In 2025, IPv6 deployment has reached a critical mass, with approximately 35% of global DNS traffic now using IPv6 transport. Choosing a DNS server with comprehensive IPv6 support is no longer optional - it's essential for optimal internet performance, security, and future-proofing your network infrastructure.
DNS servers with proper IPv6 support provide two critical capabilities:
Modern networks require both capabilities to operate efficiently in dual-stack environments. This guide evaluates the best public DNS providers offering full IPv6 support in 2025, comparing their performance, privacy policies, security features, and configuration details.
| DNS Provider | IPv4 Primary | IPv4 Secondary | IPv6 Primary | IPv6 Secondary | Speed Rank | Privacy | Security Features |
|---|---|---|---|---|---|---|---|
| Cloudflare | 1.1.1.1 | 1.0.0.1 | 2606:4700:4700::1111 | 2606:4700:4700::1001 | 1st | Excellent | DoH, DoT, DNSSEC |
| Google DNS | 8.8.8.8 | 8.8.4.4 | 2001:4860:4860::8888 | 2001:4860:4860::8844 | 2nd | Good | DoH, DoT, DNSSEC, DNS64 |
| Quad9 | 9.9.9.9 | 149.112.112.112 | 2620:fe::fe | 2620:fe::9 | 7th | Excellent | DoH, DoT, DNSSEC, Malware blocking |
| OpenDNS/Umbrella | 208.67.222.222 | 208.67.220.220 | 2620:119:35::35 | 2620:119:53::53 | 4th | Good | DoH, Content filtering, Phishing protection |
| AdGuard DNS | 94.140.14.14 | 94.140.15.15 | 2a10:50c0::ad1:ff | 2a10:50c0::ad2:ff | 5th | Excellent | DoH, DoT, Ad blocking, Privacy protection |
| NextDNS | 45.90.28.0 | 45.90.30.0 | 2a07:a8c0:: | 2a07:a8c1:: | 6th | Excellent | DoH, DoT, Customizable filtering, Analytics |
Cloudflare's 1.1.1.1 DNS service launched in 2018 and has rapidly become the performance leader in public DNS resolution.
Cloudflare consistently ranks as the fastest public DNS service worldwide, with DNSPerf measurements showing response times typically 20-40% faster than competitors. Their global anycast network with 300+ data centers ensures low latency regardless of user location.
Cloudflare has set the industry standard for DNS privacy:
Users prioritizing speed and privacy who want the fastest DNS resolution with strong privacy guarantees.
Linux/macOS:
# Add to /etc/resolv.conf
nameserver 2606:4700:4700::1111
nameserver 2606:4700:4700::1001
nameserver 1.1.1.1
nameserver 1.0.0.1
Windows PowerShell:
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses ("2606:4700:4700::1111","1.1.1.1")
Google Public DNS, launched in 2009, is one of the largest and most reliable public DNS services with comprehensive IPv6 support since its inception.
Google DNS ranks second in global performance benchmarks, offering excellent reliability and consistently low latency. Their massive infrastructure with servers in virtually every geographic region ensures robust service availability.
More transparent than most DNS providers but less restrictive than Cloudflare:
Users wanting rock-solid reliability with excellent global performance, particularly those on IPv6-only networks needing DNS64 support.
macOS (using networksetup):
networksetup -setdnsservers Wi-Fi 2001:4860:4860::8888 2001:4860:4860::8844 8.8.8.8 8.8.4.4
Android: Settings > Network & Internet > Private DNS > Enter "dns.google"
Quad9 is a non-profit DNS resolver operated by a Swiss-based organization, focusing heavily on security and privacy with built-in malware blocking.
Quad9 ranks 7th out of 12 major public DNS resolvers for average worldwide query times according to DNSPerf. While slightly slower than Cloudflare and Google, performance remains excellent with 150 resolver clusters in 90 countries providing global coverage.
Operating under Swiss privacy laws provides strong legal protections:
Security-conscious users and organizations wanting DNS-level malware protection without sacrificing privacy.
Linux (systemd-resolved):
# Edit /etc/systemd/resolved.conf
[Resolve]
DNS=2620:fe::fe 2620:fe::9 9.9.9.9
FallbackDNS=2620:fe::10
DNSSEC=yes
DNSOverTLS=yes
iOS/iPadOS: Settings > General > VPN & Device Management > DNS > Configure DNS > Manual
OpenDNS, acquired by Cisco and now operating as Cisco Umbrella, was the first public DNS resolver to announce DNS encryption support in December 2011.
OpenDNS ranks 4th in global DNS performance, offering strong reliability and good response times. Cisco's infrastructure ensures enterprise-grade availability.
Enterprise-focused approach with some data collection:
Home users wanting basic content filtering and families needing parental controls, though IPv6 filtering capabilities are limited.
Router (typical interface):
Primary DNS: 2620:119:35::35
Secondary DNS: 2620:119:53::53
Tertiary DNS (IPv4): 208.67.222.222
AdGuard DNS provides DNS-level ad blocking and privacy protection without requiring software installation.
AdGuard ranks 5th in performance benchmarks, offering good response times with a global server network. Response times are competitive, typically adding only 10-20ms compared to the fastest resolvers.
Strong privacy focus with multiple options:
Users wanting DNS-level ad blocking without browser extensions or dedicated apps, especially valuable for smart TVs and IoT devices.
Android (Private DNS): Settings > Network & Internet > Private DNS > Enter "dns.adguard-dns.com"
Router (DD-WRT/OpenWRT):
# Add to dnsmasq configuration
server=2a10:50c0::ad1:ff
server=2a10:50c0::ad2:ff
NextDNS offers highly customizable DNS filtering with detailed analytics, operating on a freemium model.
NextDNS ranks 6th in global DNS performance benchmarks. The service provides dedicated infrastructure for premium users, potentially offering better performance than shared public resolvers.
Configurable privacy with user control:
Power users wanting fine-grained control over DNS filtering with detailed analytics and per-device customization.
macOS configuration profile: Download configuration profile from NextDNS.io > Install via System Preferences > Profiles
Several DNS providers offer specialized DNS64 resolvers for IPv6-only networks that need to access IPv4-only services. DNS64 works with NAT64 gateways to translate IPv4 addresses into IPv6 using the reserved prefix 64:ff9b::/96.
Google Public DNS64:
Cloudflare DNS64:
DNS64 is essential for:
Modern DNS servers support encrypted protocols to prevent eavesdropping and manipulation of DNS queries.
DoH encrypts DNS queries using HTTPS (port 443), making DNS traffic indistinguishable from regular web traffic.
Advantages:
DoH Endpoints (IPv6-capable):
Browser Configuration:
Firefox: Settings > Privacy & Security > DNS over HTTPS > Enable > Select provider
Chrome: Settings > Privacy and security > Security > Use secure DNS > Select provider
Edge: Settings > Privacy, search, and services > Security > Use secure DNS
DoT encrypts DNS queries using TLS protocol on dedicated port 853.
Advantages:
DoT Servers (IPv6):
Disadvantages:
DNS performance varies by geographic location, network conditions, and server load. Here's how to benchmark DNS servers for your specific environment.
GRC DNS Benchmark (Windows):
namebench (Cross-platform):
# Install
pip install namebench
# Run benchmark
namebench --only=2606:4700:4700::1111,2001:4860:4860::8888,2620:fe::fe
dnsperf (Advanced users):
# Install dnsperf (Linux)
sudo apt install dnsperf
# Test IPv6 DNS server
dnsperf -s 2606:4700:4700::1111 -d queryfile.txt
Test query response time:
# Cloudflare IPv6
dig @2606:4700:4700::1111 AAAA google.com | grep "Query time"
# Google IPv6
dig @2001:4860:4860::8888 AAAA google.com | grep "Query time"
# Quad9 IPv6
dig @2620:fe::fe AAAA google.com | grep "Query time"
Compare average response times over multiple queries:
for i in {1..10}; do dig @2606:4700:4700::1111 AAAA google.com | grep "Query time"; sleep 1; done
Based on DNSPerf measurements from 200+ global locations:
Note: Your actual performance will vary based on geographic location and network routing.
| Feature | Cloudflare | Quad9 | OpenDNS | AdGuard | NextDNS | |
|---|---|---|---|---|---|---|
| DNSSEC | Yes | Yes | Yes | Yes | Yes | Yes |
| DoH | Yes | Yes | Yes | Yes | Yes | Yes |
| DoT | Yes | Yes | Yes | No | Yes | Yes |
| Malware blocking | No | No | Yes | Yes | Yes | Customizable |
| Ad blocking | No | No | No | No | Yes | Customizable |
| Content filtering | No | No | No | Yes | Limited | Customizable |
| Phishing protection | No | No | Yes | Yes | Yes | Yes |
What's collected:
What's NOT collected by privacy-focused providers:
After configuring IPv6-capable DNS servers, verify everything works correctly.
Visit test-ipv6.run for comprehensive IPv6 connectivity testing. This tool checks:
The site provides a scored assessment of IPv6 readiness and identifies DNS or connectivity issues immediately. A score indicating "broken IPv6" means DNS is working but network routing needs fixing.
1. Verify IPv6 DNS server reachability:
# Ping IPv6 DNS servers
ping6 2606:4700:4700::1111 # Cloudflare
ping6 2001:4860:4860::8888 # Google
ping6 2620:fe::fe # Quad9
2. Test AAAA record resolution:
# Query for IPv6 addresses
dig AAAA google.com +short
nslookup -type=AAAA github.com
host -t AAAA cloudflare.com
3. Test resolution via IPv6 protocol:
# Force dig to query over IPv6
dig -6 @2606:4700:4700::1111 AAAA example.com
4. Verify system DNS configuration:
Linux (systemd):
resolvectl status
macOS:
scutil --dns | grep nameserver
Windows:
ipconfig /all | findstr "DNS Servers"
5. Test encrypted DNS (DoH):
# Using curl to test DoH endpoint
curl -H "accept: application/dns-json" "https://1.1.1.1/dns-query?name=example.com&type=AAAA"
6. Measure query performance:
# Time DNS queries
time dig @2606:4700:4700::1111 AAAA netflix.com +short
# Compare with IPv4
time dig @1.1.1.1 AAAA netflix.com +short
Problem: DNS queries timeout over IPv6
Solution:
# Check IPv6 connectivity first
ping6 2606:4700:4700::1111
# If ping fails, check routing
ip -6 route show
# Verify firewall allows UDP/TCP port 53 over IPv6
sudo ip6tables -L -n | grep 53
Problem: AAAA records not returned
# Test with known IPv6-enabled site
dig AAAA google.com
# If this works but other domains don't, those domains lack IPv6
dig AAAA example.com
# Check if DNS server supports AAAA queries
dig @2606:4700:4700::1111 AAAA google.com
Problem: Slow IPv6 DNS resolution
# Compare response times
time dig @2606:4700:4700::1111 AAAA google.com
time dig @1.1.1.1 A google.com
# Test different DNS servers
dig @2001:4860:4860::8888 AAAA google.com +stats
dig @2620:fe::fe AAAA google.com +stats
If IPv6 queries are consistently slow (>100ms), you may have routing issues or should try a different DNS provider with better IPv6 infrastructure in your region.
Method 1: systemd-resolved (Ubuntu 18.04+, Debian 10+, Fedora)
Edit /etc/systemd/resolved.conf:
[Resolve]
DNS=2606:4700:4700::1111 2606:4700:4700::1001 1.1.1.1 1.0.0.1
FallbackDNS=2001:4860:4860::8888 8.8.8.8
DNSSEC=yes
DNSOverTLS=yes
Restart service:
sudo systemctl restart systemd-resolved
Method 2: NetworkManager (Most desktop Linux)
# Using nmcli
nmcli con mod "Wired connection 1" ipv6.dns "2606:4700:4700::1111,2606:4700:4700::1001"
nmcli con mod "Wired connection 1" ipv4.dns "1.1.1.1,1.0.0.1"
nmcli con up "Wired connection 1"
Method 3: Direct /etc/resolv.conf (static configuration)
# Edit /etc/resolv.conf
nameserver 2606:4700:4700::1111
nameserver 2606:4700:4700::1001
nameserver 1.1.1.1
nameserver 1.0.0.1
Make it immutable to prevent overwrites:
sudo chattr +i /etc/resolv.conf
Method 1: System Preferences (GUI)
Method 2: Command Line (networksetup)
# List network services
networksetup -listallnetworkservices
# Set DNS for Wi-Fi
sudo networksetup -setdnsservers Wi-Fi 2606:4700:4700::1111 2606:4700:4700::1001 1.1.1.1 1.0.0.1
# Verify
networksetup -getdnsservers Wi-Fi
Method 3: mDNSResponder (temporary)
# Clear DNS cache and set new servers
sudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder
Method 1: Settings (GUI)
Method 2: PowerShell (Command Line)
# Get interface names
Get-NetAdapter
# Set DNS servers (replace "Ethernet" with your interface name)
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses ("2606:4700:4700::1111","2606:4700:4700::1001","1.1.1.1","1.0.0.1")
# Verify
Get-DnsClientServerAddress -InterfaceAlias "Ethernet"
Method 3: Control Panel (Legacy)
Method 1: Private DNS (Android 9+)
This configures DNS over TLS (DoT) with IPv6 support automatically.
Method 2: Per-Network DNS (Requires root or third-party app)
Android doesn't allow easy per-network IPv6 DNS configuration without root access. Use apps like:
Method 1: Wi-Fi Network Settings
Method 2: Configuration Profile (recommended for DoH/DoT)
Download DNS configuration profiles from:
Install via: Settings > General > VPN & Device Management
Configuring DNS at the router level applies settings to all connected devices.
DD-WRT:
Setup > Basic Setup > Network Address Server Settings (DHCP)
Static DNS 1: 2606:4700:4700::1111
Static DNS 2: 2606:4700:4700::1001
Static DNS 3: 1.1.1.1
OpenWRT:
# SSH into router
uci set network.wan.dns='2606:4700:4700::1111 2606:4700:4700::1001'
uci set network.wan6.dns='2606:4700:4700::1111 2606:4700:4700::1001'
uci commit network
/etc/init.d/network restart
Ubiquiti UniFi:
Settings > Networks > Edit LAN > DHCP Name Server
Manual:
2606:4700:4700::1111
2606:4700:4700::1001
1.1.1.1
Primary: Quad9 (2620:fe::fe) Backup: Cloudflare (2606:4700:4700::1111)
Both providers have excellent privacy policies, no logging, and independent verification.
Primary: Cloudflare (2606:4700:4700::1111) Backup: Google (2001:4860:4860::8888)
Cloudflare leads performance benchmarks, with Google as an extremely reliable backup.
Primary: Quad9 (2620:fe::fe) Backup: OpenDNS (2620:119:35::35)
Both provide DNS-level threat blocking based on threat intelligence feeds.
Primary: AdGuard (2a10:50c0::ad1:ff) Backup: NextDNS (configured with blocklists)
DNS-level ad blocking without browser extensions or software.
Primary: OpenDNS (with account configuration) Alternative: AdGuard Family (2a10:50c0::bad1:ff)
Content filtering to block adult content and inappropriate sites.
Primary: Google DNS64 (2001:4860:4860::6464) Backup: Cloudflare DNS64 (2606:4700:4700::64)
DNS64 enables access to IPv4-only services from IPv6-only networks.
Primary: Cisco Umbrella (2620:119:35::35) Alternative: NextDNS (paid tier with analytics)
Management dashboards, analytics, and policy enforcement.
Primary: NextDNS (personalized configuration) Self-hosted: AdGuard Home or Pi-hole (with IPv6)
Granular control over filtering, logging, and device-specific policies.
Always configure at least two DNS servers (primary and secondary) for redundancy:
# Good configuration (dual-stack with fallback)
nameserver 2606:4700:4700::1111 # Cloudflare IPv6 primary
nameserver 2606:4700:4700::1001 # Cloudflare IPv6 secondary
nameserver 1.1.1.1 # Cloudflare IPv4 fallback
nameserver 1.0.0.1 # Cloudflare IPv4 secondary fallback
In dual-stack environments, configure both IPv4 and IPv6 DNS servers to ensure resilience if one protocol fails.
Test DNS changes on a single device before applying to entire network:
# Test specific DNS server without changing system configuration
dig @2606:4700:4700::1111 AAAA google.com
Regularly benchmark your DNS configuration:
# Create simple monitoring script
while true; do
echo "$(date): $(dig @2606:4700:4700::1111 AAAA google.com | grep "Query time")"
sleep 300
done
Enable DoH or DoT to protect DNS queries from eavesdropping and manipulation. Modern browsers and operating systems support encrypted DNS natively.
Ensure your DNS resolver validates DNSSEC signatures:
dig cloudflare.com +dnssec | grep "ad;"
Look for the ad (authenticated data) flag in the response.
Keep records of:
Consider what happens if:
Yes, and it's often recommended. Using DNS servers from different providers increases resilience. If one provider experiences an outage, your queries automatically fall back to the secondary.
Example mixed configuration:
nameserver 2606:4700:4700::1111 # Cloudflare IPv6
nameserver 2001:4860:4860::8888 # Google IPv6
nameserver 1.1.1.1 # Cloudflare IPv4
nameserver 8.8.8.8 # Google IPv4
For dual-stack networks (most common in 2025), yes. Configuring both ensures DNS resolution works regardless of which protocol is available. Some applications or network conditions may prefer or require one protocol over the other.
Possibly, but the impact is usually minimal. DNS resolution typically takes 10-50 milliseconds, which is insignificant compared to actual data transfer times. However, IPv6 can reduce latency in some cases due to:
The bigger performance factor is choosing a fast DNS provider (like Cloudflare) over a slow one, not IPv4 vs IPv6.
Without encryption, yes. ISPs can monitor DNS traffic regardless of which servers you use. To prevent this:
With DoH/DoT, ISPs can see that you're making encrypted DNS queries but cannot see the domain names you're looking up.
You can still use the IPv4 addresses of these DNS providers (1.1.1.1, 8.8.8.8, 9.9.9.9, etc.). All providers in this guide offer full dual-stack support. When your network eventually supports IPv6, simply add the IPv6 DNS addresses to your configuration.
Test with network monitoring tools:
# Monitor DNS traffic
sudo tcpdump -i any port 53 and ip6
# Check which DNS server responds
dig google.com +trace
You can also check your system's DNS configuration to see which servers are configured and in what order they're tried.
Public DNS servers (Cloudflare, Google, Quad9) generally offer:
However, ISP DNS may provide:
For most users, public DNS servers are the better choice in 2025.
Yes! Self-hosting gives you complete control. Popular options:
Pi-hole (DNS sinkhole with ad blocking):
# Supports IPv6 natively
curl -sSL https://install.pi-hole.net | bash
AdGuard Home (similar to Pi-hole):
# Supports IPv6, DoH, DoT
curl -s -S -L https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sh -s -- -v
BIND9 (traditional authoritative/recursive DNS):
sudo apt install bind9
# Configure for IPv6 in named.conf
Self-hosting requires technical expertise and a stable internet connection, but provides maximum privacy and customization.
Choosing a DNS server with comprehensive IPv6 support is essential for optimal internet performance in 2025. The landscape has matured significantly, with all major public DNS providers now offering full IPv6 support including transport (querying via IPv6) and resolution (returning AAAA records).
Top recommendations:
For most users, a dual-stack configuration using Cloudflare primary with Google or Quad9 as secondary provides the best balance of speed, privacy, and reliability.
After configuration, always verify your setup works correctly by visiting test-ipv6.run. This comprehensive testing tool checks IPv4/IPv6 connectivity, dual-stack behavior, latency comparison, and identifies broken IPv6 configurations where DNS returns AAAA records but connections fail. A healthy configuration should score highly and show successful connectivity over both protocols.
As IPv6 deployment continues to grow globally, having properly configured IPv6-capable DNS infrastructure ensures your network is ready for the modern internet.