Abuse.ch, and Shadowserver to build its blocklist. Phishing sites, malware command-and-control servers, and ransomware distribution domains are blocked at the DNS level before any connection is established.
The practical effect: if malware on your device attempts to connect to its command server to receive instructions or exfiltrate data, and that server's domain is in Quad9's blocklist, the DNS query returns no result and the connection fails. This is not a substitute for antivirus, but it adds a network-level layer with no software to install.
Quad9's privacy policy commits to no selling of query data and no logging of user IP addresses beyond the session. As a nonprofit under Swiss jurisdiction, its data practices are not subject to US national security letters or equivalent European instruments.
Setup is identical to Cloudflare: replace your DNS addresses with 9.9.9.9 (primary) and 149.112.112.112 (secondary). On Android, use "dns.quad9.net" as the Private DNS hostname.
NextDNS Free Tier: Custom Control
NextDNS provides a personal DNS resolver with custom blocklist configuration, per-device analytics, and DNS-over-HTTPS. Each account gets a unique configuration ID, and you choose which blocklists to enable from a library of options including AdGuard DNS filter, OISD, and Hagezi's blocklists.
The free tier processes 300,000 DNS queries per month. After that threshold, NextDNS continues functioning as an unfiltered DNS resolver — queries resolve but blocklists and logging stop until the next calendar month. A typical single-device user runs roughly 30,000 to 80,000 queries per month. A household with multiple devices and smart home equipment can exceed 300,000 more quickly.
NextDNS shows analytics in its dashboard: which domains your devices query most, which were blocked, which blocklist matched. This is useful for understanding your network's behavior. The analytics data is stored on NextDNS servers — for users who want zero query logging, Quad9 or Cloudflare 1.1.1.1 with logging disabled is more appropriate.
Setup: create an account at nextdns.io, get your configuration ID, follow the platform-specific setup guide. On Android, use "your-id.dns.nextdns.io" as the Private DNS hostname.
What Private DNS Does Not Protect
Private DNS resolves one privacy gap: your ISP's DNS log. It does not address:
IP-level traffic. After DNS resolves a domain, your device connects to the resulting IP address. Your ISP can infer which sites you visit from those IP connections even without DNS data. Many major services use shared IP addresses (CDNs), which reduces this inference, but it is not eliminated.
HTTPS content. The content of pages you visit over HTTPS is encrypted end-to-end and unreadable by your ISP regardless of DNS settings. DNS switching does not change this.
Browser fingerprinting and cookie tracking. DNS is a network-level concept. Tracking within your browser via cookies, fingerprinting, and login sessions is unaffected by DNS settings.
For comprehensive protection against ISP monitoring, a VPN encrypts all traffic including DNS queries and IP connections. Private DNS is a meaningful free first step. Layer additional tools based on your threat model. You can also set up free alerts to monitor whether your personal data appears in breach databases alongside your DNS hygiene improvements.
Honest Caveat
Switching to private DNS requires trusting a different organization with your query logs instead of your ISP. Cloudflare, Quad9, and NextDNS each have privacy policies and audit histories that are more user-protective than most ISPs. But they are not zero-knowledge systems — your queries still transit their servers. For users who consider any third-party DNS logging unacceptable, running a self-hosted resolver like Unbound or using Tor (which routes traffic through multiple nodes) are the relevant alternatives, with significant complexity trade-offs.
Frequently Asked Questions
Will changing my DNS actually make me more private?
Yes, but only for one specific type of data. DNS queries are the requests your device sends to translate domain names into IP addresses — every site you visit starts with one. Your default DNS provider (usually your ISP) logs these queries and can see every domain you access. Switching to a privacy-focused DNS like Cloudflare 1.1.1.1 or Quad9 removes that logging. It does not hide the content of your browsing or your IP address from the sites you visit.
What is a DNS leak and how does it happen?
A DNS leak occurs when your DNS queries are sent to a different DNS server than the one you configured — often your ISP\
What is the difference between Cloudflare 1.1.1.1 and Quad9?
Both block DNS logging and support DNS-over-HTTPS. The difference is malware blocking: Quad9 blocks known malicious domains at the DNS level, so requests to malware command-and-control servers, phishing sites, and domains serving malicious content are refused before any connection is made. Cloudflare 1.1.1.1 does not filter content — it processes all valid DNS queries without checking against a blocklist. For basic privacy, either works. For malware blocking as a layer of defense, Quad9 adds something Cloudflare does not.
What does NextDNS free tier include?
NextDNS free tier gives you a personal DNS server with custom blocklists, analytics, and DNS-over-HTTPS support — up to 300,000 DNS queries per month. After 300,000 queries, NextDNS switches to unfiltered DNS resolution (no blocklists, no logging protection). A typical household or individual uses roughly 50,000 to 150,000 queries per month. If you exceed the limit, NextDNS remains functional as a DNS resolver but loses its privacy and security filtering until the next month.
Does DNS privacy protect me on public Wi-Fi?
Partially. Encrypted DNS (DNS-over-HTTPS or DNS-over-TLS) prevents other devices on the same Wi-Fi network from reading your DNS queries in plaintext. It does not prevent the Wi-Fi network operator from reading your traffic content. Public Wi-Fi attacks often target unencrypted HTTP connections and credential capture — threats that encrypted DNS does not address. For comprehensive public Wi-Fi protection, a VPN encrypts all traffic including DNS and content.