Public DNS servers with no logging and DNSSEC validation: the full DNSCrypt and DNS-over-HTTPS resolver list

How to read the public DNS servers list

Each row is one service name as it appears in the list, which is also the name you put in the server_names setting of dnscrypt-proxy. The protocol column shows whether the server speaks DNSCrypt, DNS-over-HTTPS or both. Opening a row reveals every endpoint the operator publishes, with address, port and host name decoded from its stamp.

Three flags come from the properties field of the stamp: DNSSEC validation, no logging and no filtering. Operators set them, so they are declarations rather than measurements, yet still the fastest way to narrow hundreds of public DNS servers down to a handful, and they are exactly the values that the require_dnssec, require_nolog and require_nofilter options of dnscrypt-proxy check.

Choosing public DNS servers with no logging

A server that declares no logging promises not to keep records of the names you look up. That matters because the resolver sees every query in clear text once it decrypts it. Encryption hides lookups from the network, but only the resolver’s own policy limits what happens to them afterwards, so no logging is the first filter most people apply.

The declaration cannot be checked from outside, so read the operator’s privacy page first. Combining no logging with anonymized relays reduces what any single party learns: the relay knows who you are but not what you asked, and the resolver knows what you asked but not who you are. The route builder sets that up.

Why DNSSEC validation matters

A resolver that performs DNSSEC validation checks the signatures on records for signed zones and refuses answers that fail. DNSCrypt protects the link between you and the resolver; DNSSEC protects the data the resolver fetches from authoritative servers. A server with both properties therefore covers the whole path, which is why the DNSSEC flag is the second filter worth enabling.

Validation is not free of trade-offs. A misconfigured zone can fail validation and become unreachable through a validating resolver while still working elsewhere. Such cases are rare and usually fixed quickly. For everyday browsing, choosing public DNS servers with DNSSEC validation is the safer default, and the guide to DNSSEC explains how to check the result yourself.

Filtering and unfiltered servers

Some public DNS servers block malware domains, advertising or adult content on purpose, and say so in their stamp by leaving the no filtering flag off. Others answer every query as asked. Neither choice is wrong; a family network may want filtering while a developer usually wants unfiltered answers, so the directory lets you show either group on its own.

If you prefer to decide what gets blocked yourself, pick unfiltered servers and add your own rules in dnscrypt-proxy, as described in the filtering guide. That keeps the blocklist under your control, works the same whichever server answers, and avoids surprises when a filtering resolver blocks a domain you actually need for work or for an update.

Using the list in dnscrypt-proxy

Networks without IPv6 connectivity should leave IPv6 endpoints out, because a client that tries them first only adds delay before falling back. The directory marks those endpoints separately, and dnscrypt-proxy offers an ipv6_servers setting that ignores them entirely. On a dual-stack network both families work, and mixing them gives the client more routes to choose from.

dnscrypt-proxy loads this list through the sources section of its configuration, verifies the Minisign signature and keeps a cached copy. When server_names is empty, it picks the fastest servers that match your filters and keeps measuring them. To pin specific public DNS servers instead, copy their names from this directory into server_names, exactly as written in the first column.

To check how fast a few well-known resolvers answer from your own network, the DNS speed test sends queries from your browser and reports cold and warm timings. For a short editorial pick with the reasons behind it, the shortlist of best DNS servers compares the major operators on logging, DNSSEC, filtering and the protocols they support.