CORE TOOL
DNS Benchmark
Find the resolver that fits your connection.
Compare validated DNS-over-HTTPS response times from your browser, with consistency and success rates beside every result.
Run the benchmark ↗YOUR NETWORK, EXPLAINED
Less guesswork.
More answers.
Find a faster DNS resolver. Inspect a domain. Get to the bottom of an email issue. Six focused tools, one place to start.
PICK YOUR STARTING POINT
What would you like to check?
DNS Lookup
See what your domain is saying.
Inspect DNS records, check DNSSEC, and look up reverse DNS.
Look up DNS ↗WHOIS Lookup
Know who’s behind a domain.
Find registration dates, registrar details, nameservers, and network ownership.
Check ownership ↗Propagation Checker
Did your DNS change arrive?
Compare answers across independent public resolvers to spot cache differences.
Check propagation ↗Email DNS Checker
Check the records behind delivery.
Inspect email routing and authentication with plain-English findings.
Check email DNS ↗What’s My IP?
See your connection from outside.
Find your public IPv4 and IPv6 addresses, reverse DNS, and network owner.
Find my IP ↗MEASUREMENT WITH CONTEXT
A fast answer should also be a useful one.
Our benchmark ranks validated responses by median latency and shows the variation behind each result. It measures browser-to-DoH performance on your current network.See how the benchmark works ↗
Run the benchmark
Before you start — what this sends, and to whom
- Your browser will make DNS-over-HTTPS requests directly to … third-party resolvers. Each provider you contact can see your IP address and the test name being queried, and may log it under its own privacy policy.
- The queries use a controlled test name under dnsbenchmarkpro.com. Nothing about your browsing, device or identity is placed in a query name.
- This tool does not request your location. No geolocation prompt, no coordinates, no reverse-geocoding service.
- Results stay in this browser tab. Nothing is uploaded to our servers, and nothing is stored unless you export it yourself.
Provider privacy policies are linked in the resolver comparison. Our own data flow is documented in the privacy policy.
A cached lookup is what you experience most of the time. An uncached lookup is an upper bound, not a typical result.
Measuring…
0%
Resolvers are tested in interleaved, shuffled rounds so that no provider is measured only while conditions happen to be good.
Results
Each dot in Every measurement is one validated response, on a scale shared by every row; the upright bar is the median. The scale is logarithmic, because the difference between 20 ms and 40 ms matters far more than the difference between 300 ms and 320 ms. Dots stacked together mean a resolver answered in much the same time each round. Dots spread across the track mean it did not — and that is usually more important than which median happens to be lowest.
| # | Resolver | Every measurement | Median | Spread | Verified | IPv4 addresses |
|---|
Excluded from the ranking (0)
These resolvers did not return a response this browser could read and verify, so they carry no latency figure. In most cases this is a browser limitation, not a fault in the resolver: a DNS-over-HTTPS endpoint that does not send cross-origin headers simply cannot be measured from a web page. Their configuration addresses are still listed in the resolver comparison.
| Resolver | Outcomes | Detail |
|---|
Before you change your DNS settings
A low figure in the table above is a reason to try a resolver, not proof it will be faster for your whole system. What you measured here is an HTTPS request from this browser to a provider’s DNS-over-HTTPS endpoint. What you would configure in Windows, macOS or your router is usually that provider’s classic DNS service on port 53 — a different endpoint, transport and cache. Related, frequently correlated, but not the same measurement.
Write down what you have now
Before changing anything, record your current settings so you can put them back. On most systems the original setting is “Obtain DNS server address automatically” (DHCP) — returning to that undoes the change completely.
Where it can go wrong
- On a corporate or school network, a custom resolver often breaks access to internal hostnames, intranet sites and VPN resources that rely on split DNS.
- Public Wi-Fi captive portals may fail to load until you revert to the network’s own DNS.
- Changing resolver changes what is filtered. A family or malware-filtering resolver will block things your current one allows, and an unfiltered one will stop blocking things you may rely on.
- Your chosen resolver sees every domain you look up. Changing DNS moves that visibility from your ISP to that provider — it does not remove it.
Step-by-step guides
- Change DNS on Windows 11 and 10
- Change DNS on macOS
- Change DNS on Android
- Change DNS on iPhone and iPad
- Change DNS on your router
Each guide covers IPv4 and IPv6 separately, distinguishes classic DNS from DNS-over-HTTPS, and ends with a check that the change worked plus the exact steps to roll it back.
Background
DNS tools and guides
Check DNS records and email configuration, or follow a setup guide for your device.
Tools
- DNS Benchmark
- DNS Lookup & DNSSEC Check
- WHOIS Lookup (RDAP)
- DNS Propagation Checker
- Email DNS Checker
- What's My IP Address
Guides
Latest
- Data Breach Update Alert: 70,000 Firewall Logins Exposed
Data breach update: 70,000 firewall and VPN credentials exposed as k0t works through FortiGate, FortiWeb and GlobalProtect appliances using published flaws.
- DNS Security Alert: One Request Crashes HTTP/3 Servers
DNS security alert: new QPACK flaws crash HTTP/3 servers with one request, at up to 4,000x memory amplification. Seven of ten stacks hit, three still unpatched.
- Enterprise IT News Alert: Third VeloCloud Zero-Day Exploited
Enterprise IT news: CVE-2026-114625 lets a read-only VeloCloud Orchestrator account reach superuser operator. It is the third exploited zero-day since July.
- Cybersecurity News Alert: 333 Tor Exit Relays Hijacked
Cybersecurity news: attackers hijacked 333 Tor exit relays to intercept SSH logins and plant Ebury malware. Why trust on first use has no revocation path.
- Tech Infrastructure Shaken: Eight eMudhra CA Keys Cracked
Tech infrastructure alert: eight eMudhra CA private keys were computable from public certificates, forcing emergency browser, Go and Linux trust-store fixes.
- Two Years Hidden in VMware Tools
Data breach update: Solar says Partisan Zmiy hid the Vasilek backdoor in an unused VMware Tools folder for two years, with DNSCat2 as a backup C2 channel.
- DNS Security vs ClickFix: Inside the ROMULUS Platform
DNS security after ClickFix: Forescout's ROMULUS platform serves LegionLoader from six hosts with no exploit at all, leaving resolution as the last control.
- ConnectWise Breach Hits 173 Tenants
A compromised ConnectWise Cloud Backup credential gave attackers access to 173 Microsoft 365 tenants, with no password and no malware.
- Ads Became a Spyware Delivery Network
Citizen Lab traced zero-click Candiru spyware at Al Jazeera to targeted ads bought through legitimate ad exchanges in 161 countries.
- Proxyjacking: Edge Devices Hijacked to Resell Bandwidth
Tech infrastructure: a proxyjacking campaign hijacked 143 D-Link, Ubiquiti and SAP devices in 34 countries, reselling stolen bandwidth as residential proxies.
- Legal Aid Records Reach Back to 1978
The UK Legal Aid Agency says stolen records reach back to 1978, with 250,000 predating 2007 and four months of attacker dwell time.
- Ivanti VPN Zero-Day Chain Gives Root Access
A three-flaw Ivanti Connect Secure zero-day chain gave UTA0576 root on fully patched VPN appliances. CISA KEV deadline is 16 October.