Cloudflare 1.1.1.1 Offers DNS Filtering as Google Edges Speed Tests

Google’s 8.8.8.8 speed win is too small to settle the choice​

In his September 22 comparison for MakeUseOf, Pankil Shah reports testing Google Public DNS and Cloudflare with DNS Speed Test and manual scripts at different times of day. Google came out ahead more often, with an average advantage of approximately 0.3 milliseconds. Shah explicitly cautions that location, ISP, device, and test timing can change the outcome.

That qualification is important because a DNS resolver’s job is specific: it answers requests for information about domain names, including the addresses a device needs to reach internet services. A resolver benchmark measures that part of the process. It does not, by itself, measure how quickly an entire website becomes usable.

The September comparison supplies a useful personal observation, but not enough methodological detail to turn the result into a reproducible performance ranking. Its description does not establish the complete query set, sample count, cache conditions, or encrypted transport configuration. At a margin of three-tenths of a millisecond, those details matter more than the identity of the nominal winner.

An earlier MakeUseOf comparison illustrates how easily the order can reverse. Published on May 28, it reported average response times of 6.1 milliseconds for Google and 5.9 milliseconds for Cloudflare, with the services exchanging places during testing. That is a separate test from the same publication, not independent confirmation of September’s measurement, but it reinforces the limited usefulness of declaring an overall winner from such a narrow gap.

Google’s own Public DNS FAQ explains one reason results depend on the connection. Its service uses anycast, through which the same public address is advertised from multiple locations and network routing directs requests toward a service location. Google says the locations advertising its resolver addresses can change with network conditions and traffic load. Typing 8.8.8.8 therefore does not mean every reader is measuring the same physical server or network path.

For a home user, the sensible interpretation is that both services are candidates worth considering, not that Google has demonstrated a perceptible browsing advantage. The published test also offers no measured comparison with each reader’s ISP resolver. There is no evidence here that everyone needs to replace their existing DNS service.

Cloudflare’s privacy advantage needs the full logging comparison​

Cloudflare’s strongest argument is its published handling of source IP addresses and resolver logs. The distinction is more substantial—and more complicated—than “Google keeps data for 48 hours, while Cloudflare deletes it after a day.”

Google’s Public DNS privacy policy separates temporary logs from permanent logs. Temporary logs contain the requesting device’s IP address alongside query information. Google says these records are subject to deletion processes within 24–48 hours and are used for security, abuse mitigation, maintaining and improving the service, and producing aggregate usage summaries.

There is a defined exception: Google may retain temporary information beyond 48 hours to address security or abuse issues. Its policy also says it does not associate Public DNS personal information with information from other Google services except for addressing security and abuse. Consequently, an absolute claim that there is never any cross-service association would overstate the commitment.

Google’s permanent logs are sampled from the temporary records, with the client IP removed and replaced by city- or region-level location. They retain operational information such as the requested domain, request type, timestamp, response code, processing time, and transport protocol. Google says it does not use personal information collected through Public DNS to target advertising.

Cloudflare’s public-resolver policy takes a different approach. It says ordinary DNS queries’ source IP addresses are not retained in non-volatile storage—storage that persists beyond working memory—with an exception for randomly sampled network packets representing at most 0.05% of traffic sent to its network infrastructure. Those samples are used for troubleshooting and denial-of-service mitigation.

Cloudflare also describes truncating source addresses by removing the last octet of an IPv4 address or the last 80 bits of an IPv6 address. It commits to deleting truncated addresses and its limited public-resolver transaction and debugging logs within 25 hours.

The longer-lived Cloudflare information deserves attention because it corrects an overly simple reading of the retention promise. Its policy allows indefinite storage of aggregated data, including requested-domain statistics, regional request counts, and performance measurements. Cloudflare also gives APNIC limited access to anonymized resolver data for DNS research, without access to the associated client IP address.

Cloudflare therefore has a defensible advantage for users who prioritize limiting the persistence of source-address information. Neither provider promises that every piece of information derived from DNS activity disappears after 48 hours. The meaningful comparison is what remains, how closely it can be associated with the requester, and the purposes allowed by each published policy.

These are provider commitments, not measurements performed by WindowsForum. They support choosing Cloudflare on data-minimization grounds without implying that Google is using Public DNS as an advertising profile or that Cloudflare provides complete anonymity.

Cloudflare’s filtered addresses offer a concrete feature difference​

The clearest functional advantage belongs to Cloudflare’s optional filtering profiles. Standard 1.1.1.1 provides ordinary resolution without malware or adult-content filtering. To obtain those features, users must deliberately choose the appropriate 1.1.1.1 for Families addresses.

Cloudflare documents two filtered options: one blocks domains associated with malware and phishing; the other adds adult-content blocking. Its setup documentation states that Families uses the same privacy commitments as the standard resolver.

For the two Families profiles, Cloudflare also publishes IPv6 pairs. Malware blocking uses 2606:4700:4700::1112 and 2606:4700:4700::1002. Malware and adult-content blocking uses 2606:4700:4700::1113 and 2606:4700:4700::1003. These are the corresponding addresses for the same policies, not extra filtering tiers.

The mechanism is straightforward. Cloudflare says that when a queried domain is classified as malicious, its filtered resolver returns 0.0.0.0 instead of the actual address. The device consequently does not receive the destination address it requested. This makes the protection useful at the domain-resolution stage, before the normal connection to that destination.

That also defines its reach. A decision about a domain cannot provide a separate judgment about every page, file, or item of content hosted under that domain. The evidence supports treating Families as an additional domain-blocking layer, not replacing endpoint protection or a managed security system with it.

Cloudflare supplies dedicated test domains so users can verify filtering without seeking out actual malicious or adult sites. malware.testcategory.com tests malware blocking; nudity.testcategory.com tests adult-content blocking. After configuring the relevant profile, the expected outcome is that the applicable test destination is blocked. Cloudflare also acknowledges that domains can be miscategorized, a practical trade-off whenever a provider decides which names should resolve.

Google’s FAQ says Public DNS generally does not perform blocking or filtering, while reserving rare exceptions for security threats or legal requirements. Describing it as providing absolutely no blocking under any circumstances would therefore be inaccurate. The useful distinction is that Google does not offer the equivalent selectable public malware and adult-content profiles documented for Cloudflare Families.

Shah also highlights Cloudflare’s app as a convenience for switching its service on and off. That can matter to someone who dislikes changing network settings, but the comparison supplies no app-version-specific evaluation or Windows feature breakdown. The stronger, directly documented advantage is the availability of different resolver policies.

Encrypted DNS and mixed resolvers can change the outcome​

Both providers support encrypted DNS. Google documents DNS over HTTPS, or DoH, while Cloudflare’s setup documentation explains both DoH and DNS over TLS, or DoT. These protocols protect DNS requests traveling between a compatible client and the selected resolver.

Encryption and provider logging answer different privacy questions. Encrypted transport protects the request on its journey; the resolver must still process that request to answer it. A shorter logging policy does not substitute for transport encryption, and encrypted transport does not erase the provider’s retention policy.

Cloudflare’s filtered services can also use encrypted DNS. For DoT-compatible clients or routers, it documents security.cloudflare-dns.com for malware blocking and family.cloudflare-dns.com for malware plus adult-content blocking. Those hostnames belong to their respective profiles; choosing the standard service would not carry the filtering policy along automatically.

For Windows readers, this means the resolver address, filtering profile, and transport method should be considered separately. The presence of DoH support at a provider does not establish that a particular Windows configuration is using it. Likewise, these service capabilities do not imply identical configuration controls across Windows 10, Windows 11, browsers, routers, and third-party clients.

There is another important correction to the idea that users must pick one company as their sole resolver. Google explicitly permits configuring its service alongside another resolver. Its FAQ warns, however, that operating systems handle multiple DNS servers differently: some prefer one and use another when it fails to respond, while others distribute requests.

Mixing resolver policies can undermine the protection you intended to choose. Google’s guidance states that where configured resolvers differ in security or filtering, users get the weakest level among them. A configuration containing Cloudflare’s adult-content filter and an unfiltered Google resolver should not be treated as guaranteed adult-content protection with a harmless backup.

The practical recommendation follows directly: if filtering is the goal, use the matching pair for that filtering profile. If ordinary unfiltered resolution is the goal, combining providers is possible, but “primary” and “secondary” should not be interpreted as a universal promise about which company receives every request. The client’s resolver behavior matters.

Windows users should choose a DNS policy before changing settings​

For an unmanaged home PC, choose the desired privacy and filtering policy first, then assess whether the service works well on the actual connection. A 0.3-millisecond result from someone else’s benchmark is a weak reason to disturb a configuration that already meets your needs.

For a work computer, the first decision is whether a public resolver belongs in the configuration at all. Google’s own FAQ warns that offices may use private domains that are inaccessible from outside the organization and that Public DNS can limit access to them. Its advice is to check the IT department’s policy before changing an office computer’s DNS.

That warning establishes a clear boundary around the home-user recommendation. Successful access to public websites would not demonstrate that all required workplace names still resolve. Cloudflare’s privacy policy and Google’s benchmark performance cannot compensate for selecting a resolver that lacks access to the organization’s private naming information.

The most useful takeaways are therefore about keeping the chosen policy intact:

• Treat Google’s reported 0.3-millisecond advantage as a result from Shah’s test environment, and compare services on your own connection if performance is the deciding factor.
• Prefer Cloudflare if its more restrictive source-IP retention commitments match your priorities, while recognizing its allowance for longer-lived aggregated information.
• Select 1.1.1.2 with 1.0.0.2 for malware filtering, or 1.1.1.3 with 1.0.0.3 for malware and adult-content filtering; standard 1.1.1.1 does not provide those protections.
• Verify the selected Families profile with Cloudflare’s designated test domains, and use matching filtering policies across configured resolver addresses.
• Treat encrypted DNS as a separate configuration choice, and leave managed workplace DNS unchanged unless the organization authorizes an alternative.

The comparison supports a modest, useful conclusion: Cloudflare offers more selectable home-user controls and a stronger source-address minimization commitment, while Google’s tiny speed advantage in one test provides little reason to favor it by default. Choose the service whose documented policy fits the network, verify that the intended filtering or encryption is actually in use, and let performance on that connection—not a universal leaderboard—settle any remaining tie.