A curated list of public DNS providers that block malware, phishing, and offer enhanced security via IPv6.
| # | Provider Name | Primary IPv6 Address | Secondary IPv6 Address | Security Feature |
|---|---|---|---|---|
| 1 | Quad9 (Secure) | `2620:fe::fe` | `2620:fe::9` | Blocks threats, DNSSEC, DoT/DoH support. |
| 2 | AdGuard DNS (Default) | `2a10:50c0::ad1:ff` | `2a10:50c0::ad2:ff` | Ad blocking, malware/phishing protection. |
| 3 | Cloudflare (Security) | `2606:4700:4700::1112` | `2606:4700:4700::1002` | Malware and adult content blocking (`1.1.1.2` equivalent). |
| 4 | OpenDNS (FamilyShield) | `2620:119:35::35` | `2620:119:53::53` | Malware and basic adult content filtering. |
| 5 | CleanBrowsing (Security) | `2a0d:2a00:1::1` | `2a0d:2a00:2::1` | Blocks malware, phishing, and explicit content. |
| 6 | NextDNS | `2a0d:2406:1801::` | `2a0d:2406:1802::` | Customizable security lists (e.g., threat intelligence feeds). |
| 7 | Verisign Public DNS | `2620:74:1b::1:1` | `2620:74:1c::2:2` | High reliability with mandatory DNSSEC validation. |
| 8 | Yandex.DNS (Safe) | `2a02:6b8:0:1::feed:1ff` | `2a02:6b8:0:1::feed:1ff` | Blocks viruses and fraudulent websites. |
| 9 | Neustar UltraDNS (Threat) | `2610:a1:1018::3` | `2610:a1:1019::3` | Threat protection and malware blocking. |
| 10 | DNS.SB | `2a09::` | `2a11::` | Strict DNSSEC and DNS over TLS (DoT) support. |
| 11 | Control D | `2606:1a40::` | `2606:1a40:1::` | Powerful rule engine for advanced filtering. |
| 12 | Google Public DNS (Standard) | `2001:4860:4860::8888` | `2001:4860:4860::8844` | High security baseline, supports DNSSEC and DoT/DoH. |
| 13 | dns0.eu (Family) | `2a0f:fc80::3` | `2a0f:fc81::3` | Malware and adult content filtering (European focus). |
| 14 | AdGuard DNS (Family) | `2a10:50c0::bad1:ff` | `2a10:50c0::bad2:ff` | Ad blocking and adult content protection. |
| 15 | CleanBrowsing (Adult Filter) | `2a0d:2a00:1::1` | `2a0d:2a00:2::1` | Blocks adult and malicious content. |
Use this command on macOS to temporarily set the DNS for your Wi-Fi interface. Adapt the service name for Ethernet.
# Example using Quad9 (Secure) IPv6 addresses
sudo networksetup -setdnsservers "Wi-Fi" 2620:fe::fe 2620:fe::9
# Verify the change
networksetup -getdnsservers "Wi-Fi"For distributions using `systemd-resolved`, modify the configuration file to make the change permanent.
# Edit the configuration file
sudo nano /etc/systemd/resolved.conf
# Add or uncomment the DNS and DNSSEC lines:
# [Resolve]
# DNS=2620:fe::fe 2620:fe::9
# DNSSEC=true
# Restart the service to apply changes
sudo systemctl restart systemd-resolvedRun PowerShell as Administrator to configure the DNS for a specific network adapter by its index number.
# Open PowerShell as Administrator
# Find your network adapter's index (look for the "InterfaceIndex")
Get-NetAdapter | Select-Object Name, InterfaceIndex
# Set the IPv6 DNS for the interface (e.g., index 12, using AdGuard)
Set-DnsClientServerAddress -InterfaceIndex 12 -ServerAddresses ("2a10:50c0::ad1:ff","2a10:50c0::ad2:ff")
# Verify the settings
Get-DnsClientServerAddress -InterfaceIndex 12The best method for network-wide security is configuring the DNS directly on your router. Look for **WAN**, **Internet Settings**, or **DHCP/DNS Settings** in your router's admin panel to update the **IPv6 DNS Servers** fields.