Google Public DNS is a

Domain Name System The Domain Name System (DNS) is a hierarchical and distributed naming system for computers, services, and other resources in the Internet or other Internet Protocol (IP) networks. It associates various information with domain names assigned to ...

(DNS) service offered to

Internet The Internet (or internet) is the global system of interconnected computer networks that uses the Internet protocol suite (TCP/IP) to communicate between networks and devices. It is a '' network of networks'' that consists of private, pub ...

users worldwide by

Google Google LLC () is an American multinational technology company focusing on search engine technology, online advertising, cloud computing, computer software, quantum computing, e-commerce, artificial intelligence, and consumer electronics. ...

. It functions as a recursive name server. Google Public DNS was announced on December 3, 2009, in an effort described as "making the web faster and more secure." As of 2018, it is the largest public DNS service in the world, handling over a trillion queries per day. Google Public DNS is not related to Google Cloud DNS, which is a

DNS hosting service A DNS hosting service is a service that runs Domain Name System (DNS) servers. Most, but not all, domain name registrars include DNS hosting service with registration. Free DNS hosting services also exist. Many third-party DNS hosting services ...

Service

The Google Public DNS service operates recursive name servers for public use at the following four IP addresses. The addresses are mapped to the nearest operational server by

anycast Anycast is a network addressing and routing methodology in which a single destination IP address is shared by devices (generally servers) in multiple locations. Routers direct packets addressed to this destination to the location nearest the se ...

routing Routing is the process of selecting a path for traffic in a network or between or across multiple networks. Broadly, routing is performed in many types of networks, including circuit-switched networks, such as the public switched telephone netw ...

. The service does not use conventional DNS

name server A name server refers to the server component of the Domain Name System (DNS), one of the two principal namespaces of the Internet. The most important function of DNS servers is the translation (resolution) of human-memorable domain names (example. ...

software, such as

BIND BIND () is a suite of software for interacting with the Domain Name System (DNS). Its most prominent component, named (pronounced ''name-dee'': , short for ''name daemon''), performs both of the main DNS server roles, acting as an authoritative n ...

, instead relying on a custom-designed implementation, conforming to the DNS standards set forth by the

IETF The Internet Engineering Task Force (IETF) is a standards organization for the Internet and is responsible for the technical standards that make up the Internet protocol suite (TCP/IP). It has no formal membership roster or requirements and a ...

. It fully supports the

DNSSEC The Domain Name System Security Extensions (DNSSEC) are a suite of extension specifications by the Internet Engineering Task Force (IETF) for securing data exchanged in the Domain Name System (DNS) in Internet Protocol (IP) networks. The protocol ...

protocol since 19 March 2013. Previously, Google Public DNS accepted and forwarded DNSSEC-formatted messages but did not perform validation. Some DNS providers practice DNS hijacking while processing queries, redirecting web browsers to an advertisement site operated by the provider when a nonexistent domain name is queried. The Google service correctly replies with a non-existent domain (NXDOMAIN) response. The Google service also addresses DNS security. A common attack vector is to interfere with a DNS service to achieve redirection of web pages from legitimate to malicious servers. Google documents efforts to be resistant to DNS cache poisoning, including “Kaminsky Flaw” attacks as well as denial-of-service attacks.

DNS64

The Google Public DNS64 service operates recursive name servers for public use at the following two IP addresses for use with

NAT64 NAT64 is an IPv6 transition mechanism that facilitates communication between IPv6 and IPv4 hosts by using a form of network address translation (NAT). The NAT64 gateway is a translator between IPv4 and IPv6 protocols, for which function it need ...

. These servers are compatible with DNS over HTTPS.

Privacy

Google stated that for the purposes of performance and security, the querying

IP address An Internet Protocol address (IP address) is a numerical label such as that is connected to a computer network that uses the Internet Protocol for communication.. Updated by . An IP address serves two main functions: network interface ident ...

will be deleted after 24–48 hours, but

Internet service provider An Internet service provider (ISP) is an organization that provides services for accessing, using, or participating in the Internet. ISPs can be organized in various forms, such as commercial, community-owned, non-profit, or otherwise private ...

(ISP) and location information are stored permanently on their servers.

History

In December 2009, Google Public DNS was launched with its announcement on the Official Google Blog by product manager Prem Ramaswami, with an additional post on the

Google Code Google Developers (previously Google Code) , application programming interfaces (APIs), and technical resources. The site contains documentation on using Google developer tools and APIs—including discussion groups and blogs for developers usin ...

blog. In January 2019, Google Public DNS adopted the

DNS over TLS DNS over TLS (DoT) is a network security protocol for encrypting and wrapping Domain Name System (DNS) queries and answers via the Transport Layer Security (TLS) protocol. The goal of the method is to increase user privacy and security by prevent ...

protocol.

DNSSEC

At the launch of Google Public DNS, it did not directly support

. Although RRSIG records could be queried, the AD (Authenticated Data) flag was not set in the launch version, meaning the server was unable to validate signatures for all of the data. This was upgraded on 28 January 2013, when Google's DNS servers silently started providing DNSSEC validation information, but only if the client explicitly set the DNSSEC OK (DO) flag on its query. This service requiring a client-side flag was replaced on 6 May 2013 with full DNSSEC validation by default, meaning all queries will be validated unless clients explicitly opt-out.

Client subnet

Since June 2014, Google Public DNS automatically detects nameservers that support

EDNS Client Subnet EDNS Client Subnet (ECS) is an option in the Extension Mechanisms for DNS that allows a recursive DNS resolver to specify the subnetwork for the host or client on whose behalf it is making a DNS query. This is generally intended to help speed up th ...

(ECS) options as defined in the IETF draft (by probing name servers at a low rate with ECS queries and caching the ECS capability), and will send queries with ECS options to such

name servers A name server refers to the server component of the Domain Name System (DNS), one of the two principal namespaces of the Internet. The most important function of DNS servers is the translation (resolution) of human-memorable domain names (example. ...

automatically.Public-DNS-announce mailing list: Google Public DNS now auto-detects nameservers that support edns-client-subnet
/ref>

Censorship in Turkey

In March 2014, use of Google Public DNS was blocked in

Turkey Turkey ( tr, Türkiye ), officially the Republic of Türkiye ( tr, Türkiye Cumhuriyeti, links=no ), is a list of transcontinental countries, transcontinental country located mainly on the Anatolia, Anatolian Peninsula in Western Asia, with ...

after it was used to circumvent the blocking of

Twitter Twitter is an online social media and social networking service owned and operated by American company Twitter, Inc., on which users post and interact with 280-character-long messages known as "tweets". Registered users can post, like, and ...

, which took effect on 20 March 2014 under court order. The block was the result of earlier remarks by Prime Minister

Tayyip Erdogan Tayyip () is a Turkish given name for males. Tayyip may refer to: * Recep Tayyip Erdoğan (born 1954), Turkish politician, and Prime Minister of the Republic of Turkey from 2003 to 2014, and current President of Turkey since 2014 *Tayyip Talha Sa ...

who vowed to "wipe out Twitter" following damaging allegations of corruption in his inner circle. The method became popular after it was determined that a simple domain name block was used to enforce the ban, which would easily be bypassed by using an alternate DNS resolver. Activists distributed information on how to use the service, and spray-painted the IP addresses used by the service as

graffiti Graffiti (plural; singular ''graffiti'' or ''graffito'', the latter rarely used except in archeology) is art that is written, painted or drawn on a wall or other surface, usually without permission and within public view. Graffiti ranges from s ...

on buildings. Following the discovery of this method, Google Public DNS was blocked entirely."Twitter website 'blocked' in Turkey"
''BBC News'', 20 March 2014. Retrieved 23 March 2014.
''PCWorld'', 21 March 2014. Retrieved 22 March 2014

References

External links

Official developers blog

Google Public DNS
{{DEFAULTSORT:Google Public Dns Public DNS Alternative Internet DNS services Internet properties established in 2009