Well-known IPs: public DNS resolvers compared
Who runs 8.8.8.8, 1.1.1.1 and 9.9.9.9, their second and IPv6 addresses, what each one blocks and logs, and why their location is everywhere.
Some IP addresses are famous because millions of devices use them as their DNS resolver. Each page here says who runs the address, its other addresses, encrypted DNS endpoints, what it filters and logs, and how to check that you really use it. The facts come from each operator's own documentation, linked on every page.
Public DNS resolvers
| Address | Operator | Network | Blocks | Your IP address in logs |
|---|---|---|---|---|
| 8.8.8.8 | Google Public DNS | AS15169 | Nothing, apart from rare security or legal cases | Temporary logs, deleted within 24 to 48 hours (longer only for security and abuse issues) |
| 1.1.1.1 | Cloudflare | AS13335 | Nothing; 1.1.1.2 blocks malware, 1.1.1.3 malware and adult content | Not written to disk, apart from 0.05% samples; truncated logs deleted within 25 hours |
| 9.9.9.9 | Quad9 (Swiss foundation) | AS19281 | Malicious domains; 9.9.9.10 and 9.9.9.12 block nothing | Not collected or recorded |
| Address | Second address | IPv6 | DNS over TLS name |
|---|---|---|---|
| 8.8.8.8 | 8.8.4.4 | 2001:4860:4860::8888 | dns.google |
| 1.1.1.1 | 1.0.0.1 | 2606:4700:4700::1111 | one.one.one.one |
| 9.9.9.9 | 149.112.112.112 | 2620:fe::fe | dns.quad9.net |
Why these addresses have no single location
All three are anycast addresses: the operator announces the same address from many sites, and the internet's routing takes your query to one of them, usually one near you, though routing goes by network paths rather than distance. An IP location lookup has to give one place for such an address, but the server that answers you is often far from it. The 8.8.8.8 and 1.1.1.1 pages show the operator's documented query that names the site you reach; in host.sh's own test from Lisbon on 28 October 2026, 8.8.8.8 answered from Google's Madrid site and 1.1.1.1 from Cloudflare's Lisbon one.
The same is true of many CDN and cloud addresses, which is why a location for a server address says less than one for a home or mobile connection.
Look up any address
- Your own address: the IP lookup, or
curl host.shin a terminal. - Any address with the API: Lookup (needs a token for addresses other than your own).
- Is it IPv6? The IPv6 test.
FAQ
What is the best public DNS server?
It depends on what you want. To block malicious domains, 9.9.9.9 or 1.1.1.2. For no filtering, 1.1.1.1 or 8.8.8.8. On logging, Quad9 says it does not record IP addresses, Cloudflare keeps truncated logs for up to 25 hours, and Google keeps full addresses in temporary logs for 24 to 48 hours, longer only to deal with security and abuse issues. All three are free and support DNS over HTTPS and DNS over TLS.
Are 8.8.8.8 and 1.1.1.1 the same?
No. 8.8.8.8 is Google Public DNS and 1.1.1.1 is Cloudflare's resolver. Both are free public DNS resolvers, but they are run by different companies on different networks with different logging policies.
Why do these addresses show a location far from me?
They are anycast: one address is announced from many places, and an IP location lookup can give only one of them. Your queries are answered by whichever site routing picks for your network, usually a nearby one.
Which public DNS resolver blocks malware?
Quad9 at 9.9.9.9 blocks malicious domains by default. Cloudflare's 1.1.1.2 blocks malware, and 1.1.1.3 also blocks adult content. Google's 8.8.8.8 does not filter.
This page as Markdown: /ip/index.md