Quad9 vs Cloudflare: 9.9.9.9 vs 1.1.1.1
One resolver quietly blocks malicious domains for you; the other stays out of the way and answers fast. Here is how Quad9 and Cloudflare actually differ on security, privacy, and speed — with a live test so the speed part is a measurement, not a claim.
Quad9 vs Cloudflare — the short answer
Quad9 (9.9.9.9) blocks known malicious domains for you by default, while Cloudflare (1.1.1.1) is a fast, unfiltered resolver that leaves security filtering up to you. Both keep no personal query logs and validate DNSSEC, and neither is universally faster.
Quick identity check
Quad9 9.9.9.9 is run by the Quad9 Foundation, a Swiss non-profit, and
its whole reason for existing is safety: it uses threat intelligence to stop lookups to domains tied
to malware, phishing, and command-and-control before your device ever connects to them. Cloudflare 1.1.1.1 comes from Cloudflare, a security and
content-delivery company, and takes the opposite starting position — the base
1.1.1.1 resolver deliberately filters nothing and focuses on being fast and private.
Both are free, need no account, and work anywhere you can set custom DNS servers.
Security: filtering is the real dividing line
This is the difference that actually matters between these two. Quad9's default address is a security filter: it checks every domain you look up against threat-intelligence feeds and refuses to resolve ones flagged as malware, phishing, or command-and-control. A domain on its blocklist simply fails to resolve, which quietly shields every device on your network — including phones, TVs, and IoT gadgets that can't run their own security software — without installing anything.
Cloudflare DNS inverts that. The headline 1.1.1.1 address does no blocking at all; Cloudflare instead offers protection on separate addresses — 1.1.1.2 adds malware blocking and 1.1.1.3 adds malware plus adult-content filtering. So the practical question is which default you want: Quad9 protects you unless you opt out (its unfiltered address is 9.9.9.10), while Cloudflare stays neutral unless you opt in. Both approaches are legitimate; they just suit different people.
Speed: who answers faster?
There is no universal winner here, and it would be dishonest to name one. Quad9 and Cloudflare both operate global anycast networks with points of presence in many countries, so a request from your device typically lands on a nearby server for either provider. What decides the real number is specific to you: the physical distance to each network's closest site, how well that network peers with your particular ISP, and momentary congestion along the path — all of which vary from one household to the next.
A common assumption is that Quad9 must be slower because it checks a blocklist. In practice that lookup happens inside the resolver against data it already holds, so it is not a meaningful source of latency. The only figure worth trusting is one measured from your own connection. Run the live DNS speed test and compare Quad9 and Cloudflare side by side — look at the median latency alongside the jitter, not a single lucky lookup.
Privacy: both strong, for different reasons
Privacy is where these two are closest. Quad9's privacy note: Blocks malicious domains using threat intelligence and does not retain source IP addresses. Operated as a Swiss non-profit.
Cloudflare DNS's privacy note: No query logging to disk and no client IP retained; anonymized data is purged within 24 hours. Independently audited.
Both keep no personally identifying query logs and, importantly, neither sends EDNS Client Subnet (ECS) — the DNS extension that shares part of your IP address with a site's authoritative servers to aid CDN routing. Quad9's edge is governance: it's a Swiss non-profit whose mission is protection, not data. Cloudflare's edge is verification: it has published an independent audit of its no-logging claims. If minimizing your footprint is the priority, our best DNS for privacy guide puts both in wider context.
Side-by-side comparison
| Detail | Quad9 | Cloudflare |
|---|---|---|
| Primary address | 9.9.9.9 | 1.1.1.1 |
| Secondary address | 149.112.112.112 | 1.0.0.1 |
| IPv6 primary | 2620:fe::fe | 2606:4700:4700::1111 |
| Malware blocking (default) | Yes — blocks known malicious domains | No filtering on the base address |
| Filtering approach | Filtered by default; use 9.9.9.10 for none | Unfiltered by default; 1.1.1.2 for malware, 1.1.1.3 for family |
| DNSSEC validation | Yes | Yes |
| Query logging | No source IP addresses retained | No logs written to disk; anonymized data purged within 24 hours |
| EDNS Client Subnet (ECS) | Not sent | Not sent |
| Encrypted transport (DoH / DoT) | Yes | Yes |
| DNS-over-TLS host | dns.quad9.net | 1dot1dot1dot1.cloudflare-dns.com |
| Operator | Quad9 Foundation — a Swiss non-profit | Cloudflare — a US security & CDN company |
Reliability
Both Quad9 and Cloudflare DNS run on globally distributed anycast infrastructure designed to keep answering even if a single data center fails, and both have long, dependable track records. Neither publishes outage figures that give one a durable edge, so for everyday use — including as one of the two addresses on your router for redundancy — either is a trustworthy choice.
Setup: how to switch
Changing DNS takes a couple of minutes and installs nothing. Enter the primary and secondary addresses from the table on your router (to cover every device at once) or on a single device. If you're choosing Quad9 for its blocking, use 9.9.9.9 and 149.112.112.112 together so a fallback never drops the protection. Step-by-step walkthroughs are available for Windows, macOS, Android, iPhone, Linux, and your router.
The verdict
There's no loser here — both are excellent, free resolvers with strong privacy. The honest differentiator isn't speed, it's the default: do you want a resolver that actively blocks threats, or one that stays neutral and gets out of your way?
- Pick Quad9 if you want malware and phishing blocking switched on by default across every device, prefer a non-profit operator whose mission is protection, and don't need an unfiltered resolver.
- Pick Cloudflare if you want a plain, unfiltered resolver with an independently audited no-logging policy — and the option to add filtering later on 1.1.1.2 or 1.1.1.3 only if you decide you want it.
Torn on speed? Run the DNS speed test now — it measures both resolvers from your exact connection and reports the real median latency and jitter, which beats any general claim about which is "faster."
Quad9 vs Cloudflare — questions
Does Quad9 block malware by default?
Yes. At its main address (9.9.9.9), Quad9 checks domains against threat-intelligence feeds and refuses to resolve ones flagged as malicious — no configuration needed. If you want a resolver that filters nothing, use Quad9's unsecured address (9.9.9.10) or Cloudflare's 1.1.1.1 instead.
Can Cloudflare block malware like Quad9?
Yes, but not on the default address. Cloudflare's 1.1.1.1 is deliberately unfiltered. To get malware blocking you point your device at 1.1.1.2 (malware) or 1.1.1.3 (malware plus adult content) — different IP addresses, not a toggle. Quad9's difference is that the protection is already on at 9.9.9.9.
Is Quad9 or Cloudflare faster?
Neither is faster everywhere. Both run global anycast networks, so your lookups usually reach a nearby server for either one, and real-world speed comes down to your distance to each network and how it peers with your ISP. Quad9's security check happens on the resolver side and isn't a meaningful source of delay. The honest way to decide is to run the live DNS speed test from your own connection.
Which is more private, Quad9 or Cloudflare?
Both take a strong no-logging stance and neither sends EDNS Client Subnet. Quad9 keeps no source IP addresses and is run by a Swiss non-profit. Cloudflare writes no query logs to disk, purges anonymized data within 24 hours, and has published an independent audit. Both are solid privacy choices; the deciding factor between them is usually filtering, not privacy.
Will Quad9's blocking break normal websites?
Quad9 only blocks domains flagged as malicious by its threat feeds, so ordinary sites resolve as usual. If you ever suspect a legitimate site is being caught, you can switch to Quad9's unfiltered address (9.9.9.10) or to Cloudflare's 1.1.1.1, which applies no blocking at all.
Can I use Quad9 and Cloudflare together?
You can, but mixing a filtered and an unfiltered resolver is usually not what you want: if a device falls back to the second one, you lose the guarantee of the first. If your goal is security blocking, set both of Quad9's addresses (9.9.9.9 and 149.112.112.112). If your goal is a plain resolver, use both of Cloudflare's (1.1.1.1 and 1.0.0.1).