208.67.220.220: OpenDNS secondary

208.67.220.220 is the secondary resolver address for OpenDNS, now part of Cisco Umbrella. It applies the same account policies and phishing protection as 208.67.222.222 and is announced from a separate /24, so the pair survives a routing problem with either prefix.

The pair and the pattern

OpenDNS chose two /24s inside 208.67.216.0/21, a block registered to OpenDNS and now held under Cisco. Both addresses use repeated digits so they can be dictated over the phone, a design decision from 2006 when the alternative was memorising an ISP resolver nobody advertised.

Cisco announces the prefixes from AS36692 and anycasts them from its Umbrella data centres. A whois lookup on either address returns Cisco OpenDNS as the organisation.

Why filtering follows the network, not the address

OpenDNS applies policy by looking at the public IP a query arrives from and matching it against a network registered in the dashboard. That mechanism has two consequences worth planning for.

First, both resolver addresses behave identically for you, because they consult the same account. There is no “filtered” and “unfiltered” member of the pair.

Second, home connections with a changing public IP need a dynamic DNS updater, or the dashboard loses track of the network and the resolver silently falls back to unfiltered answers. Most consumer routers can run that updater in their DDNS section.

When you see it

The address shows up in the alternate DNS field on router setup pages, in the second nameserver entry in /etc/resolv.conf, and in printed IT handbooks from the era when OpenDNS was the default third-party recommendation. School and library networks that adopted OpenDNS filtering in the 2010s still carry the pair in their DHCP scopes.

How to configure it

• Windows: alternate DNS server field, with 208.67.222.222 as preferred.
• macOS: System Settings, Network, Details, DNS, second entry.
• Linux: nameserver 208.67.220.220 as the second line, or in resolved.conf.
• IPv6: 2620:119:53::53 pairs with 2620:119:35::35.
• FamilyShield instead: swap in 208.67.220.123 and 208.67.222.123 for adult content blocking without an account.

Privacy and policy

Use of either address falls under the Cisco privacy statement and the OpenDNS service terms. Cisco collects query data including source IP addresses from the free service and uses it for security research and threat intelligence feeds that support its commercial products. That is the trade the free tier makes explicit, and it is a different bargain from resolvers that commit to discarding client addresses.

Court-ordered blocking has also affected availability. Cisco stopped resolving for users in France and Portugal in 2024 rather than implement site blocking there, so both OpenDNS addresses can be unreachable depending on where you are.

What it is not

208.67.220.220 is not a backup that bypasses your policy, and it is not a separate product. It is also not required: OpenDNS works with a single address configured, though listing only one removes the redundancy the pair exists for. If neither address answers, test a resolver from another operator such as 9.9.9.9 before assuming your connection is down.

Compare answers between providers in /dns-lookup.