What Is 1.1.1.1? A Plain Guide to Public DNS Resolvers

Ask a home-networking forum why a site loads slowly and someone will say it within five replies: just switch your DNS to 1.1.1.1. It gets offered the way duct tape gets offered — as the fix for everything. I have typed those digits into my own router. Sometimes pages did snap open faster afterwards. Once, at a relative's house, it 'fixed' a problem that turned out to be a dying router which then died completely a week later, taking my reputation with it.

So let us be precise about what those four digits are, what changes when you use them, and what very much does not.

First, the job a resolver does for you

Every time anything on your network asks for a website by name, something has to translate that name into an address. That something is a recursive resolver, and you already have one: your internet provider runs it, and your router hands its address to every device automatically. You never chose it, you probably do not know its address, and it answers thousands of your questions a day. The basics of what a DNS server is cover the cast of characters; the resolver is the one doing the legwork on your behalf.

It is also a witness. Your resolver sees every name you look up — not the pages themselves, but the names, which amounts to a decent sketch of your habits. Whoever runs your resolver holds that log. Switching resolvers does not remove the witness. It changes who the witness is.

So what exactly is 1.1.1.1?

1.1.1.1 is a public recursive resolver, operated by Cloudflare and open to anyone, free, at an address short enough to remember — which is honestly half the reason it spread. There is a second address, 1.0.0.1, for the usual reason: so a single dead address cannot take your lookups down with it. Public resolvers run by other companies exist at other famous addresses; the idea is decades old. 1.1.1.1 is simply the one that became a household name.

'Public' is the whole point. Your provider's resolver exists to serve its customers. A public resolver exists to serve whoever asks, and takes its instructions from you rather than from your provider's defaults.

How it differs from the resolver you already have

The rest of the family

The famous address has siblings, and knowing them prevents a common confusion. The same operator publishes variants at neighbouring addresses: one that refuses names known to serve malware, and one that refuses those plus adult content, aimed at households. People sometimes land on a filtering variant without realising — through a guide, a router preset, or a well-meaning relative — and then report, puzzled, that certain sites “do not exist”. They exist. The resolver is declining to introduce you, which is a feature somebody chose on your behalf.

There are IPv6 forms too, long hex strings like 2606:4700:4700::1111, which is why nobody quotes them at dinner parties. If your connection runs IPv6 and you set only the IPv4 addresses, some devices quietly keep using whatever IPv6 resolver they were handed, and your lookups split between two services — confusing every test you run afterwards. A device that offers a screen for one family usually has a screen for the other. Fill both.

Read that table again and notice what is not in it: a row promising speed. Speed is a separate question, and it deserves its own honest section below.

The privacy claims, with the limits left in

Switching changes who can log your lookups. The operator of 1.1.1.1 still sees your queries — it has to, in order to answer them — so what you are really choosing is whose privacy policy you prefer. Pair it with encrypted DNS and you gain something real: with DNS over HTTPS or its TLS sibling, the hop between you and the resolver is encrypted, so your provider and the coffee-shop Wi-Fi can no longer read the questions as they pass.

Now the limits. The sites you visit still see your connection arriving from your own address. Your provider still sees which addresses you connect to, even if it can no longer see the names you asked about. 1.1.1.1 is not a VPN, does not claim to be one, and any guide that lets you walk away thinking otherwise is selling something.

Why it can feel faster — and why it might not

Two genuine mechanisms work in its favour. The first is anycast: the same address is announced from locations all over the world, so your query lands at a nearby instance rather than crossing an ocean. The second is cache. A resolver answering questions for a huge crowd has probably been asked for the popular names already, and a cached answer comes back immediately instead of after a full lookup chain. Hit a warm cache all day and browsing does feel snappier.

The cache cuts both ways, though. An obscure name nobody has asked for still needs the full chain of lookups, wherever your resolver lives. And geography is personal: your provider's resolver might sit one short hop from your house, while the nearest anycast instance routes oddly from your particular network. I have seen both win. Measure with your own browsing over a few days, not with faith.

A word about resolver speed rankings, because you will find them if you search. Benchmarks time how quickly resolvers answer a list of names from your connection, and the results are real — for those names, at that hour, on that connection. What they cannot capture is your mix. The obscure names a household actually asks about start uncached everywhere, and a resolver that wins the benchmark by milliseconds can lose your Tuesday evening to a routing quirk nobody measured. Use rankings to break a tie, not to make the decision.

One more scope limit worth keeping straight: a resolver only ever helps the first step, the lookup. Once your device has an address and starts talking to a site, the resolver leaves the story entirely — it is not consulted again until the cached answer expires. So a slow stream, a struggling call, a download that crawls: none of those are DNS problems wearing a disguise, and no resolver, however fast or famous, will touch them. Blame is a budget. Spend it on the layer that is actually slow.

When I would not switch

• A work or school laptop. Its resolver settings may be deliberate policy, and internal names — the printer, the file server, the intranet — often only resolve through the office resolver. Point it elsewhere and things break mysteriously.
• A network behind a captive portal. The hotel and airport login dance is fragile enough already; sending your queries somewhere unusual before you have logged in can make it stranger.
• If you quietly rely on your provider's family or malware filtering. A plain public resolver does not filter. Switching can remove a protection you forgot you had.
• In the middle of a fault you want your provider to fix. Their support will, fairly, blame the one thing you changed, and you will have no answer.

If none of those apply and you want to try it, changing your DNS server takes a few minutes — do it on one device first, live with it for a few days, and keep the router for last.

One namesake to keep separate: the app

Search an app store for these digits and you will find an app from the same operator, built on a companion technology that does something the plain resolver does not: it routes a phone's traffic through the operator's network, which is much closer to what a VPN does than to a resolver swap. Bundling the two under one brand causes real confusion. People install the app expecting “just DNS” and get a tunnel; other people type the digits into a settings screen expecting a tunnel and get just DNS. They are different tools that happen to share a famous name, so decide which of the two you actually want before you install or type anything. My rule of thumb: if you typed digits into a settings screen, you changed a resolver. If you installed something that asked for VPN permissions, you installed a tunnel.

My own setup these days is a compromise: the house router points at a public resolver, the laptop takes whatever each network hands it. Not ideology — just the arrangement that broke the fewest things. That is the honest frame for 1.1.1.1 as a whole. The digits are not magic, and they are not a scam either. They are a choice about who answers your questions, made by you instead of by default.