Cloudflare vs Quad9, NextDNS and AdGuard for Malicious Domains

Updated 9 November 2026 · Standard formula, shown below

Cloudflare, Quad9, NextDNS, and AdGuard can all block some malicious domains through DNS, but they use different filtering policies and controls. To test them fairly, send the same known-safe test domain through each resolver and verify the response; do not visit live malware or phishing sites.

What a malicious-domain DNS test checks

DNS translates a domain name, such as example.com, into an address a device can connect to. A filtering DNS resolver checks a requested domain against threat or block lists and may refuse to return its normal address. Depending on the service and configuration, the response might be an error, a block-page address, or another non-routable result.

A test therefore checks one narrow question: does this resolver block this particular domain, at this time, under this configuration? It does not establish that the resolver catches every threat, nor that a browser, device, or network is fully protected. Lists change, threats may use new domains, and a domain can be categorized differently by different providers.

How the four services differ

Cloudflare: Offers public DNS options with different filtering policies. Its malware-blocking option is commonly identified by the IPv4 addresses 1.1.1.2 and 1.0.0.2; the standard resolver does not have the same malware-blocking policy. Check Cloudflare’s current setup instructions before configuring a device.
Quad9: Its security-focused service blocks domains associated with threats using threat-intelligence sources. The commonly documented IPv4 addresses for its primary secure service are 9.9.9.9 and 149.112.112.112. Quad9 also offers other service variants, so confirm which endpoint you selected.
NextDNS: Provides configurable filtering, including security-related blocklists. The outcome depends on the profile and lists enabled, so a default profile and a customized one may not produce the same result.
AdGuard DNS: Provides several filtering configurations. A security-focused configuration can block known malicious domains; other configurations may also filter ads or trackers. Choose the endpoint matching the intended policy.

Addresses, service names, and policies can change. Consult each provider’s official documentation when setting up or interpreting a test. Also distinguish a service’s default resolver from its security-filtering variant: entering a familiar provider’s address does not automatically mean malware blocking is active.

How to test safely and compare results

Use a purpose-built DNS filtering test domain published or recommended by the provider you are evaluating, where available. Such a domain is intended to exercise a block response without loading malware. Never use a real phishing or malware URL as a test in a browser, and do not download a suspicious file to check whether filtering works.

Choose one device and network. Record whether the test device uses a VPN, browser secure DNS, a router-level resolver, or a security app. These can route DNS requests somewhere other than the resolver you intend to test.
Set one resolver at a time. Use the provider’s documented endpoint and filtering mode. For NextDNS, note the profile; for services with multiple variants, note which variant is active.
Clear or account for caching. Your computer, router, browser, or provider may cache DNS answers. A cached result can make a changed setting appear ineffective. Restarting the relevant network connection or using the operating system’s DNS cache-flush procedure may help, but exact steps differ by system.
Query the test domain. Use the provider’s test page or a DNS lookup tool, not a browser visit to a dangerous site. Record the returned status or address and the time of the test.
Repeat under identical conditions. Change only the resolver or profile, then run the same test again. Restore your preferred settings afterward.

A blocked response shows that the selected path applied a blocking rule to that test. A normal answer can mean filtering is off, the wrong endpoint is in use, the test domain is not covered by that provider, or another DNS path bypassed the setting. It is not, by itself, proof that the service is defective.

Why results can disagree

Different results are expected. Providers draw on different threat feeds, classify domains at different times, and apply different policies. A domain may be malicious according to one source but absent from another list. Customized blocklists can make NextDNS or AdGuard results especially dependent on configuration.

DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) encrypt DNS requests between a client and resolver, but encryption alone does not decide whether a domain is blocked. A browser’s secure DNS setting may use its own resolver and bypass the operating system’s DNS choice. VPN software can also supply or redirect DNS. If a test seems inconsistent, check the active resolver at the device, browser, VPN, and router levels.

Other common sources of confusion include stale cache entries, IPv4 versus IPv6 configuration, and testing one device while changing DNS on another. A DNS test also says nothing about threats delivered from a legitimate compromised website, malicious files already on a device, or content loaded from an IP address without a domain lookup.

Choosing a resolver and understanding the limits

There is no universal winner based on a single domain test. Choose according to the control and policy you need: a straightforward security-filtering option, a configurable profile, or additional ad and tracker filtering. Compare privacy terms, available protocols, device support, reliability, and whether the configuration is easy to manage—not just a test result.

For a simple comparison, use the same safe test domain, device, and network, and record the exact endpoint.
For household or organization-wide filtering, consider whether settings can be applied consistently at the router or managed per device.
For troubleshooting, temporarily return to the provider’s documented default configuration and check whether VPN or browser DoH is overriding it.
For stronger protection, treat DNS filtering as one layer alongside updated software, cautious link handling, and endpoint security—not as a replacement.

DNS filtering can also block a legitimate domain by mistake. If a trusted site stops resolving, check the provider’s explanation or diagnostic tools and review the active policy before changing settings. Avoid disabling protections broadly just to make one site load; first confirm the domain and identify which rule caused the block.

Frequently Asked Questions

How do I test whether Cloudflare blocks malicious domains?
Configure Cloudflare’s documented malware-filtering resolver, then use a safe DNS filtering test domain or Cloudflare’s current diagnostic guidance. Confirm that the device is actually using that resolver and that browser DoH or a VPN is not overriding it.

Is Quad9 better than Cloudflare for malware blocking?
There is no dependable answer from one test. Their threat sources, filtering policies, and update timing differ. Compare the security variants with the same safe test and consider privacy, reliability, and configuration needs.

Why does NextDNS block a domain that another DNS service allows?
NextDNS may have a different threat feed or profile configuration. Check which lists and security settings are enabled and whether the other service’s malware-filtering option is active.

Can I test with a real malware or phishing URL?
No. Do not open or download from a live threat to test DNS. Use a provider-recommended test domain or diagnostic method designed to demonstrate filtering safely.

Does a blocked DNS test mean I am fully protected?
No. It confirms only that a particular DNS request was blocked under the tested conditions. It does not detect every threat or replace browser, operating-system, and endpoint protections.

Why is a blocked domain still opening in my browser?
The browser may have cached the result, be using secure DNS with another resolver, or be connecting through a VPN or proxy. Check the browser’s DNS settings and the active network path, then repeat the safe test after accounting for caches.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.