You should always enter the secondary DNS server in case the primary server goes down. Otherwise, you wouldn’t be able to connect to any sites at all.
However, don’t mix in other DNS servers. If you use Cloudflare’s adult content filter as your primary DNS server with your ISP’s DNS server as a secondary, when Cloudflare refuses to resolve an adult site, macOS will drop down to the secondary ISP server, which will resolve it happily, thus eliminating the utility of the Cloudflare’s filtering.
One final note before you get started. Apple’s iCloud Private Relay service (in beta in macOS 12 Monterey, iOS 15, and iPadOS 15) sends all your traffic through two proxy servers, which prevents DNS filters like Quad9 and Cloudflare from working. That’s unfortunate since iCloud Private Relay is a useful way to hide your IP address and browsing activity from your network provider and the websites you visit. Apple is clear about this limitation, noting in its various DNS server interfaces:
DNS requests are being routed by iCloud Private Relay for this network. Turn off Private Relay to manually configure DNS settings.
If you need to turn off iCloud Private Relay on the Mac, open System Preferences > Apple ID and deselect the checkbox next to Private Relay. On an iPhone or iPad, open Settings > Your Name > iCloud > Private Relay and flip the switch to Off.
Set Up DNS Filtering in macOS
To use DNS filtering on the Mac, follow these steps, which should work in any version of macOS. We’re using Quad9 as the example here, but replace the primary and secondary IP addresses as desired if you want to use one of the Cloudflare filters.
1. Open System Preferences > Network, and select the adapter you use (likely Wi-Fi or Ethernet) in the sidebar.
2. Click the Advanced button, and in the sheet that appears, click DNS.
3. Click the button under the DNS Servers list and enter 9.9.9.9.
4. Click the button again and enter 149.112.112.112.
5. Click OK to dismiss the Advanced preferences, and click Apply.
6. Close the Network preference pane.