Quad9 vs Cloudflare: Which DNS Resolver Is More Secure and Private?

Ask which public DNS resolver is safer, Quad9 or Cloudflare, and you usually get an answer based on speed benchmarks. Speed is the least interesting difference. Both are free, both encrypt your queries, and both are fast enough that you will not notice the gap in normal browsing.

What actually separates them is three things: what they block before it reaches you, what they record about your queries, and whose laws govern the servers. On those three questions, Quad9 and Cloudflare made deliberately different choices. Here is the honest comparison.

The two resolvers at a glance

Quad9 (primary address 9.9.9.9) is run by the Quad9 Foundation, a non-profit based in Zurich, Switzerland. Its founding purpose is security: it blocks known malicious domains at the DNS layer using threat intelligence from more than a dozen providers, and it was built by people from IBM, Packet Clearing House, and the Global Cyber Alliance.

Cloudflare (primary address 1.1.1.1) is run by Cloudflare, a US-based public company. It launched in 2018 with a single headline promise: the fastest public resolver, backed by a strict no-logging privacy stance. Its default resolver does not filter anything, so blocking is opt-in through separate addresses.

Security: what each one blocks

This is the biggest practical difference. Quad9's default resolver blocks domains associated with malware, phishing, and command-and-control infrastructure. If a device on your network tries to reach a known-malicious host, Quad9 simply does not return the address, which stops a whole class of attacks before a connection is ever made. You get this protection automatically by pointing at 9.9.9.9.

Cloudflare's default 1.1.1.1 is deliberately unfiltered: it resolves everything, including malicious domains, and treats blocking as a separate choice. Cloudflare offers two filtering variants:

• 1.1.1.2 blocks malware.
• 1.1.1.3 blocks malware and adult content.

So the two are closer than they look, but the defaults matter. A non-technical user who just types in the primary address gets threat blocking from Quad9 and no blocking from Cloudflare. For a family network or a small business without a dedicated security team, that default is the whole point.

Privacy and logging

Both resolvers market themselves on privacy, and both are meaningfully better than your ISP's default DNS. The details differ.

Quad9 states that it does not collect or store personal data, and specifically does not log the source IP address of queries. It also does not send ECS data, the piece of your network information that many resolvers pass to authoritative servers to optimize routing. Not sending ECS is a privacy win and a small performance tradeoff. Because Quad9 is Swiss, it operates under Switzerland's data-protection laws rather than US jurisdiction.

Cloudflare commits to not logging source IP addresses and to purging query logs within 24 hours, and it has commissioned public audits (by KPMG) of that claim. That is a stronger transparency posture than almost any ISP offers. The caveat is jurisdiction: Cloudflare is a US company, so its infrastructure sits under US legal process.

Neither company sells your browsing data. The realistic distinction is not that one spies and one does not. It is which legal system you would rather trust, and whether independent auditing (Cloudflare) matters more to you than minimal data handling and a neutral jurisdiction (Quad9).

Speed and reach

Cloudflare has historically topped independent resolver speed rankings, thanks to one of the largest anycast networks in the world. Quad9 is fast and has expanded its points of presence significantly, but if you are optimizing purely for the lowest possible resolution latency, Cloudflare usually wins by a few milliseconds. In real-world browsing, where DNS answers are cached aggressively, the difference is rarely perceptible, and the threat-blocking lookup Quad9 performs adds negligible overhead.

Encryption and standards

Both resolvers support the modern encrypted-DNS protocols, so your queries are not sent in plaintext for anyone on the path to read or tamper with:

• DNS over HTTPS (DoH) and DNS over TLS (DoT): supported by both.
• DNSSEC validation: both validate DNSSEC signatures and refuse forged answers.

On protocol support they are effectively tied. If encrypted DNS is new to you, the wider set of options is covered in the DNS security solutions guide.

The honest comparison

Dimension	Quad9 (9.9.9.9)	Cloudflare (1.1.1.1)
Operator	Non-profit foundation	US public company
Jurisdiction	Switzerland	United States
Malware blocking (default)	Yes, on by default	No (use 1.1.1.2 / 1.1.1.3)
Content filtering option	Malware only	Malware, or malware + adult
Logs source IP	No	No (24-hour purge, KPMG-audited)
Sends ECS	No	Limited
DoH / DoT	Yes	Yes
DNSSEC validation	Yes	Yes
Raw speed	Fast	Fastest in most tests
Cost	Free	Free

Which one should you use?

• You want protection with zero configuration: Quad9 (9.9.9.9). Malware blocking is on by default, jurisdiction is neutral, and it does not send ECS.
• You want the fastest resolver and will configure filtering yourself: Cloudflare 1.1.1.1, or 1.1.1.2 if you also want malware blocking.
• Family or shared device: Cloudflare 1.1.1.3 (malware plus adult content), or Quad9 paired with a separate content filter.
• You run a business: use either as an upstream, but pair it with logging and policy controls, and consider a managed filtering DNS service rather than a public resolver alone.

There is also no rule that says pick one forever. Many people set Quad9 as primary and Cloudflare as secondary, or the reverse, to get threat blocking plus a fast fallback.

Frequently Asked Questions

Is Quad9 better than Cloudflare?

For default-on security, yes: Quad9 blocks malicious domains automatically, while Cloudflare's primary 1.1.1.1 is unfiltered. For raw speed, Cloudflare usually edges ahead. The better choice depends on whether you value automatic threat blocking or the lowest latency.

What is the difference between 9.9.9.9 and 1.1.1.1?

9.9.9.9 is Quad9's security-filtering resolver, run by a Swiss non-profit. 1.1.1.1 is Cloudflare's unfiltered, speed-optimized resolver, run by a US company. Both are free and support encrypted DNS.

Does Quad9 block malware by default?

Yes. Pointing a device at 9.9.9.9 blocks domains that Quad9's threat-intelligence feeds flag as malicious, with no extra setup.

Is Cloudflare DNS actually private?

Cloudflare says it does not log source IP addresses and purges query data within 24 hours, and it has published KPMG audits of that claim. The main caveat is that Cloudflare is subject to US jurisdiction.

Quad9 vs Cloudflare vs Google, which is safest?

Google's 8.8.8.8 is fast and reliable but, like Cloudflare's default, does not block malicious domains and operates under US jurisdiction. For automatic security blocking with a neutral jurisdiction, Quad9 is the safest default of the three.

Related reading

• Top 5 DNS security solutions: how Quad9 and Cloudflare stack up against NextDNS, Control D, and other filtering resolvers.
• The browser security landscape: DNS is one layer of defense; your browser is another.
• Top 10 VPNs compared: when you need to encrypt more than just your DNS queries.