Key Takeaway:
8.8.8.8 is Google Public DNS, a free service that turns website names into IP addresses for anyone who asks. It has run since December 2009, its second address is 8.8.4.4, and it’s one of the most widely used DNS resolvers in the world. It’s safe to use, and it doesn’t block or redirect websites, but Google does see the sites you look up: it keeps your full IP address with each lookup for 24 to 48 hours, then keeps a sample without it. If 8.8.8.8 turns up in your router, your logs or a ping command, this is what it is and what it means.
You might have seen 8.8.8.8 in your router’s settings, in a firewall log, in a troubleshooting guide that tells you to “ping 8.8.8.8”, or in a lookup that says it belongs to Google and sits in Virginia. It’s the same address in every case, and the explanation is simpler than most of those places make it look.
What 8.8.8.8 Is
Every time you open a website, your device has to find out the IP address behind its name. It asks a DNS resolver, a server whose job is to look names up and pass back the answer. By default, that’s usually a resolver run by your internet provider. 8.8.8.8 is Google’s alternative, and anyone can use it free, with no account. Google launched it on 3 December 2009 as Google Public DNS. If DNS itself is new to you, start with what DNS is and how it works.
The service has four plain addresses and two encrypted ways in:
| What | Address |
|---|---|
| IPv4, primary | 8.8.8.8 |
| IPv4, secondary | 8.8.4.4 |
| IPv6 | 2001:4860:4860::8888 and 2001:4860:4860::8844 |
| DNS over HTTPS | https://dns.google/dns-query |
| DNS over TLS (Android “Private DNS”) | dns.google |
8.8.8.8 isn’t one computer. It’s an anycast address: Google announces the same number from locations all over the world, and the internet’s routing sends your lookup to the nearest one. Someone in Bucharest and someone in Chicago both type 8.8.8.8, and each reaches a different building.
🔍 What a Lookup of 8.8.8.8 Shows
Look 8.8.8.8 up in any IP tool and you get a consistent picture of who owns it, with an inconsistent location:
- Owner: Google LLC, on the network AS15169. Our ASN lookup and WHOIS lookup both show the registration.
- Name: a reverse DNS lookup of 8.8.8.8 returns
dns.google. - Location: usually somewhere in the United States, depending on the database; our own lookup files it under Ashburn, Virginia. Because the address is anycast, that’s just where the database files the whole range. The server that actually answers you is usually much closer to you. More on why at how IP geolocation works.
- Connection type: our Bulk IP Lookup labels it “Data centre”, with a “Proxy-listed” tag beside it. The range appears on lists of proxy addresses even though it’s a DNS service, which is why the tag sits next to the label instead of replacing it.
Why 8.8.8.8 Turns Up Everywhere
In your router or device settings. Someone, perhaps you or whoever set up the network, chose Google’s DNS instead of your provider’s. It’s one of the most common changes people make, usually after their provider’s DNS was slow or unreliable. If you didn’t set it and don’t know who did, it’s worth knowing that a router whose DNS was quietly changed is a known attack. 8.8.8.8 itself is harmless, but if you find addresses you don’t recognise, check them with our lesson Has Your Router’s DNS Been Changed?
In a ping command. “Ping 8.8.8.8” is a classic connection test because the address is easy to remember and almost always reachable. Pinging it checks whether you can reach the internet at all. Pinging a name such as google.com checks that and DNS. If the first works and the second fails, your connection is fine and DNS is the problem. Our guide to fixing “DNS server not responding” starts with exactly this test.
In firewall or network logs. Lots of connections to 8.8.8.8 on port 53 (plain DNS), 853 (DNS over TLS) or 443 (DNS over HTTPS) just mean that a device on your network uses Google’s DNS. Some apps and smart devices are set to use a public resolver directly, whatever your router hands out. It isn’t someone attacking you: 8.8.8.8 only answers questions, and only when it’s asked.
If you run a website or a name server. When Google’s resolver looks up your domain, the queries reach your name servers from other Google address ranges, not from 8.8.8.8 itself. Google publishes that list of ranges, labelled by the nearest airport, for exactly this reason.
Is 8.8.8.8 Safe? What Google Logs
It’s safe in the sense that matters most: it gives you the real answers. Google says its resolver doesn’t block or filter anything, except for a small number of domains in rare cases where it believes that’s needed to protect users from security threats, or where it’s legally required to. It also checks DNSSEC, the digital signatures that prove an answer hasn’t been forged, and has done since January 2013.
Privacy is where the trade-off lies. A DNS resolver sees every site name you look up, so using 8.8.8.8 moves that record from your provider to Google. Google’s privacy page for the service says:
- Temporary logs hold your full IP address alongside each lookup and are deleted within 24 to 48 hours. Google may keep some of that information longer, but only to deal with security and abuse problems.
- Permanent logs are a sample of those lookups with your IP address removed and replaced by a city- or region-level location.
- Google says it doesn’t use the service’s data to target ads, and doesn’t link it to your use of other Google services, except to deal with security and abuse.
Two more points are easy to miss. First, a plain lookup to 8.8.8.8 isn’t encrypted, so your provider can still read the names on the way, even though it no longer answers them. To stop that, use the encrypted options in the table above; our guide to DNS over HTTPS shows how. Second, for some sites, the ones whose name servers support a feature called EDNS Client Subnet, Google passes on a shortened form of your network address, not your full IP, so a content network can pick a server near you.
8.8.8.8 vs 1.1.1.1 vs 9.9.9.9
The three best-known public resolvers do the same job with different priorities. These are the differences in their own published policies:
| Resolver | Run by | What it keeps | Blocks |
|---|---|---|---|
| 8.8.8.8, 8.8.4.4 | Full IP for 24–48 hours, then a sample with city-level location | Nothing, apart from rare security or legal cases | |
| 1.1.1.1, 1.0.0.1 | Cloudflare | IP shortened, then deleted within 25 hours; practices audited by an outside accounting firm | Nothing on the main address |
| 9.9.9.9, 149.112.112.112 | Quad9, based in Zürich, Switzerland | Says it doesn’t collect or record users’ IP addresses at all | Known malicious domains |
Which is fastest depends on where you are and how close each one’s nearest location is, so test from your own connection rather than trusting anyone’s chart. Google makes a useful point here: a quick ping isn’t the same as quick answers, because what counts is how fast a resolver actually returns names, including ones it doesn’t already have cached. For a longer comparison that includes your provider’s DNS, see what your ISP’s DNS sees.
How to Use 8.8.8.8
You can set it in two places:
- On the router, so every device on your network uses it. This is usually under “Internet”, “WAN” or “DHCP” settings in the router’s admin page. Enter 8.8.8.8 as the primary DNS and 8.8.4.4 as the secondary.
- On one device, which overrides the router for that device only. Phones on Android 9 or later can use the encrypted option: Settings, then Network, then Private DNS, and enter
dns.google.
Step-by-step instructions for Windows, Mac, iPhone, Android and routers are in our guide to checking and changing your DNS settings. After switching, flush your DNS cache so old answers don’t linger.
How to Check It’s Really Being Used
A setting can say 8.8.8.8 while your lookups go somewhere else: a VPN, a browser with its own secure DNS, or a router that quietly redirects DNS can all override it. Two quick checks:
1. Ask 8.8.8.8 directly. This confirms it’s reachable from your network:
nslookup example.com 8.8.8.8If you get an address back, Google’s resolver answered you. If it times out while your normal DNS works, something on your network is blocking outside DNS.
2. Ask which resolver is really answering. Run nslookup whoami.akamai.net with no server named. The address that comes back belongs to whichever resolver handled your query. Put it into the ASN lookup: if it says Google (AS15169), you’re using Google’s DNS. If it names your provider or your VPN company, your setting isn’t the one being used. The free lesson What Your Provider Sees walks through this check step by step.
When Not to Use It
- On a work or school network, where internal names (the intranet, printers, file shares) are only known to the organisation’s own DNS. Switching to 8.8.8.8 breaks them.
- When your network relies on DNS filtering, such as parental controls or a provider’s security service. 8.8.8.8 doesn’t filter, so changing to it turns that protection off. If you want blocking of known malicious sites, 9.9.9.9 is designed for it.
- If you’d rather Google didn’t see your lookups at all. Pick a different resolver, and use DNS over HTTPS or TLS with it.
Also remember what changing DNS doesn’t do. It doesn’t hide your IP address from the websites you visit, and it doesn’t stop your provider seeing which servers you connect to. If you use a VPN, its DNS settings take over from yours, and whether they really do is what a DNS leak is about.
Frequently Asked Questions
Who owns the IP address 8.8.8.8?
Google. It’s registered to Google LLC on network AS15169, and its reverse DNS name is dns.google. It’s the primary address of Google Public DNS.
Why does a lookup say 8.8.8.8 is in Virginia?
Location databases file the whole range under one place in the United States. 8.8.8.8 is an anycast address, answered from many places around the world, so the server you actually reach is usually the one nearest you.
I see 8.8.8.8 in my firewall log. Am I being hacked?
No. Connections to 8.8.8.8 are a device on your network asking Google’s DNS to look up a name. 8.8.8.8 never contacts you on its own; it only replies to questions it’s sent.
What is 8.8.4.4?
The second address of the same service. Set it as the secondary DNS server so your lookups keep working if your device can’t reach 8.8.8.8.
Is 8.8.8.8 faster than my provider’s DNS?
Sometimes. It depends on where you are and how well your provider runs its own resolvers. The only way to know is to compare from your own connection, and if your speed problem isn’t DNS, changing it won’t help: see how to fix slow internet to find the real cause.
Does using 8.8.8.8 hide my browsing?
No. It changes who answers your lookups, from your provider to Google. Websites still see your IP address, and unless you use the encrypted DNS options, your provider can still read the names you look up.