Public DNS vs ISP DNS servers: pros, cons and setup

A DNS server looks up which IP address belongs to a website name, so your computer or phone knows where to connect. By default you use the DNS servers of your internet provider (ISP), which work straight away with no setup. A public DNS server, such as Google (8.8.8.8), Cloudflare (1.1.1.1) or Quad9 (9.9.9.9), is one you choose yourself when you want more say over privacy, protection against malicious domains or a fallback for when your ISP's DNS has trouble.

This article explains what a DNS server and a DNS provider are, the pros and cons of public DNS versus ISP DNS, which DNS server to use for your situation and how to change the DNS server on your computer, phone or router.

What is a DNS server?

DNS (Domain Name System) is the address book of the internet. When you type ljpc-hosting.nl, your device asks a DNS server for the matching IP address. Only with that address can your browser connect to the right server. This happens for every website you open and every email you send, usually in a fraction of a second.

There are two kinds of DNS servers, and it helps to tell them apart:

• Resolver (also called a recursive DNS server): the DNS server your device uses. It finds the answer for you and keeps it in its cache for a while, so the next lookup is faster. This article is about this kind: your ISP's resolver or a public one.
• Authoritative nameserver: the server that holds the official answer for a domain. For domains whose DNS is hosted at LJPc, these are ns1, ns2 and ns3.ljpc.network. Which nameservers belong to a domain is set in its NS record.

A resolver starts at the root servers of the internet, then asks the servers of the extension (for example .com or .nl) and so arrives at the domain's own nameservers. Those return, for example, the A record with the IP address.

What is a DNS provider?

"DNS provider" can mean two different things:

• The company behind your resolver. That is your ISP, unless you set a public DNS server yourself. It decides how you look up other websites.
• The company that hosts the DNS of your domain. It runs the nameservers and records of your own domain, such as the A record of your website and the MX record for your email. If your domain uses LJPc's nameservers, that is us.

The two are independent. Setting Cloudflare as the DNS server on your laptop changes nothing about your own domain's DNS. And moving your domain to other nameservers does not change which resolver you and your visitors use.

Your ISP's DNS servers

Out of the box, your modem or router hands your devices the DNS servers of your ISP. As long as DNS on your device is set to automatic, you already use them and there is nothing to fill in. To go back to your ISP after trying a public DNS server, set the DNS setting to automatic again.

In the Netherlands, Ziggo lists 62.179.104.196 and 213.46.228.196 as the DNS servers for its business connections. If you use your own modem with Ziggo, its phone service only works with the Ziggo DNS servers your modem receives automatically; for internet you are free to use any DNS server.

Pros

• Works immediately, with no settings on your devices.
• The servers sit in your ISP's network, close to your connection.
• If something breaks, your ISP's support can help with their own setup.

Cons

• Your ISP sees which domain names you look up. What it does with that is set out in its privacy policy.
• You do not choose the extras yourself, such as malware filtering or encrypted DNS. That depends on what your ISP offers.
• If your ISP's DNS fails, the internet seems down even though your connection still works.

Public DNS servers

A public DNS server is a resolver you can use for free, whichever ISP you have. The best known are Google Public DNS, Cloudflare and Quad9. Quad9 is a Swiss foundation, covered by Swiss privacy law and the GDPR. Since June 2025 there is also DNS4EU, a European resolver set up with support from the European Union and run by the Czech company Whalebone. Its public service is meant for individuals in Europe, not for business networks.

Pros

• You choose whose privacy policy you trust. Quad9 does not record users' IP addresses. Cloudflare keeps your IP address only in truncated form, apart from a small sample, and deletes its logs within 25 hours. Google deletes its temporary logs with your full IP address within 24 to 48 hours and keeps a sample with only your city or region after that.
• A filtering variant blocks known malware and phishing domains before your device connects to them.
• All four validate DNSSEC signatures and support encrypted DNS (DNS over HTTPS and DNS over TLS).
• You have a working fallback when your ISP's DNS is down.

Cons

• You set them up yourself, per device or in your router.
• Your ISP still sees which servers you connect to; only encrypted DNS hides which names you look up.
• A filter can occasionally block a legitimate website. Switch to an unfiltered variant for a moment or report it to the service.

Public DNS vs ISP DNS at a glance

Which DNS server should you use?

There is no single best DNS server for everyone. Choose based on what matters to you:

• Everything works and you want zero setup: stay with your ISP's DNS.
• A secure DNS server that blocks malware and phishing: pick a filtering variant, such as Quad9 (9.9.9.9) or Cloudflare 1.1.1.2. At home, DNS4EU Protective (86.54.11.1) is another option. For a company, a business DNS filter can also detect DNS tunneling, where malware hides data inside DNS traffic.
• Privacy: read the service's privacy policy and turn on encrypted DNS as well, so your ISP no longer sees which names you look up.
• The fastest DNS server: measure it. How fast a resolver is for you depends on the distance to its nearest server and on whether the answer is already in its cache. dig shows the response time under Query time, for example dig ljpc-hosting.nl @9.9.9.9. To compare several resolvers properly, with GRC's DNS Benchmark or the free dnseval, see DNS benchmark: how to find the fastest DNS server. A faster DNS server only speeds up the lookup, not the loading of the website itself. Google passes part of your IP address on to nameservers (EDNS Client Subnet), so large services can send you to a server nearby. Cloudflare does not, and Quad9 only does on 9.9.9.11.
• Children at home: a family filter such as Cloudflare 1.1.1.3 or DNS4EU with child protection (86.54.11.12), set in your router, covers every device on your Wi-Fi.

Always enter two addresses, a preferred and an alternate DNS server, so your device can fall back when one does not answer. Take both from the same service. With two different services you may get different answers, for example when one filters a domain and the other does not.

How to change your DNS server

You can set a DNS server per device, or once in your router so it applies to everyone on your network. Note the current setting before you change anything, so you can always go back to automatic.

Windows 11

1. Select Start, Settings, Network & internet.
2. Choose your connection: for Wi-Fi, select Manage known networks and then your network, or select Ethernet.
3. Next to the DNS settings, select Edit and choose Manual.
4. Turn on IPv4 and enter the two addresses of your service under Preferred DNS and Alternate DNS. Do the same for IPv6 if your connection has IPv6.
5. For encrypted DNS, set DNS over HTTPS to On (automatic template). Select Save.

macOS

1. Choose Apple menu, System Settings, and click Network in the sidebar.
2. Click your network service, for example Wi-Fi, then click Details.
3. Click DNS, click the add button at the bottom of the DNS servers list, enter the address and click OK.

iPhone and iPad

1. Open Settings and tap Wi-Fi.
2. Tap the info button next to your network, then tap Configure DNS.
3. Change Automatic to Manual, remove the existing servers, tap Add Server, enter the addresses and tap Save.

This only applies to that Wi-Fi network, not to mobile data.

Android

1. Open Settings and tap Network & internet, then Private DNS. On Samsung, tap Connections, More connection settings, Private DNS. If you cannot find it, search Settings for Private DNS.
2. Choose Private DNS provider hostname.
3. Enter the hostname of your service, for example dns.google, one.one.one.one or dns.quad9.net, and tap Save.

Private DNS is encrypted (DNS over TLS) and applies to every network your phone connects to, not only to one Wi-Fi network.

Router

In your router you set the DNS server for all devices at once. Where the setting lives differs per router; look for DNS in the admin page, often under the LAN or DHCP settings. If your ISP's modem does not let you change the DNS servers, set them per device instead.

Only in your browser

Chrome and Firefox can use encrypted DNS on their own, separate from your device settings. In Chrome, go to Settings, Privacy and security, Security, and under Advanced turn on Use secure DNS and pick a service provider. In Firefox, go to Settings, Privacy and security, DNS over HTTPS; choose Custom to pick the service yourself. Other apps on your computer keep using your device's DNS server.

Check which DNS server you use

Run nslookup ljpc-hosting.nl in Command Prompt or Terminal. At the top of the output, Server shows which DNS server your device asked, with its IP address below it. If that is your router, for example 192.168.1.1, your router forwards the lookups to the DNS server set in the router, usually your ISP's.

Whether your resolver validates DNSSEC signatures is shown by the internet.nl connection test, in the part on domain name signatures (DNSSEC).

DNS servers and your own domain at LJPc hosting

If your domain uses LJPc's nameservers, ns1, ns2 and ns3.ljpc.network give the official answer for your domain, over IPv4 and IPv6. Which DNS server your visitors use makes no difference to that answer: every resolver fetches it from our nameservers. If your domain is registered with us and uses our nameservers, we turn on DNSSEC automatically, so validating resolvers, such as all four in the table above, recognise a forged answer.

Do not enter ns1, ns2 or ns3.ljpc.network as the DNS server on your computer or router. They are authoritative nameservers: they only answer for domains hosted with us, so other websites will not load. If you want to change your domain's nameservers instead, read change your nameservers.

Changed a record and still seeing the old value? Then your resolver still has the old answer in its cache. Ask our nameserver directly, for example with dig A yourdomain.com @ns1.ljpc.network +short. Google and Cloudflare also offer a page to clear their cache for a single domain name: Flush Cache for Google Public DNS and Cloudflare's Purge Cache. Why a change takes time is explained in what is DNS propagation. If your domain does not work at all, troubleshoot DNS problems takes you through it step by step. You manage the records themselves in Plesk or in the customer portal at portal.ljpc.nl; see manage DNS records.

Stuck with the DNS of your domain? Create a support ticket in the customer portal and we will look into it with you.