Quick answer: Google DNS (8.8.8.8 / 8.8.4.4) and Cloudflare DNS (1.1.1.1) are well-known public resolvers. We moved to Quad9 (9.9.9.9) because its standard service also blocks lookups for known malicious domains.
What DNS does
DNS is the internet's address book. When you type a website name, your device asks a DNS service where to find it. That happens before the browser connects to the website.
Most people never notice DNS. But that first lookup gives us a sensible chance to stop some harmful connections before a page, download or malicious link can load.
Why change from 8.8.8.8 and 1.1.1.1?
Google Public DNS and Cloudflare's 1.1.1.1 are reliable, fast public DNS services. Their standard addresses are designed to resolve internet names; they do not provide the threat blocking that we wanted as a default safeguard.
Quad9's 9.9.9.9 service checks requested domain names against threat-intelligence feeds. If a domain is known to be linked to malware, phishing, spyware or botnets, Quad9 can refuse the lookup. The aim is to break the connection before the device reaches that known harmful destination.
What this helps with
- A link in a phishing email that leads to a known malicious site.
- A malicious download or program trying to contact a known command-and-control domain.
- A compromised device attempting to reach a known malware or botnet host.
- An accidental visit to a known harmful domain.
What it does not do
DNS filtering is a safety net, not a complete cyber-security solution. It cannot guarantee that every new scam or malicious site will already be known. It will not repair a hacked email account, remove malware, undo a payment, replace updates, or stop someone using a stolen active sign-in session.
That is why we still recommend unique passwords, multi-factor authentication, updates, security software, good backups and careful checking of unexpected messages. If you think an account or device has already been compromised, use the Been Hacked Recovery Checklist rather than relying on DNS alone.
Why Quad9 specifically?
Quad9's standard resolver is 9.9.9.9. It is a free, privacy-first DNS service operated by the Swiss-based Quad9 Foundation. Its secure service uses threat blocking and DNSSEC validation. For resilience, Quad9 also publishes 149.112.112.112 as its secondary IPv4 resolver.
As with any security filter, a legitimate site can occasionally be blocked. If a business application or trusted website stops working after a DNS change, check the address carefully first. Do not turn off protection just because an unexpected pop-up tells you to.
Our practical view
This is not about claiming one public DNS provider is universally best. It is about choosing the default that better matches our priority: reducing the chance that a known bad domain is reached in the first place. It is one quiet, low-friction layer in a wider security approach.
Official Quad9 information
Quad9 explains its threat-blocking approach and its secure resolver addresses and features. Review your own network and device requirements before changing DNS settings.