A PowerShell script that benchmarks 17+ public DNS resolvers for speed, reliability, and security - then applies the best one to your system automatically.
- Detects your active network adapter and current DNS settings
- Benchmarks 17 DNS providers across 10 test domains with multiple queries each
- Scores each provider using a weighted composite:
- Speed (40%) - average query latency
- Reliability (25%) - successful resolution rate
- Security (25%) - DNSSEC, encryption, logging policy, threat blocking
- Consistency (10%) - low jitter / stable response times
- Recommends the best DNS for your network
- Applies the winning DNS to your system (with confirmation + backup)
| Provider | Primary IP | Security Features |
|---|---|---|
| Cloudflare | 1.1.1.1 | DNSSEC, DoH, DoT, audited no-log |
| Cloudflare (Malware) | 1.1.1.2 | + malware blocking |
| Cloudflare (Family) | 1.1.1.3 | + malware & adult content blocking |
| 8.8.8.8 | DNSSEC, DoH, DoT | |
| Quad9 | 9.9.9.9 | DNSSEC, DoH, DoT, threat blocking, non-profit |
| Quad9 (Unfiltered) | 9.9.9.10 | DNSSEC, DoH, DoT, no filtering |
| OpenDNS | 208.67.222.222 | DNSSEC, DoH, phishing protection |
| OpenDNS (FamilyShield) | 208.67.222.123 | + family content filter |
| AdGuard | 94.140.14.14 | DNSSEC, DoH, DoT, ad/tracker blocking |
| AdGuard (Family) | 94.140.14.15 | + family content filter |
| Comodo Secure | 8.26.56.26 | Malware & phishing blocking |
| CleanBrowsing (Security) | 185.228.168.9 | DNSSEC, DoH, DoT, malware blocking |
| CleanBrowsing (Family) | 185.228.168.168 | + family content filter |
| Mullvad | 194.242.2.2 | DNSSEC, DoH, DoT, privacy-focused |
| Control D | 76.76.2.0 | DNSSEC, DoH, DoT, customizable |
| Neustar UltraDNS | 64.6.64.6 | DNSSEC, enterprise-grade |
| Level3 / CenturyLink | 4.2.2.1 | Basic DNS |
Paste this into any PowerShell window - it auto-elevates to admin, downloads, benchmarks, and applies the best DNS:
irm https://raw.githubusercontent.com/TiltedLunar123/DNS-Benchmark/master/install.ps1 | iexWhat happens:
- Requests admin privileges (UAC prompt)
- Downloads the latest script to
%USERPROFILE%\DNS-Benchmark\ - Runs the full benchmark
- Window stays open so you can see the results and confirm changes
- Saves the script locally so you can re-run anytime
# Run as Administrator
.\DNS-Benchmark.ps1The script will benchmark all DNS servers and ask before applying any changes.
# Full benchmark + apply best DNS (interactive)
.\DNS-Benchmark.ps1
# Benchmark only, don't change anything
.\DNS-Benchmark.ps1 -SkipApply
# Run with more queries for higher accuracy
.\DNS-Benchmark.ps1 -TestCount 10
# Export results to CSV
.\DNS-Benchmark.ps1 -Report
# Also set the winner's IPv6 DNS (dual-stack networks)
.\DNS-Benchmark.ps1 -IncludeIPv6
# Benchmark the resolvers in parallel (PowerShell 7+, much faster)
.\DNS-Benchmark.ps1 -Parallel
# Combine flags
.\DNS-Benchmark.ps1 -TestCount 10 -Report -SkipApply
# Put back whatever DNS you had before
.\DNS-Benchmark.ps1 -Restore
# Restore, but go straight to automatic (DHCP) and ignore the backup
.\DNS-Benchmark.ps1 -Restore -ResetDhcp| Parameter | Type | Default | Description |
|---|---|---|---|
-TestCount |
int | 5 | Queries per DNS per domain |
-SkipApply |
switch | false | Benchmark only, don't apply changes |
-Restore |
switch | false | Put back the DNS recorded in the newest backup (see below) |
-ResetDhcp |
switch | false | With -Restore, reset to DHCP/automatic and skip the backup |
-Report |
switch | false | Export results to CSV |
-IncludeIPv6 |
switch | false | Also apply the winner's IPv6 DNS (see below) |
-Parallel |
switch | false | Benchmark resolvers concurrently (PowerShell 7+; see below) |
-ThrottleLimit |
int | 8 | Max resolvers benchmarked at once with -Parallel |
Every apply writes your previous DNS to a timestamped dns-backup_*.json next
to the script, and -Restore reads the newest one for that adapter and puts
those servers back. If you were running a Pi-hole, a work resolver, or anything
else static, that is what you get back.
When the backup shows the adapter was on DHCP, or there is no backup to read,
-Restore resets to automatic DNS the way it always did. Pass -ResetDhcp
alongside -Restore to force the reset regardless of what the backup says.
Both address families are handled. A static restore resets the adapter first,
so an IPv6 pair applied by an earlier -IncludeIPv6 run does not outlive a
restore of an IPv4-only backup. The DNS cache is flushed for you either way.
Older releases reset to DHCP no matter what, which meant a static setup was recorded and then dropped. If you upgraded from one of those and your old resolver is already gone, the backup that has it is still sitting in the script directory.
By default the script only touches IPv4 DNS. On a dual-stack network that leaves a gap: the machine can still resolve over whatever IPv6 DNS the router handed out, quietly bypassing the resolver you just picked.
Run with -IncludeIPv6 to also set the winning provider's IPv6 addresses.
It only does so when the adapter actually has IPv6 bound and the chosen
resolver publishes IPv6 anycast (most in the list do; a few are IPv4-only and
are applied as IPv4 only). The previous IPv6 servers are saved in the same
backup, and -Restore puts both families back. It stays off by default so an
IPv6 configuration is never changed unless you ask for it.
By default the benchmark tests one resolver at a time. With 17 servers that
takes a couple of minutes at the default query count. Run with -Parallel to
test them concurrently and finish much faster:
.\DNS-Benchmark.ps1 -Parallel
.\DNS-Benchmark.ps1 -Parallel -ThrottleLimit 16-Parallel needs PowerShell 7 or newer, since it uses ForEach-Object -Parallel. On Windows PowerShell 5.1 it prints a note and runs sequentially.
-ThrottleLimit (default 8) caps how many resolvers are measured at once.
One tradeoff: running the servers at the same time means they share your
connection while their latency is being measured, so numbers can read a little
higher than a clean sequential run. Leave -Parallel off when you want the
most precise ranking; use it when you just want a fast answer.
Each DNS server gets a composite score out of 100:
Score = (Speed × 0.40) + (Reliability × 0.25) + (Security × 0.25) + (Consistency × 0.10)
- Speed - Normalized average latency across all test queries (lower = better)
- Reliability - Percentage of queries that resolved successfully
- Security - Pre-assigned score based on known features: DNSSEC validation, encryption (DoH/DoT), logging policy, threat blocking, audits
- Consistency - Normalized jitter / standard deviation of response times
Results are displayed with letter grades (A+ through F) and the top 3 are starred.
- Pre-flight connectivity check - probes a few public resolvers before benchmarking, so an offline machine gets a clear message instead of a ranking built from failed queries
- Asks before applying - won't change DNS without your confirmation
- Automatic backup - saves your previous DNS settings to a timestamped file before changing
- Easy restore - run with
-Restoreto put back the DNS you had before, static config included - Picks the right adapter - targets the NIC carrying the default route, so a second connected adapter can't absorb the change
- Admin required - script won't run without elevated privileges
DNS Server Avg (ms) Med (ms) Jitter Rely % Security Score Grade
----------------------------------------------------------------------------------------------------------
★ Quad9 12.45 11.20 3.21 100.0% 96/100 89.2 A+
★ Cloudflare 8.33 7.50 2.10 100.0% 92/100 88.5 A+
★ Cloudflare (Malware) 10.12 9.80 2.55 100.0% 95/100 87.1 A
Mullvad 18.90 17.60 4.33 99.8% 94/100 82.4 A-
...
- Windows 10/11
- PowerShell 5.1+ (pre-installed on Windows 10/11);
-Parallelneeds PowerShell 7+ - Run as Administrator (required to change DNS settings)
MIT License - see LICENSE for details.