Nearly every DNS form asks for two addresses, and hardly anyone knows what the second one does. That’s where combinations like “Cloudflare as primary and Google as secondary, so I get the best of both” come from. They sound sensible and don’t do what they seem to.
What the secondary really does
Your operating system always asks the primary. Only if that server fails to answer within a timeout (one or two seconds, depending on the system) does it retry against the secondary. It doesn’t alternate, doesn’t share the load and doesn’t compare answers. As long as the primary answers, the secondary never sees a single query.
There are per-system nuances: Windows goes back to the primary after a while; some Linux resolvers can rotate if told to; the router hands both to every device and each one decides. But the general idea is the same everywhere: the secondary is a backup for when the primary is down or unreachable, and nothing more.
One detail that trips people up: if the primary answers “that domain doesn’t exist”, that’s a valid answer and the system does not ask the secondary. It only fails over when there’s no answer at all.
What to pair and what not to
That gives three simple rules.
Both from the same provider. Every provider publishes two addresses precisely for this: 1.1.1.1 and 1.0.0.1, 8.8.8.8 and 8.8.4.4, 9.9.9.9 and 149.112.112.112, 86.54.11.1 and 86.54.11.201. They sit on different networks of the same operator, so if one goes down the other carries on, and both apply the same policy.
Don’t mix filtered with unfiltered. If you set AdGuard as primary to remove ads and Google as secondary “just in case”, every time AdGuard takes a bit too long the query goes out through Google with no filter. You won’t notice, but the blocking will have holes. Same with a family filter: the secondary has to be the same filtering level or the paired address from the same family (CleanBrowsing and OpenDNS publish a pair for each filter).
If you do mix, make it two unfiltered ones. Cloudflare as primary and Quad9 as secondary is a reasonable pairing: if Cloudflare has a problem, Quad9 answers, and neither changes the outcome of ordinary queries (Quad9 only blocks malware domains).
Which order to put them in
The primary is the one doing the work, so put the fastest from your network first, not the most famous. The speed test tells you in two minutes. From Madrid, Cloudflare, Quad9, CleanBrowsing and DNS4EU answered in 5 or 6 ms cached; from your ISP the order may differ.
And if your router only lets you enter one, nothing terrible happens: the big resolvers are anycast and carry their redundancy internally. The secondary mostly protects against a network problem between you and that provider.
IPv6 comes in pairs too
If your connection has IPv6, the system will also query over it, and there the provider’s IPv6 pair applies: 2606:4700:4700::1111 and ::1001 for Cloudflare, 2001:4860:4860::8888 and ::8844 for Google, 2620:fe::fe and 2620:fe::9 for Quad9. Put one provider’s IPv4 and another’s IPv6 and you’re back to mixing policies. Each provider page lists all four addresses.
”Public DNS” versus “private DNS”
These two phrases show up constantly in the searches that reach this site, and they mean different things depending on who’s using them.
Public DNS is a resolver open to anyone on the internet. Cloudflare, Google, Quad9, DNS4EU or AdGuard are public: you don’t need to be anyone’s customer. Your ISP’s DNS is, in that sense, private: it only answers its own customers’ connections. When someone says “use a public DNS”, they mean “stop using the ISP’s”.
Private DNS can mean three things:
- Android’s “Private DNS” setting. It’s encrypted DNS (DNS over TLS) to the provider you type in, for Wi-Fi and mobile data. “Private” there means the carrier can’t read or tamper with your queries. It takes a name (
one.one.one.one,dns.quad9.net), not an IP. We cover it in the phone article. - A resolver that keeps no logs. In that sense, “private” describes the provider’s policy: Quad9, Cloudflare or Mullvad state they keep no identifiable queries; OpenDNS or Google do keep something. The comparison has a logging column.
- A resolver of your own. A Pi-hole at home, an AdGuard Home or the company’s DNS: a server that only serves your network. It’s the most literal meaning and the least common in searches.
So “free public DNS” and “free private DNS” are usually the same search made by two different people: both want a resolver that isn’t the ISP’s, is fast and doesn’t snoop. Any of the no-logs public ones fits.
The short version
Primary: the fastest from your network. Secondary: that same provider’s second address. IPv6: the same provider’s pair. No mixing filters. And if you’re torn between two, the comparison puts them side by side and the guides show where each goes on Windows, macOS, Android, iOS and the router.