ICANN DNS Provider	Server Locations	Privacy Policy	Type	Logging	Protocols	DNSSEC	QNAME Minimization	Filtering	Source Code
AdGuard	Anycast (based in Cyprus )		Commercial	No	DoH, DoT, DNSCrypt	Yes	Yes	Ads, trackers, malicious domains
BlahDNS	Switzerland , Japan , Germany		Hobby Project	No	DoH, DoT, DNSCrypt	Yes	Yes	Ads, trackers, malicious domains
Cloudflare	Anycast (based in US )		Commercial	Some	DoH, DoT, DNSCrypt	Yes	Yes	No
CZ.NIC	Czech Republic		Association	No	DoH, DoT	Yes	Yes	?	?
dnswarden	Germany		Hobby Project	No	DoH, DoT, DNSCrypt	Yes	Yes	Based on server choice	?
Foundation for Applied Privacy	Austria		Non-Profit	Some	DoH, DoT	Yes	Yes	No	?
nextdns	Anycast (based in US )		Commercial	Based on user choice	DoH, DoT, DNSCrypt	Yes	Yes	Based on user choice	?
PowerDNS	The Netherlands		Hobby Project	No	DoH	Yes	No	No
Quad9	Anycast (based in US )		Non-Profit	Some	DoH, DoT, DNSCrypt	Yes	Yes	Malicious domains	?
SecureDNS	The Netherlands		Hobby Project	No	DoH, DoT, DNSCrypt	Yes	Yes	Based on server choice	?
UncensoredDNS	Anycast (based in Denmark )		Hobby Project	No	DoT	Yes	No	No	?

Terms

• DNS-over-TLS (DoT) - A security protocol for encrypted DNS on a dedicated port 853. Some providers support port 443 which generally works everywhere while port 853 is often blocked by restrictive firewalls.
• DNS-over-HTTPS (DoH) - Similar to DoT, but uses HTTPS instead, being indistinguishable from "normal" HTTPS traffic on port 443.
• DNSCrypt - An older yet robust method of encrypting DNS.

How to verify DNS is encrypted

• DoH / DoT
  • Check DNSLeakTest.com.
  • Check the website of your DNS provider. They may have a page for telling "you are using our DNS." Examples include AdGuard and Cloudflare.
  • If using Firefox's trusted recursive resolver (TRR), navigate to about:networking#dns. If the TRR column says "true" for some fields, you are using DoH.
• dnscrypt-proxy - Check dnscrypt-proxy's wiki on how to verify that your DNS is encrypted.
• DNSSEC - Check DNSSEC Resolver Test by Matthäus Wander.
• QNAME Minimization - Run dig +short txt qnamemintest.internet.nl from the command-line (taken from this NLnet Labs presentation). You should see this display: "HOORAY - QNAME minimisation is enabled on your resolver :)!"

Worth Mentioning and Additional Information

• Encrypted DNS clients for desktop:
  • Firefox comes with built-in DoH support with Cloudflare set as the default resolver, but can be configured to use any DoH resolver. Currently Mozilla is conducting studies before enabling DoH by default for all US-based Firefox users.
• Encrypted DNS clients for mobile:
  • Android 9 comes with a DoT client by default.
  • DNSCloak - An open-source DNSCrypt and DoH client for iOS by the Center for the Cultivation of Technology gemeinnuetzige GmbH.
  • Nebulo - An open-source application for Android supporting DoH and DoT. It also supports caching DNS responses and locally logging DNS queries.
• Local DNS servers:
  • Namecoin - A decentralized DNS open-source information registration and transfer system based on the Bitcoin cryptocurrency.
  • Stubby - An open-source application for Linux, macOS, and Windows that acts as a local DNS Privacy stub resolver using DoT.
• Network wide DNS servers:
  • Pi-hole - A network-wide DNS server mainly for the Raspberry Pi. Blocks ads, tracking, and malicious domains for all devices on your network.
  • NoTrack - A network-wide DNS server like Pi-hole for blocking ads, tracking, and malicious domains.
• Further reading:
  • QNAME Minimization and Your Privacy by the Internet Systems Consortium (ISC)
  • DNSSEC and BIND 9 by the ISC