New study benchmarks Malware blocking by free third-party DNS providers
A new study has been published that attempts to benchmark the effectiveness of several popular and free third-party Domain Name Service (DNS) providers to see how effective they are at blocking 100 malware and phishing websites (whittled down from an original list of 41,000 to reduce the risk from false positives). The results make for an interesting read.
For context. DNS providers typically convert Internet Protocol (IP) addresses into a human-readable form and back again (e.g. 123.56.32.1 to exampleofafakedomain.co.uk). Most such services tend to be provided automatically by UK broadband ISPs or mobile network operators, thus operating seamlessly in the background, without you ever really being aware.
However, it’s also possible to replace the DNS from your broadband or mobile provider with one from a third-party service, which is often as simple as changing a couple of server IP addresses on your device or router. A good third-party DNS will give you better performance, additional security filtering for bad sites and may help you to avoid DNS related bugs that your ISP can sometimes experience. In addition, they can be used to circumvent DNS level web blocking / filtering enforced by your ISP.
Advertisement
The new study, which was conducted by MUO (Make Use Of) and is well worth a read to get the full context (credits to Steve for spotting), attempted to benchmark the effectiveness of how the free DNS solutions from Cloudflare DNS, Quad9, NextDNS and AdGuard fair in terms of their ability to block websites that are known to predominantly contain malware and phishing dangers.
One of the caveats here is that this did not examine the speed of each DNS provider, although that’s probably for the best as benchmarking the performance of a third-party DNS is difficult (i.e. the results would vary between individual broadband connections and ISPs). Nevertheless, both Cloudflare and Quad9 below are well known to perform well across the world and deliver low pings (i.e. fast latencies).
Otherwise, the results found that AdGuard and Cloudflare delivered the strongest overall block rate – 86% and 85% respectively, which was followed by NextDNS (70%) and Quad9 (68%). But it’s important to take these results with a pinch of salt because threat-intelligence databases are constantly changing as malicious pages appear, disappear, and get reclassified. In other words, the results could easily be different if the same test were conducted a week later.
On top of that there were other differences between the services, which might be worth considering. For example, Cloudflare is much easier than others to set up, while Quad9 focuses more on its core task (not everybody wants a DNS provider to do extra filtering) and NextDNS offers a lot of more advanced tweaks for logging, blocklists and security protections etc. Finally, AdGuard’s free DNS tier has some restrictions on its usage and to go beyond those you’d have to pay.
Advertisement
One final observation is that all of the four providers delivered strong malware blocking (range of 94% to 100%), leaving phishing sites as the main area of weakness. This is partly because it’s easier to detect malware in code, but phishing by nature tries to avoid being so obvious.
Results of the DNS malware filtering study
Mark is a professional technology writer, IT consultant and computer engineer from Dorset (England), he also founded ISPreview in 1999 and enjoys analysing the latest telecoms and broadband developments. Find me on X (Twitter), Mastodon, Facebook, BlueSky, Threads.net and Linkedin.
Advertisement
Leave a Reply
Privacy Notice: Please note that news comments are anonymous, which means that we do NOT require you to enter any real personal details to post a message and display names can be almost anything you like (provided they do not contain offensive language or impersonate a real person's legal name). By clicking to submit a post you agree to storing your entries for comment content, display name, IP and email in our database, for as long as the post remains live.
Only the submitted name and comment will be displayed in public, while the rest will be kept private (we will never share this outside of ISPreview, regardless of whether the data is real or fake). This comment system uses submitted IP, email and website address data to spot abuse and spammers. All data is transferred via an encrypted (https secure) session.
I though the default free public Cloudflare DNS 1.1.1.1/1.0.0.1 was unfiltered?
https://developers.cloudflare.com/1.1.1.1/setup/
Use the following DNS resolvers to block malicious content:
1.1.1.2
1.0.0.2
or
2606:4700:4700::1112
2606:4700:4700::1002
Or 1.1.1.3 (etc) if you also want adult site blocking
@Cleggy
You’re right – in my view, it’s unacceptable for a public resolver like Cloudflare offering a service to consumers not to default to filtering malware. 1.1.1.1 is promoted as the headline resolver offering by Cloudflare, so it ought to include malware filtering, following the example of Quad9 and others.
It’s worth noting that public resolvers operated by US-based companies are subject to legislation including the US CLOUD Act, FISA 702 etc. This means that the personal information of non-US citizens using the services is readily available to US law enforcement without the need for a warrant. That is not the case for EU-based organisations, including Quad9, AdGuard and DNS4EU (Whalebone).
… although you may find your browser opts into DNS-over-HTTPS by default and therefore bypasses whatever you set at the OS or network level.
You can select the DNS-over-HTTPS provider in Firefox.
They didn’t take into account other popular dns like dns bunker and dns forge etc.. I use dns forge as its highly customised as they have normal,clean,hard and blank
I think it’s a bit unfair because I guarantee my NextDNS settings would probably block 90-95% of the malware ridden sites, with AI threat protection, using various filters (including the AdGuard one) and blocking newly registered domains.
Agreed. Plus I could use Adguards lists in Nextdns too!
Completely agree with NextDNS, plus the latest updates to security options allow you to enhance even more.
Not a fair comparison in my book as NextDNS uses other lists to achieve protection and covers a wide range of privacy options too.
In Windows 11 (in DNS server assignment) I set DNS to 9.9.9.9 and also enabled DoH with Quad9. This is better than setting up each browser you use.
Get a decent router and enforce at router level for everything, and enforce DNS over TLS at same time. Decent routers also allow DNS exceptions for specific devices too.
Very odd article, limited information and just a select few DNS providers, no mention of ControlD or OpenDNS, very strange.