If taking safest in the most literal sense, and you trust PCH/IBM, then Quad9 is a pretty good choice for most people. Unlike normal DNS, Quad9 purposely does

If taking safest in the most literal sense, and you trust PCH/IBM, then Quad9 is a pretty good choice for most people. Unlike normal DNS, Quad9 purposely does not resolve threatening results. If you view "safest" more to mean "prevents the spread of malware, keeping everyone safer" than "gives me absolute privacy I can audit" then it's hard to beat. They do log data at the city/metropolitan level for threat analysis. It's one of the few services that supports DoH, and Chrome already automatically upgrades requests when it detects you using Quad9. https://www.quad9.net/policy/ https://www.quad9.net/policy/