>We want a public service to be available. Going forward, we will support Quad9 instead of running it ourselves. Running a privacy-focused public DNS service is a highly specialized undertaking, and the Quad9 Foundation is the undisputed leader in the field. Rather than duplicating their efforts to achieve only part of what they do, we're putting those resources toward financially supporting Quad9 instead.
Unfortunately, Quad9 is censoring some domains in Europe (notably in France and Italy) following injunctions issued by rights holders [1]. That was not the case with Mullvad's DNS.
> The German courts entirely disregarded our use of geo-IP lookups on queries, and asserted that since tests via a VPN were able to resolve the domain, we were in breach of court orders
Seriously, what the fuck? So you're supposed to block VPNs as well? What's next, Tor exit nodes? New VPN and Tor nodes as they pop up? I really don't like where this is going.
>Since Quad9 already performs DNSSEC validation, DNSSEC being enabled in the forwarder will cause a duplication of the DNSSEC process, significantly reducing performance and potentially causing false BOGUS responses.
This sounds dodgy. Surely that means Quad9 can poison my DNS?
I use Clouldflare DoT and enabled validation in systemd-resolved some time ago. Not because I would be particularly paranoid, but more out of curiosity how it works. I noticed no problems, except for with Atlassian. They use 2 second level domains (at least), one under .com signed and one under .net (unsigned) (IIRC). Most things worked like normal, but some Jira extension stopped working. Turned out that systemd did reject their signed subdomains. Could not figure out whether the rejection was justified or not. When I asked Claude 7 times about it, I also got 7 contradicting answers... Reported to Atlassian support that their signing is incorrect (some delegation missing). To my surprise they replied: Are you using systemd? And gave a bug number that systemd handles validation wrong in their case.
Haven't had time to study the bug and really understand the whole issue myself. Just left it there with the takeaway that local validation is currently not for non-experts.
(Sorry not at my computer. Details rather vague from memory.)
Technically yes, in practice the odds your local resolver is validating DNSSEC is slim (and if you're intentionally configured it to do so, switch to a provider that isn't Quad9).
That's something people should run themselves. I run Adguard Home on my router. Unlike the main Adguard product, Adguard Home is fully FOSS. It's been rock-solid for me, and improves on pi-hole in various ways - like full IPv6 support.
Mullvad had adblocking, malware blocking. And they didn’t block websites from governments blacklists in France and Italy. None of these features are available on Quad9.
This is a very important detail. Adblock in 2026 is necessary and DNS will transparently do a lot of that work for you. It isn't just about lightning fast lookups and five-nines uptime anymore.
I'm all for supporting quad9; but what if we just disable dnssec instead, it really solves nothing and continued support of it just makes it show up in compliance guides unnecessarily.
I'm always wondering whether those centralized privacy services are not the easiest first target for three-letter-agencies to infiltrate to gain access to the most relevant users to track - and what currently would prevent them from doing so if they haven't already ? Maybe, as with the case of many TOR nodes , they might be running them.
I don't think there's any company with useful information on the American public that isn't being forced to regularly hand over that data. That's probably been true to some extent for a long time (see Room 641A) but it's certainly gotten worse. At this point you can't check out a book from the library without the feds demanding that your librarian turn over a list of everything you've ever read, or rent a hotel room for a night without the hotel being forced to provide your information to the government.
Use an online service that's new enough and small enough and it might not be compromised, but the moment it gets popular men with guns and national security letters with gag orders will show up to install hardware on their prem, take over entire offices, or just demand reports.
VPNs and secure DNS services aren't there to keep your data from the NSA, ICE, or even the police. They are useful for keeping your ISP from selling your browsing history to anyone willing to pay them (https://www.mitnicksecurity.com/in-the-news/republicans-just...). It'll help keep a little of what you do online away from data brokers, keep your ISP from sending you DMCA notices, and not much else.
For clarification, this is completely true of the US, without needing to speculate, thanks to a combination of FISA 702, the ECPA, CALEA, EO 12333, and the CLOUD act. It all has legal footing in the States.
However, it's not at all the reality of a vast swath of other countries (or, at least, not yet; see Chat Control v2). The US is particularly foul (and effective) when it comes to this practice, but anything outside of US jurisdiction that doesn't have an office in the US can't be touched by laws like these, and the laws of most other countries tend to be significantly less invasive than American ones when it comes to data interception and the practices surrounding it.
Adversaries don't always ask nicely. Sometimes they break in and silently take the data. These services centralize traffic flows and make it so that an adversary only needs to tap one or two circuits to get a full picture for all users of a service.
Quad9 is a reasonable choice given the stance on privacy and the similar jurisdiction (Mullvad would probably face the same takedown orders as Quad9), but really anyone who cares about bypassing national blocking orders should run a local caching recursive resolver. Unbound is a great choice.
Unbound can also be used to block malware and advertising domains using shared public lists, or you can build your own list. Your resolver’s DNS queries could be piped through Mullvad or Tor if you want additional privacy.
Been using them for years. The price is reasonable too. It’s the only way I found to block ads everywhere on iOS (except the YT app, Mullvad’s Albania wireguard did that)
I've found DoH was pretty unusable for me on Windows because the TCP connection doesn't seem to stay open between queries. No idea if it's a software or network issue, but big unpredictable delays on DNS queries broke all kinds of weird unexpected stuff.
I stopped using Mullvad when they discontinued OpenVPN support (another one to add to the parent list). OpenVPN, if nothing else, provides a wider array of connection options that have a better chance of fulfilling your specific network needs. It supports both UDP and TCP, unlike WireGuard.
I say this respectfully, but Mullvad is perhaps “dumbing down” their VPN service in an effort to simplify their operations and cater to a wider and more general audience.
> Running a privacy-focused public DNS service is a highly specialized undertaking
This seems like an overstatement: I have been running my own recursive DNS with Unbound for years and never thought it was a "highly specialized undertaking." It took perhaps a couple of hours to set up in the pre-AI age. I filter ads and trackers using an aggressive blacklist[0].
This dude has been doing it for 25 years, and actually this is a dns provider for domain names which I'm decently sure makes it more complicated than public dns.
They're allowed to say they don't want to pay for it anymore, I just think their logic is bad. Or maybe their lawyer said they're running risks just ignoring takedown and they didn't want to deal with it anymore.
The old heads out there might remember a time when, rather than everyone using one service provider (ex. for Linux binaries/source), we all mutually agreed to use independently run mirrors closer to us. We sort of had to because of bandwidth and latency limits. But it meant that there were a thousand different people providing the same service. Impossible to censor everyone, everyone shares the load, too many places to hack if you wanted to massively compromise, and the users won.
DNS is harder to do that way because it's hard to have limits on DNS. Perhaps DNS could be adapted with QUIC, to allow fast, encrypted DNS that's easier to rate-limit, and then it'd be easier for average people to run public mirrors with limits.
disappointing, because alternatives matter too. quad9 and other well known servers are potentially blocked by some countries, so the more lesser known services there are the better.
Mullvad talks a lot about decentralization, then hands its resolver users to one of the biggest resolvers going. Quad9 is a good operator, and they actually fought Sony in German court instead of quietly complying. They still got ordered to block. That's the problem. A blocking order only hurts as much as the resolver it lands on is used, so every operator that shuts down and sends its users to Quad9 makes the next order a better deal for whoever files it.
Translation: one of Mullvad’s two cofounders has donated money to Örebropartiet, a left-leaning Swedish political party that promotes strict and restrictive immigration laws.
They are not far right, AFAICT they are “right” Marxists, probably most similar to Albanian Hoxhaism.
If you aren’t familiar with splits inside Marxism-Leninism, the “left” is most often represented by Trotskyism with the “right” tendency being more like Stalinism and North Korean Juche. (Note that these left/right terms aren’t universally used or applied because every faction claims to be correct.)
>We want a public service to be available. Going forward, we will support Quad9 instead of running it ourselves. Running a privacy-focused public DNS service is a highly specialized undertaking, and the Quad9 Foundation is the undisputed leader in the field. Rather than duplicating their efforts to achieve only part of what they do, we're putting those resources toward financially supporting Quad9 instead.
Brilliant.
Unfortunately, Quad9 is censoring some domains in Europe (notably in France and Italy) following injunctions issued by rights holders [1]. That was not the case with Mullvad's DNS.
[1] https://quad9.net/news/blog/italian-blocking-demands-followi...
> The German courts entirely disregarded our use of geo-IP lookups on queries, and asserted that since tests via a VPN were able to resolve the domain, we were in breach of court orders
Seriously, what the fuck? So you're supposed to block VPNs as well? What's next, Tor exit nodes? New VPN and Tor nodes as they pop up? I really don't like where this is going.
24 replies →
On the Quad9 website:
>Since Quad9 already performs DNSSEC validation, DNSSEC being enabled in the forwarder will cause a duplication of the DNSSEC process, significantly reducing performance and potentially causing false BOGUS responses.
This sounds dodgy. Surely that means Quad9 can poison my DNS?
I use Clouldflare DoT and enabled validation in systemd-resolved some time ago. Not because I would be particularly paranoid, but more out of curiosity how it works. I noticed no problems, except for with Atlassian. They use 2 second level domains (at least), one under .com signed and one under .net (unsigned) (IIRC). Most things worked like normal, but some Jira extension stopped working. Turned out that systemd did reject their signed subdomains. Could not figure out whether the rejection was justified or not. When I asked Claude 7 times about it, I also got 7 contradicting answers... Reported to Atlassian support that their signing is incorrect (some delegation missing). To my surprise they replied: Are you using systemd? And gave a bug number that systemd handles validation wrong in their case.
Haven't had time to study the bug and really understand the whole issue myself. Just left it there with the takeaway that local validation is currently not for non-experts.
(Sorry not at my computer. Details rather vague from memory.)
Not if Quad9 is using DNSSEC, no.
What's the specific threat you're envisioning? If it involves Quad9 themselves being malicious, what would DNSSEC on the forwarding prevent?
This page explains how all of this works in detail: https://quad9.net/news/blog/quad9-enables-dnssec-on-all-serv...
7 replies →
Technically yes, in practice the odds your local resolver is validating DNSSEC is slim (and if you're intentionally configured it to do so, switch to a provider that isn't Quad9).
Quad9 doesn't have an adblocking DNS service though, so it's not really a replacement.
That's something people should run themselves. I run Adguard Home on my router. Unlike the main Adguard product, Adguard Home is fully FOSS. It's been rock-solid for me, and improves on pi-hole in various ways - like full IPv6 support.
14 replies →
Mullvad had adblocking, malware blocking. And they didn’t block websites from governments blacklists in France and Italy. None of these features are available on Quad9.
Maybe it’s time to try nym.com?
This is a very important detail. Adblock in 2026 is necessary and DNS will transparently do a lot of that work for you. It isn't just about lightning fast lookups and five-nines uptime anymore.
3 replies →
I've been using Control D and have been happy with it so far
I'm all for supporting quad9; but what if we just disable dnssec instead, it really solves nothing and continued support of it just makes it show up in compliance guides unnecessarily.
I'm always wondering whether those centralized privacy services are not the easiest first target for three-letter-agencies to infiltrate to gain access to the most relevant users to track - and what currently would prevent them from doing so if they haven't already ? Maybe, as with the case of many TOR nodes , they might be running them.
I don't think there's any company with useful information on the American public that isn't being forced to regularly hand over that data. That's probably been true to some extent for a long time (see Room 641A) but it's certainly gotten worse. At this point you can't check out a book from the library without the feds demanding that your librarian turn over a list of everything you've ever read, or rent a hotel room for a night without the hotel being forced to provide your information to the government.
Use an online service that's new enough and small enough and it might not be compromised, but the moment it gets popular men with guns and national security letters with gag orders will show up to install hardware on their prem, take over entire offices, or just demand reports.
VPNs and secure DNS services aren't there to keep your data from the NSA, ICE, or even the police. They are useful for keeping your ISP from selling your browsing history to anyone willing to pay them (https://www.mitnicksecurity.com/in-the-news/republicans-just...). It'll help keep a little of what you do online away from data brokers, keep your ISP from sending you DMCA notices, and not much else.
For clarification, this is completely true of the US, without needing to speculate, thanks to a combination of FISA 702, the ECPA, CALEA, EO 12333, and the CLOUD act. It all has legal footing in the States.
However, it's not at all the reality of a vast swath of other countries (or, at least, not yet; see Chat Control v2). The US is particularly foul (and effective) when it comes to this practice, but anything outside of US jurisdiction that doesn't have an office in the US can't be touched by laws like these, and the laws of most other countries tend to be significantly less invasive than American ones when it comes to data interception and the practices surrounding it.
> and what currently would prevent them from doing so if they haven't already
they arent gods. some people actually have moral standards and dont just do whatever a foreign agency wants them to do
Adversaries don't always ask nicely. Sometimes they break in and silently take the data. These services centralize traffic flows and make it so that an adversary only needs to tap one or two circuits to get a full picture for all users of a service.
7 replies →
Quad9 is a reasonable choice given the stance on privacy and the similar jurisdiction (Mullvad would probably face the same takedown orders as Quad9), but really anyone who cares about bypassing national blocking orders should run a local caching recursive resolver. Unbound is a great choice.
Unbound can also be used to block malware and advertising domains using shared public lists, or you can build your own list. Your resolver’s DNS queries could be piped through Mullvad or Tor if you want additional privacy.
It's not that I don't trust Quad9 or dns.sb or any of the others, it's just that I trust Mullvad more.
Sad to see this going away, but I assume this is so Mullvad can focus on their primary services.
Does anyone know of good alternatives that also block ads? Seems Quad9 doesn't.
NextDNS https://nextdns.io/
Been using them for years. The price is reasonable too. It’s the only way I found to block ads everywhere on iOS (except the YT app, Mullvad’s Albania wireguard did that)
1 reply →
https://controld.com/free-dns
https://joindns4.eu/for-public#resolver-options
they block duolingo
https://github.com/AdguardTeam/AdGuardHome/releases
Trivial to self-host, and gives you full control of blocking.
nextdns.io might be an option
https://adguard-dns.io/kb/general/dns-providers/ have a list of options that some of them have ad blocker
I'm using numa(https://github.com/razvandimescu/numa) for ad filtering and odoh mode for privacy (shameless plug)
So this is something to use instead of pihole?
Several (European) alternatives are available: https://eualternative.eu/categories/public-dns/
dot.sb
dns.adguard-dns.com
What about Cloudflare’s public DNS? https://developers.cloudflare.com/1.1.1.1/setup/#1111-for-fa...
Cloudflare DNS does not block ads, it only blocks malware
These was one of the fastest DoH services for pipelined queries over single TCP connection
IME, it was much faster than Quad9 for this purpose
First Mullvad shuts down its Google search proxy
Now its DoH service
What's next
I've found DoH was pretty unusable for me on Windows because the TCP connection doesn't seem to stay open between queries. No idea if it's a software or network issue, but big unpredictable delays on DNS queries broke all kinds of weird unexpected stuff.
They lost me as a customer when they got rid of port forwarding, which is nice to have on the high seas
I stopped using Mullvad when they discontinued OpenVPN support (another one to add to the parent list). OpenVPN, if nothing else, provides a wider array of connection options that have a better chance of fulfilling your specific network needs. It supports both UDP and TCP, unlike WireGuard.
I say this respectfully, but Mullvad is perhaps “dumbing down” their VPN service in an effort to simplify their operations and cater to a wider and more general audience.
Curious what alternative you found as a replacement. Could you share?
5 replies →
Also had a ChatGPT alternative with less surveillance
Discontinued
> Running a privacy-focused public DNS service is a highly specialized undertaking
This seems like an overstatement: I have been running my own recursive DNS with Unbound for years and never thought it was a "highly specialized undertaking." It took perhaps a couple of hours to set up in the pre-AI age. I filter ads and trackers using an aggressive blacklist[0].
[0] https://github.com/hagezi/dns-blocklists
You can't compare running a single service in your home network with the operations it takes to serve a public DNS
>https://freedns.afraid.org/
This dude has been doing it for 25 years, and actually this is a dns provider for domain names which I'm decently sure makes it more complicated than public dns.
They're allowed to say they don't want to pay for it anymore, I just think their logic is bad. Or maybe their lawyer said they're running risks just ignoring takedown and they didn't want to deal with it anymore.
2 replies →
This is a scaling problem, not an intrinsic difficulty. Mullvad already had the infrastructure in place. I suspect the real reason is cost-cutting.
2 replies →
How much traffic is your public DNS serving?
That's a shame, even if I remember their DNS service being a bit unstable (it would at various points not be able to resolve or flat out it was down).
The old heads out there might remember a time when, rather than everyone using one service provider (ex. for Linux binaries/source), we all mutually agreed to use independently run mirrors closer to us. We sort of had to because of bandwidth and latency limits. But it meant that there were a thousand different people providing the same service. Impossible to censor everyone, everyone shares the load, too many places to hack if you wanted to massively compromise, and the users won.
DNS is harder to do that way because it's hard to have limits on DNS. Perhaps DNS could be adapted with QUIC, to allow fast, encrypted DNS that's easier to rate-limit, and then it'd be easier for average people to run public mirrors with limits.
disappointing, because alternatives matter too. quad9 and other well known servers are potentially blocked by some countries, so the more lesser known services there are the better.
There is always the option of running your own locally.
This is probably service you can host locally with the lowest maintenance and hardware requirements so it isn't even a hassle to do it yourself.
Mullvad talks a lot about decentralization, then hands its resolver users to one of the biggest resolvers going. Quad9 is a good operator, and they actually fought Sony in German court instead of quietly complying. They still got ordered to block. That's the problem. A blocking order only hurts as much as the resolver it lands on is used, so every operator that shuts down and sends its users to Quad9 makes the next order a better deal for whoever files it.
Their founder supports Nazis.
Pretty unapologetically, too. He's still doing it and will keep doing it the more you give him money.
Source?
Translation: one of Mullvad’s two cofounders has donated money to Örebropartiet, a left-leaning Swedish political party that promotes strict and restrictive immigration laws.
4 replies →
First I thought it must be the usual Israel-related dogwhistle, but nope, it's legitimate and related to Swedish far-right Örebropartiet [1].
(Next time, might be worth to add a source yourself to prevent downvotes)
[1] https://www.reddit.com/r/ProtonMail/comments/1uivm45/mullvad...
They are not far right, AFAICT they are “right” Marxists, probably most similar to Albanian Hoxhaism.
If you aren’t familiar with splits inside Marxism-Leninism, the “left” is most often represented by Trotskyism with the “right” tendency being more like Stalinism and North Korean Juche. (Note that these left/right terms aren’t universally used or applied because every faction claims to be correct.)
6 replies →
[dead]