Unknown DNS Resolver Found in Benchmark

If your DNS benchmark shows a resolver you don’t recognize, it is almost certainly one of two things: a server operated by your internet service provider (ISP) that uses a different name than you expected, or a third-party resolver your router, device, or browser is configured to use without your explicit knowledge. This article explains how to identify it, why it appeared, and what to do about it.

What a DNS Resolver Is

A DNS (Domain Name System) resolver is a server that translates human-readable domain names like example.com into numeric IP addresses that computers use to connect to each other. When you type a website address, your device sends a query to a resolver, which then looks up the answer from authoritative name servers and returns it to you. This happens in milliseconds, and you rarely notice it—until a benchmark tool shows you a list of servers you never configured.

Most people use the resolver assigned by their ISP automatically via DHCP. But many devices and apps can override that setting. For instance, your router may have a hardcoded fallback, your operating system might use a “smart” DNS feature, or a VPN or security app could route queries through its own resolver. Any of these can appear in a benchmark even if you never manually entered an IP address.

Why an Unknown Resolver Appears

There are several common reasons a benchmark will show a resolver you don’t recognize:

ISP infrastructure: Large ISPs often run multiple resolver farms with different names. What you see may be a regional or backup server that handles your traffic when the primary one is busy.
Router default settings: Many home routers come with a preset DNS that isn’t your ISP’s—for example, a generic upstream resolver from the router manufacturer or a public DNS like 8.8.8.8.
VPN or proxy software: If you have a VPN active, its DNS servers will be used to prevent leaks. The benchmark will show those instead of your normal ones.
Browser-specific DNS: Some browsers (like Chrome or Firefox) can use their own DNS-over-HTTPS (DoH) settings, bypassing the system resolver entirely.
Parental controls or security suites: Services that filter content or block malicious sites often route DNS through their own servers.

To find out which one applies to you, check your network settings on the device you ran the benchmark on. Look at the DNS server addresses listed there, and compare them with what the benchmark reported. If they match, then the resolver is simply the one your device is using—even if you didn’t set it.

How to Identify the Resolver

Once you have the IP address or hostname from the benchmark, you can look it up:

Use a WHOIS lookup service (like whois.icann.org or any online tool) to see which organization owns the IP address.
If the owner is your ISP, it’s likely a legitimate resolver they operate.
If the owner is a company you don’t recognize, search for the domain name or IP online to see if it’s associated with a known public DNS provider or a software product you use.
Check your router’s admin page (usually at 192.168.1.1 or 192.168.0.1) to see what DNS servers are configured in the WAN or DHCP settings.
On Windows, run ipconfig /all; on macOS, run scutil --dns; on Linux, check /etc/resolv.conf.

If you still can’t identify it, that’s a red flag—but not necessarily a security issue. Some routers use “DNS rebinding protection” or “DNS proxy” features that appear as a local IP (like 192.168.1.1) in the benchmark. That’s your router itself acting as a resolver, forwarding queries upstream.

Common Problems with Unknown Resolvers

The main concerns with an unexpected resolver are privacy, speed, and reliability. A resolver you don’t control could log your browsing history, serve you different results, or go down without notice. However, most unknown resolvers are benign—just a configuration you forgot about.

One real problem is that some ISPs transparently redirect DNS traffic to their own servers, even if you set a different resolver on your device. This is called “DNS hijacking” and can make the benchmark show the ISP’s server instead of the one you chose. In that case, you’d need to enable DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) to encrypt your queries and prevent interception.

Another issue is that public resolvers (like Google, Cloudflare, or Quad9) may be faster or slower depending on your location. A benchmark that shows an unknown server might actually be showing you a better option than your default—so test it before changing anything.

How to Choose a DNS Resolver

If you decide to switch to a known resolver, here are the most popular options (as of 2025):

Google Public DNS: 8.8.8.8 and 8.8.4.4
Cloudflare: 1.1.1.1 and 1.0.0.1
Quad9: 9.9.9.9 (blocks malicious domains)
OpenDNS: 208.67.222.222 and 208.67.220.220 (offers filtering options)

To change your resolver, you can either edit the settings in your router (affects all devices) or change it per-device. On Windows, go to Network Settings → Change adapter options → IPv4 properties. On macOS, go to System Settings → Network → DNS. On a smartphone, look in Wi-Fi settings for “Configure DNS.”

After changing, rerun the benchmark to confirm the new resolver appears. If it doesn’t, your ISP might be intercepting DNS traffic—in that case, enable DoH/DoT in your browser or operating system.

Security and Privacy Considerations

Using a resolver you don’t recognize can expose you to DNS spoofing or surveillance. However, the risk is low for most home users. To protect yourself, use a resolver that supports DNSSEC (which validates responses) and offers encrypted transport (DoH/DoT).

If you’re worried about privacy, avoid using your ISP’s resolver because they can log your browsing history. Public resolvers like Cloudflare and Quad9 have strict no-logging policies, but they still see your queries unless you use encryption. For maximum privacy, you could run your own resolver (like Pi-hole) on a local device, but that requires technical expertise.

Remember that DNS is only one part of your online footprint. Even with a private resolver, websites you visit can see your IP address and collect data via cookies and other tracking methods.

Frequently Asked Questions

Is an unknown DNS resolver a sign of malware?

Not necessarily. It’s more common to see a legitimate resolver from your ISP or a software you installed. However, malware can change DNS settings to redirect you to phishing sites. If you see a resolver you didn’t configure and also notice pop-ups or slow browsing, run a security scan.

Why does my benchmark show my router’s IP as a DNS server?

Many routers act as DNS proxies. They receive queries from your devices and forward them to upstream servers. This is normal and often used for caching or parental controls. The benchmark sees the router’s IP because that’s where your device sends queries.

Can I trust a resolver that appears with a generic name like “dns1” or “ns2”?

Generic names are common for ISP infrastructure. Check the WHOIS record for the IP address. If it belongs to your ISP, it’s safe. If it belongs to an unknown company, investigate further before assuming it’s malicious.

How do I stop my ISP from overriding my DNS choice?

Use DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT). These protocols encrypt your DNS queries, making it harder for ISPs to intercept or redirect them. Most modern browsers and operating systems support DoH in settings.

What is the fastest DNS resolver?

Speed varies by location and network conditions. Use a benchmark tool (like the one you already ran) to compare latency and response times for several resolvers. The fastest one for you might be different from someone else’s.

Should I use my ISP’s DNS or a public resolver?

It depends on your priorities. ISP DNS often works well and may offer local caching for faster access to popular sites. Public resolvers like Cloudflare or Quad9 may provide better privacy and additional security features. Test both and see which gives you better performance.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →