8.8.4.4: Google Public DNS secondary

8.8.4.4 is the secondary IPv4 address of Google Public DNS. It runs the same anycast recursive resolver as 8.8.8.8, but Google announces it from a different prefix so a routing fault on one block does not take the whole service offline. Configure it as the alternate DNS server, not as a replacement.

The point of a second address

A resolver pair is a routing hedge. 8.8.8.8 lives in 8.8.8.0/24 and 8.8.4.4 lives in 8.8.4.0/24, and Google announces both from AS15169. If one prefix gets withdrawn, hijacked, or blackholed by an intermediate network, clients that hold both addresses keep resolving through the other.

That has happened. In 2018 a BGP leak by an operator in Nigeria pulled Google traffic through China Telecom for over an hour, and route hijacks aimed at popular resolver prefixes have been documented several times since. Holding two prefixes limits the blast radius rather than removing the risk.

Where you meet the address

You see 8.8.4.4 mostly in configuration, not in traffic. It shows up as the second line under “DNS servers” in ipconfig /all, as the alternate field on a router’s DHCP page, and in installation guides that tell you to paste both Google addresses. Because most resolver libraries only query the second server after the first one times out, packet captures on a healthy network show almost nothing going to it.

Support scripts use it as a control. If nslookup example.com 8.8.8.8 fails and nslookup example.com 8.8.4.4 succeeds, the problem is a path or a filter, not DNS itself.

Setting it up

• Windows: put 8.8.8.8 in Preferred DNS and 8.8.4.4 in Alternate DNS under the adapter’s IPv4 properties.
• macOS: System Settings, Network, Details, DNS, add both addresses in that order.
• Linux: nameserver 8.8.8.8 and nameserver 8.8.4.4 on separate lines in /etc/resolv.conf, or the DNS= line in resolved.conf.
• Router: enter both in the LAN DHCP DNS fields so clients inherit the pair.
• IPv6 equivalents: 2001:4860:4860::8888 and 2001:4860:4860::8844.

Privacy and policy

The service behind 8.8.4.4 is governed by the same Google Public DNS privacy notice as the primary address. Temporary logs hold the full client IP for 24 to 48 hours, permanent logs discard it, and Google states the data is not used for ad targeting. Both addresses support DNSSEC validation and EDNS Client Subnet, so both forward a truncated version of your network prefix to authoritative servers that request it.

Encrypted transports do not use the raw addresses. DNS over TLS and DNS over HTTPS both point at the hostname dns.google, which resolves to all four Google Public DNS addresses.

What it is not

8.8.4.4 is not a backup copy of a cache held at 8.8.8.8, and it is not a different tier of service. There is no “fast” address and no “family” address in this pair. Google runs its filtering-free resolver on all four addresses and offers no blocklist variant. If you want a second opinion during troubleshooting, query a resolver from a different operator such as 1.1.1.1 or 9.9.9.9, because two Google addresses share the same cache logic and the same view of the internet.

Run a name through /dns-lookup to see the record and its TTL, or check reachability with /ping-test.