# DNS over HTTPS servers and providers: templates, ports, DoT hostnames and how to choose one URL: https://webvpn.org/encryption/dns-over-https-servers/ Updated: 2026-09-12 DNS over HTTPS servers and providers with DoH templates and DoT hostnames: Cloudflare, Quad9, NextDNS, AdGuard, Google and more, DoH ports explained, and Oblivious DoH. DNS over HTTPS servers are public resolvers that accept encrypted DNS queries at a template URL such as https://dns.quad9.net/dns-query on port 443, and most also offer DNS over TLS on the same hostname at port 853. The main providers are Cloudflare, Quad9, NextDNS, AdGuard DNS, Google Public DNS and a number of privacy-focused operators such as Mullvad, each with unfiltered and filtered variants. Choosing one is a matter of whether you want ad, tracker or malware filtering, whose logging policy and jurisdiction you accept, and whether you want per-device configuration. Configuring encrypted DNS on any platform requires a template or hostname, and providers publish these in scattered documentation. This guide gathers them into one reference, explains what templates and ports mean, distinguishes DoH and DoT addresses, describes the filtering variants, covers Oblivious DoH, and gives criteria for choosing. Check the provider's own documentation for current addresses, since they occasionally add variants. ## Templates, hostnames and ports A DoH template is the URL your device sends queries to. It looks like https://hostname/dns-query, and it is what Windows 11, browsers and macOS profiles ask for when you add a custom server. The standard path is /dns-query, though providers may use others. A DoT hostname is the server name your device connects to on port 853 with TLS. Android's Private DNS setting takes a hostname, and so do most home resolvers configured for encrypted upstream. The hostname is usually the same as the DoH template's host. Ports. DoH uses 443, shared with all HTTPS. DoT uses 853. Plain DNS uses 53. DNS over QUIC uses 853 over UDP. A network that blocks 853 blocks DoT; blocking DoH requires blocking the resolver's IP addresses, which the blocking guide on this site discusses. IP addresses still matter. A device needs to resolve the resolver's hostname before it can use it, which is a bootstrap problem solved either by the operating system using plain DNS once, or by configuring the resolver's IP alongside the template. Windows 11 requires you to enter the IP and associate it with a template. ## Reference: major DNS over HTTPS servers Provider Variant DoH template DoT hostname IPv4 Cloudflare Unfiltered https://cloudflare-dns.com/dns-query one.one.one.one 1.1.1.1, 1.0.0.1 Cloudflare Malware blocking https://security.cloudflare-dns.com/dns-query security.cloudflare-dns.com 1.1.1.2, 1.0.0.2 Cloudflare Malware and adult https://family.cloudflare-dns.com/dns-query family.cloudflare-dns.com 1.1.1.3, 1.0.0.3 Quad9 Malware blocking https://dns.quad9.net/dns-query dns.quad9.net 9.9.9.9, 149.112.112.112 Quad9 Unfiltered https://dns10.quad9.net/dns-query dns10.quad9.net 9.9.9.10, 149.112.112.10 Google Unfiltered https://dns.google/dns-query dns.google 8.8.8.8, 8.8.4.4 AdGuard DNS Ads and trackers https://dns.adguard-dns.com/dns-query dns.adguard-dns.com 94.140.14.14, 94.140.15.15 AdGuard DNS Family https://family.adguard-dns.com/dns-query family.adguard-dns.com 94.140.14.15, 94.140.15.16 AdGuard DNS Unfiltered https://unfiltered.adguard-dns.com/dns-query unfiltered.adguard-dns.com 94.140.14.140, 94.140.14.141 NextDNS Per profile https://dns.nextdns.io/PROFILEID PROFILEID.dns.nextdns.io Assigned per account Mullvad Unfiltered https://dns.mullvad.net/dns-query dns.mullvad.net 194.242.2.2 Mullvad Ad blocking https://adblock.dns.mullvad.net/dns-query adblock.dns.mullvad.net 194.242.2.3 Addresses are as published by each provider at the time of writing; confirm on the provider's site before relying on them, and note that several providers also publish IPv6 addresses and additional filtering tiers. ## Filtering variants Most providers offer more than one resolver, differing in what they refuse to resolve. - Unfiltered answers every query, leaving blocking to your browser or device. - Malware or security filtering refuses domains on threat lists, stopping many phishing and malware connections. Quad9's default and Cloudflare's 1.1.1.2 do this. - Ad and tracker filtering refuses advertising and tracking domains network-wide, replacing or supplementing a browser ad blocker. AdGuard DNS's default and Mullvad's adblock variant do this. - Family filtering adds adult content and sometimes other categories. - Configurable services, NextDNS and AdGuard DNS's personal accounts, let you choose lists, add exceptions and see logs if you enable them. Filtering at the resolver affects every app on the device, which is powerful and occasionally breaks things; unfiltered resolvers never surprise you. ## Oblivious DNS over HTTPS Standard DoH lets the resolver see both your queries and your IP address. Oblivious DoH inserts a proxy: your device encrypts the query for the resolver, sends it to the proxy, and the proxy forwards it without your IP. The resolver answers without knowing who asked; the proxy relays without knowing what was asked. Cloudflare operates ODoH-capable resolvers and Apple's iCloud Private Relay uses the approach for Safari and app traffic. Client support in general-purpose operating systems is still limited, and for most people a resolver with a strong logging policy achieves the practical goal. The DoH guide on this site has more on the trust question. ## Choosing a provider Ask five questions. - Do you want filtering? None, malware only, ads and trackers, or configurable. - Whose logging policy do you accept? Read it. Quad9 states it does not log user IPs; Cloudflare states short retention with independent audit; NextDNS lets you choose; Google logs in its documented way. - Which jurisdiction? Quad9 is Swiss, Mullvad is Swedish, Cloudflare and Google are American, AdGuard is Cypriot. This matters for legal process, not for encryption strength. - Do you need per-device configuration? NextDNS and AdGuard's personal service provide it; the others do not. - Is it fast where you are? Large anycast networks such as Cloudflare and Google are quick almost everywhere; test the others from your location. Any of these providers protects you from your ISP and local networks; the choice among them is about who you would rather have see the lookups instead. ## Running your own If no provider satisfies you, run your own resolver. AdGuard Home, Pi-hole with an encrypted upstream, unbound as a recursive resolver, or dnscrypt-proxy give you local control, and AdGuard Home can serve DoH and DoT to your devices with a certificate. A recursive resolver such as unbound talks directly to authoritative servers, so no single provider sees all your queries, at the cost of those queries travelling unencrypted to the authoritative servers. The blocking guide on this site describes the home resolver setups. ## A five-point checklist - Copy the template and hostname exactly from the provider's documentation. - Enter the IP addresses too where the platform requires them, as Windows 11 does. - Pick the filtering variant deliberately; filtered resolvers can block things you need. - Test with the provider's check page after configuring. - Record what you chose so you can change it later; a forgotten DNS setting is a common source of mysterious failures. ## What providers publish and independent reviewers report The reference above follows the providers' documentation and third-party assessment. Each provider listed publishes its DoH templates, DoT hostnames and IP addresses along with a privacy policy describing logging; Cloudflare additionally publishes an independent audit of its resolver privacy commitments, and Quad9 publishes its non-profit governance and data policy. The IETF specifications for DoH and DoT define the standard ports and the query path convention, and the Oblivious DoH specification defines the proxy and target roles used by Cloudflare and Apple. Independent reviewers comparing public resolvers report that performance differences among the major anycast providers are small for most users, that filtering resolvers block a large share of tracking and malicious domains, and that logging policy and jurisdiction, rather than encryption, distinguish the providers. ## Pick one, copy the template, test it Every server in the table above encrypts your lookups identically. Choose by filtering and policy, copy its template and hostname into your device with the enabling guide on this site, and verify on the provider's test page. If you later change your mind, switching resolvers is a two-minute edit. ## FAQ Q: What is a DNS over HTTPS template? A: The URL a client uses to send DoH queries to a resolver, such as https://dns.quad9.net/dns-query or https://cloudflare-dns.com/dns-query. Operating systems and browsers ask for this template when you configure a custom DoH server. Providers with per-user configuration, such as NextDNS, give each profile its own template URL. Q: What port does DNS over HTTPS use? A: Port 443, the standard HTTPS port, which is why DoH traffic is indistinguishable from web browsing. DNS over TLS uses port 853, and plain DNS uses port 53. A resolver's DoH endpoint may be hosted on a non-standard port, but public providers use 443. Q: Which DNS over HTTPS provider is best? A: Quad9 for a simple resolver with malware blocking and a non-profit no-logging stance, NextDNS or AdGuard DNS for configurable ad and tracker blocking, Cloudflare for speed with an audited privacy commitment, and Mullvad or similar for resolvers run by privacy-focused companies. The best choice depends on whether you want filtering and whose policy you trust. Q: What is the difference between DNS over TLS and DNS over HTTPS providers? A: Most providers support both, using the same hostname: the DoT hostname is entered as a server name on port 853, and the DoH template is a URL on port 443. Android's Private DNS uses the DoT hostname; browsers and Windows use the DoH template. Some providers publish separate hostnames for filtered variants. Q: What is Oblivious DNS over HTTPS? A: A variant of DoH in which queries pass through a proxy that strips your IP address before reaching the resolver, so the resolver cannot link queries to you and the proxy cannot see the queries. Cloudflare supports it as a target, and Apple's iCloud Private Relay uses it. Few client applications support it directly so far.