SerpApi.Org
When it comes to DNS, there are plenty of tools you can use to figure out what's best for your system. You run the DNS tool, it spits out the "best DNS," and you plug the numbers into your adapter. Boom, your internet feels faster, and you're probably more secure and private, too.
But what happens when you run DNS tests on different tools? As I found out, you get a whole different set of results depending on the DNS test — and there is a good reason for that.
I ran DNS tests on three different tools
Broad testing should give clearer results
I've been running various DNS tests on and off for months now, since I swapped out Cloudflare for a custom DNS stack on my home network. Since then, I've also benchmarked some of the most popular DNS providers to see what's really best, and uncovered some DNS providers that I'd never heard about using GRC Benchmark V2.
I've used a few different tools in that time. DNS Speed Test is an online DNS testing tool that delivers fast results, while the aforementioned GRC Benchmark V2 is the new version of Steve Gibson's legendary GRC Benchmark V1 DNS testing tool. It's also a premium tool that'll cost you $10 for a lifetime license, but it's worth the money.
I also ran a PowerShell script on my PC that tested my DNS against a range of popular resolvers and websites, checking my existing DNS configuration against the other two tools, giving me three clear sets of data to work with.
But on three DNS testing tools, I got three different results
Each tool suggested a different best DNS
What really surprised me was the range of results I received from each of the tools. There is a good reason for that, which I'll elaborate on more in a moment, but it's basically down to the testing method used by each option.
So, GRC Benchmark V2 suggested I use a DNS service called Vercara, which, according to the tool, was streets ahead of most other options. However, that comes with its own problem: Vercara DNS is a premium, enterprise-focused DNS service. In that, while it's DNS resolution appears to be super-fast, it's not a tool I would use, because it's more expensive than free, which many other popular DNS resolvers are.
Then, DNS Speed Test suggested that Quad9 is the better option for my network. I've previously used Quad9 across many of my devices, and it's a popular DNS resolver that we frequently suggest folks try.
Finally, my PowerShell script found that, of the eight free DNS services included, AdGuard was the fastest option across the 25 samples.
Three different DNS tests, three different results, begging the question: "What gives?"
Why different DNS testing tools give different results
They're not disagreeing on speed — they're disagreeing on what to measure
On the face of it, I've received a jumbled mess of DNS testing results, making it difficult to understand what's really best for my network. What's really happening is that each tool is answering a slightly different DNS testing question.
For example, GRC Benchmark V2 doesn't just test the handful of DNS resolvers you've likely heard of. It's a comprehensive DNS testing tool, and that means it comes equipped with a massive built-in list of IPv4, IPv6, DoH, and DoT resolvers that it scans to build your list. That means the testing takes a while (over 20 minutes for me), but it also means that you receive a truly comprehensive list. But then, within that, as I found, there will be resolvers you can't use.
That's actually what GRC Benchmark V2's custom DNS list is useful for; you can curate a specific list of DNS resolvers rather than every one pre-built into the tool.
Furthermore, that's not the only part of the testing, throwing out some curveballs. GRC Benchmark V2 tests UDP, DoH, and DoT. But DNS Speed Test only tests DoH connections, which means every result represents the resolver's performance over an encrypted HTTPS connection, not the plain DNS most of your devices use by default. That distinction makes a difference, as I discovered when testing encrypted vs. unencrypted DNS providers.
My PowerShell script also uses a different testing method
And guess what? My PowerShell script does something different again. It only tests DNS over good old-fashioned UDP port 53, giving a different set of results again. The script is below if you'd like to try it yourself:
Caching is another point of contention and also alters the results you receive.
My script clears the DNS cache before every single pass, on purpose — I wanted cold, uncached lookups only, so five domains times five passes gave me 25 real queries per resolver with no cache propping up the numbers.
GRC V2 does the opposite: it deliberately measures both cached and uncached performance and blends them into a single, jitter-aware score, on the reasonable logic that real-world browsing hits your cache constantly. AdGuard topping my script isn't AdGuard being the fastest DNS I tested. Rather, it's AdGuard being the fastest at cold lookups specifically, which isn't as remarkable as it first looks.
So, which one of these results should I actually trust?
With all of that, and the differences in testing, it doesn't mean that any of the three DNS tests are broken. It means the greater consideration goes to what sort of connection and protocol you're using, and whether cold performance or a cached average is more important.
Given most folks aren't constantly clearing their DNS cache every day, cached average scores are more important.
We're not using Vercara for the previously stated reasons, and that leaves Quad9 and AdGuard. Given I've previously used Quad9 and always been happy with its performance, it looks like that's where I'll be heading back to.
