10 ms·
Shutting down our public encrypted DNS
- pbhjpbhj 13d ago>We want a public service to be available. Going forward, we will support Quad9 instead of running it ourselves. Running a privacy-focused public DNS service is a highly specialized undertaking, and the Quad9 Foundation is the undisputed leader in the field. Rather than duplicating their efforts to achieve only part of what they do, we're putting those resources toward financially supporting Quad9 instead. Brilliant.
- pbhjpbhj 13d agoOn the Quad9 website: >Since Quad9 already performs DNSSEC validation, DNSSEC being enabled in the forwarder will cause a duplication of the DNSSEC process, significantly reducing performance and potentially causing false BOGUS responses. This sounds dodgy. Surely that means Quad9 can poison my DNS?
- Arainach 13d agoNot if Quad9 is using DNSSEC, no. What's the specific threat you're envisioning? If it involves Quad9 themselves being malicious, what would DNSSEC on the forwarding prevent? This page explains how all of this works in detail: https://quad9.net/news/blog/quad9-enables-dnssec-on-all-service-endpoints/ https://quad9.net/news/blog/quad9-enables-dnssec-on-all-serv...
- zamadatix 13d agoDNSSEC validation on your forwarder would prevent a maliciously modified record from Quad9 (or others) from being accepted locally - i.e. "Quad9 can poison my DNS". I've always been of two minds on this. On one hand, that concern is beyond any reasonable level of security/performance/reliability tradeoff for most any user. At the same time, it is a bit of a shame DNS doesn't have a more scalable & performant approach to security which can just always be done without having to consider it a tradeoff, however minor in practice.
- justsomehnguy 13d agoYou are rely here on the assumption what your resolver already knows what the zone is DNSSEC signed. If your forwarder or resolver strips that information?..
- zamadatix 13d agoAt a high level, one of 3 things happens: 1. The forwarder gets a response claiming the record is supposed to be DNNSEC signed from the parent (recursively traversing from the root). The forwarder checks the signature of this claim. If the signature is valid, the forwarder continues on to validate the signature of the record and checks its validity to know if the info was secure. If the signature is invalid, the forwarder knows any information any information is not able to be validated as secure - Somewhere during the recursive checks through the root, the forwarder gets an unsigned (no DNSSEC) or invalidly signed (e.g. your stripped response) response. The forwarder knows any information is not able to be validated as secure. - A claim for lack of configuration or support of DNSSEC records comes back. The forwarder knows any information is not able to be validated as secure. So you always know whether or not the information was secure, it's just if it was insecure you don't know if it's because it was just never secured or if someone tried to tamper with it. And that should make sense, an insecure message is by definition one which you can't tell if it has been tampered with.
- tptacek 11d agoYou have two recursers (or recurser-capable systems, in the case of a forwarder), an upstream that you tentatively trust and a downstream one you trust completely (because end systems use stub resolvers and have to blindly trust a recursive resolver somewhere). Can you be more specific about how, using current DNS software, that downstream resolver can reliably detect whether a zone is DNSSEC signed? The upstream recurser can erase every DNSSEC record in the tree if it wants. What does the downstream recurser do short of jettisoning the upstream and doing all its own recursive lookups?
- zamadatix 10d ago
- tptacek 13d agoWait, I must be misunderstanding you, because if you're resolving off Quad9, they can definitely poison your DNSSEC-signed records. Between a stub resolver and a recursor DNSSEC collapses down to a single "yes it was signed" bit in the header. To protect yourself from an upstream resolver using DNSSEC, you need to be doing something akin to a full recursive lookup yourself. This is a flaw in the DNSSEC design and a reason why DoH took off instead.
- QDwQ1 13d ago> To protect yourself from an upstream resolver using DNSSEC, you need to be doing something akin to a full recursive lookup yourself. This is a flaw in the DNSSEC design and a reason why DoH took off instead. What? I don't see how you can call that a flaw in DNSSEC when DoH is no better in this regard; it doesn't even attempt to protect against a malicious recursive resolver. The only way to do that is to validate DNSSEC on the client.
- tptacek 13d agoDNSSEC and DoH provide different security services. But to get the benefit of DNSSEC, you need to resolve recursively. DoH works for stub resolvers. That's all I'm saying.
- joveian 13d agoI don't know the details but knot-resolver asks for DS records of the domain being looked up when forwarding to avoid needing to do a full recursive lookup to validate DNSSEC. As I recall from what I've read this works almost everywhere, including Quad9, but not Google DNS due to a bug that they claim to have identified three years ago but haven't fixed. But as I understand it this is not how recursive resolvers validate so it is extra data that the forwarding server needs to request and cache.
- thenewnewguy 13d agoTechnically yes, in practice the odds your local resolver is validating DNSSEC is slim (and if you're intentionally configured it to do so, switch to a provider that isn't Quad9).
- usr1106 13d agoI use Clouldflare DoT and enabled validation in systemd-resolved some time ago. Not because I would be particularly paranoid, but more out of curiosity how it works. I noticed no problems, except for with Atlassian. They use 2 second level domains (at least), one under .com signed and one under .net (unsigned) (IIRC). Most things worked like normal, but some Jira extension stopped working. Turned out that systemd did reject their signed subdomains. Could not figure out whether the rejection was justified or not. When I asked Claude 7 times about it, I also got 7 contradicting answers... Reported to Atlassian support that their signing is incorrect (some delegation missing). To my surprise they replied: Are you using systemd? And gave a bug number that systemd handles validation wrong in their case. Haven't had time to study the bug and really understand the whole issue myself. Just left it there with the takeaway that local validation is currently not for non-experts. (Sorry not at my computer. Details rather vague from memory.)
- seany 13d agoI'm all for supporting quad9; but what if we just disable dnssec instead, it really solves nothing and continued support of it just makes it show up in compliance guides unnecessarily.
- oofdere 13d agoQuad9 doesn't have an adblocking DNS service though, so it's not really a replacement.
- 1970-01-01 13d agoThis is a very important detail. Adblock in 2026 is necessary and DNS will transparently do a lot of that work for you. It isn't just about lightning fast lookups and five-nines uptime anymore.
- cortesoft 13d agoFor blocking, I would much rather run my own service.
- LetsGetTechnicl 13d agoI've been loving the Pihole setup I just set up. It uses Quad9 as the upstream provider and then I do all the blocking myself. I used to use NextDNS but this is so much better and free!
- vardalab 13d agoTechnitium is also really good as a performant local blocker and recursive dns server. I have been running mine for years now and it is fast as well.
- upcoming-sesame 12d agoHow do you block ads when you're outside of your home network? Do you expose your pihole outside?
- cortesoft 12d agoVPN back to your home network?
- assumed_throwaw 13d agoUnfortunately, Quad9 is censoring some domains in Europe (notably in France and Italy) following injunctions issued by rights holders [1]. That was not the case with Mullvad's DNS. [1] https://quad9.net/news/blog/italian-blocking-demands-following-a-bad-example/ https://quad9.net/news/blog/italian-blocking-demands-followi...
- loup-vaillant 13d ago> The German courts entirely disregarded our use of geo-IP lookups on queries, and asserted that since tests via a VPN were able to resolve the domain, we were in breach of court orders Seriously, what the fuck? So you're supposed to block VPNs as well? What's next, Tor exit nodes? New VPN and Tor nodes as they pop up? I really don't like where this is going.
- jwitthuhn 13d agoThe entire point is that it can't be reasonably enforced with any granularity. Rights-holders want it to be like that so a copyright win in a single country means something has to be taken down globally.
- loup-vaillant 13d agoMy fear exactly.
- Henchman21 13d agoSounds more like we should end copyright worldwide.
- jMyles 13d agoIndeed it needs to happen, and even here on HN, it can be difficult for some to admit and acknowledge. It'd be great for this to be the first major relinquishment of nation-state power to happen without violence, without backroom deals, without wedge politics and flag waving. Just... let it go. It's beyond obvious that copyright is not going to exist in 1000 years. Every creature on earth - especially the internet - survives by copying information. It's the most basic life force in the universe. Copyright is serving exactly nobody today. It's time. Are there elder stateswo/men in the room who can see the writing on the wall and act with grace?
- subscribed 12d agoTerrible. No malware / trackers / ad blocking on 9999. I hope at least they'll keep these options in their tunnel configuration but if not there's not much sense in keeping their service....
- em-bee 13d agodisappointing, because alternatives matter too. quad9 and other well known servers are potentially blocked by some countries, so the more lesser known services there are the better.
- DemiGuru 13d agoMullvad talks a lot about decentralization, then hands its resolver users to one of the biggest resolvers going. Quad9 is a good operator, and they actually fought Sony in German court instead of quietly complying. They still got ordered to block. That's the problem. A blocking order only hurts as much as the resolver it lands on is used, so every operator that shuts down and sends its users to Quad9 makes the next order a better deal for whoever files it.
- prmoustache 13d agoThere is always the option of running your own locally. This is probably service you can host locally with the lowest maintenance and hardware requirements so it isn't even a hassle to do it yourself.
- em-bee 12d agoif i live in a country where DNS is filtered then running my own locally is not going to work.
- deleted 13d ago[deleted]
- ianmurrays 13d agoDoes anyone know of good alternatives that also block ads? Seems Quad9 doesn't.
- mgrunwald_ 13d agohttps://controld.com/free-dns https://controld.com/free-dns
- SamDc73 13d agonextdns.io might be an option https://adguard-dns.io/kb/general/dns-providers/ https://adguard-dns.io/kb/general/dns-providers/ have a list of options that some of them have ad blocker
- Dezvous 13d agoNextDNS https://nextdns.io/ https://nextdns.io/
- hexfish 13d agohttps://joindns4.eu/for-public#resolver-options https://joindns4.eu/for-public#resolver-options
- mikalauskas 13d agothey block duolingo
- 1vuio0pswjnm7 13d agoThese was one of the fastest DoH services for pipelined queries over single TCP connection IME, it was much faster than Quad9 for this purpose First Mullvad shuts down its Google search proxy Now its DoH service What's next
- kennethrc 13d agoThey lost me as a customer when they got rid of port forwarding, which is nice to have on the high seas
- ornornor 13d agoCurious what alternative you found as a replacement. Could you share?
- RamRodification 13d agoI'm not the person you are responding to, but Proton VPN? That's what I switched to after it turned out one of the two Mullvad founders took my money and gave it to a local lunatic politician.
- erxam 13d agoI've heard AirVPN being mentioned around, if it interests you.
- UltraSane 13d agoI switched to ProtonVPN which has a heavy emphasis on port forwarding.
- Denatonium 13d agoI did too, but I really miss Mullvad's static port forwarding system. It's a pain having to continually run a NAT-PMP client, and it doesn't work when you're connecting to ProtonVPN on your router.
- 13d ago
- nullmatrix 13d ago[flagged]
- PufPufPuf 13d agoSource?
- snatekay 13d agoTranslation: one of Mullvad’s two cofounders has donated money to Örebropartiet, a left-leaning Swedish political party that promotes strict and restrictive immigration laws.
- MrDOS 13d agoAnd “donated money” here means “his donations amounted to 72% of the party's entire 2025 revenue”[0]. [0]: https://www.flamman.se/techprofil-ger-miljoner-till-orebropartiet/ https://www.flamman.se/techprofil-ger-miljoner-till-orebropa...
- pocksuppet 13d agoThere's no such thing as a left-leaning party that harsh on immigration. Only parties that call themselves left-leaning. You may as well speak of a capitalist party that wants to seize and redistribute the means of production.
- Eufrat 13d agoOr that the Nazis are socialist because they have socialist in their name instead of it being a front name to hide their fascist and racist intentions.
- vlyan 13d agowhich shows how thoroughly they've been subverted by their purported enemy. siding with the capital on its quest to drive the wages down and the rents up will rightfully be their doom. no amount of progressive signaling can make up for that betrayal. the age of unprecedented prosperity is almost over in the west, and the modern left will perish with it. is there a single party in Europe campaigning on the promise of more immigration, I wonder? if so, how do they fare? :)
- mentalgear 13d agoI'm always wondering whether those centralized privacy services are not the easiest first target for three-letter-agencies to infiltrate to gain access to the most relevant users to track - and what currently would prevent them from doing so if they haven't already ? Maybe, as with the case of many TOR nodes , they might be running them.
- ajjahs 13d ago> and what currently would prevent them from doing so if they haven't already they arent gods. some people actually have moral standards and dont just do whatever a foreign agency wants them to do
- greyface- 13d agoAdversaries don't always ask nicely. Sometimes they break in and silently take the data. These services centralize traffic flows and make it so that an adversary only needs to tap one or two circuits to get a full picture for all users of a service.
- tancop 13d agoCIA is not stupid enough to break into a guarded data center in Switzerland or one of the less America friendly EU countries. They tell the NSA to look for security holes and spread narratives that only criminals use VPN hoping that a politician will notice and try to ban them, like what's happening in the UK. Big tech services are less private than you think but almost every provider who cares about privacy is safer than you expect. Most of the people who work there are committed to their mission, and if they ever get a gag order someone will leak it in no time because they know exactly how to do it without exposing their identity.
- greyface- 13d agoWhy would they serve a secret subpoena and gag order, when instead they can just drive to a secluded location 5km away from the super secure datacenter, dig a few meters down, passively tap a strand or two, facility and service operators none the wiser?
- iamnothere 13d agoQuad9 is a reasonable choice given the stance on privacy and the similar jurisdiction (Mullvad would probably face the same takedown orders as Quad9), but really anyone who cares about bypassing national blocking orders should run a local caching recursive resolver. Unbound is a great choice. Unbound can also be used to block malware and advertising domains using shared public lists, or you can build your own list. Your resolver’s DNS queries could be piped through Mullvad or Tor if you want additional privacy.
- jcgl 12d agoI don’t honestly see how that’s necessarily better. Now your ISP can tap your individual household to see what’s being queried. Whereas if you use Do[THU] to connect to some remote recursive resolver it practically functions as a mixer.
- iamnothere 12d agoThat’s why I suggested routing queries through a VPN or Tor if that’s a concern. This bypasses centralized DNS services that may face national blocking orders while retaining privacy.
- jcgl 11d agoI don't see how that's an improvement over using a big public resolver. Probably worse privacy (you've basically just swapped your ISP for another virtual ISP), and worse performance (likely longer network paths from your resolver to various authoritative servers, as well as not getting the benefits from the nicely-warmed caches that big public resolvers will have).
- iamnothere 11d agoA “virtual” ISP may not have my personal details, especially if I am careful about it. I agree that it’s a tradeoff. Some people may live under regimes where big DNS servers are blocked or under legal orders, or they may have concerns about imminent DNS censorship or logging orders.
- deleted 13d ago[deleted]
- drnick1 13d ago> Running a privacy-focused public DNS service is a highly specialized undertaking This seems like an overstatement: I have been running my own recursive DNS with Unbound for years and never thought it was a "highly specialized undertaking." It took perhaps a couple of hours to set up in the pre-AI age. I filter ads and trackers using an aggressive blacklist[0]. [0] https://github.com/hagezi/dns-blocklists https://github.com/hagezi/dns-blocklists
- pprotas 13d agoYou can't compare running a single service in your home network with the operations it takes to serve a public DNS
- drnick1 13d agoThis is a scaling problem, not an intrinsic difficulty. Mullvad already had the infrastructure in place. I suspect the real reason is cost-cutting.
- morserer 13d agoIt's a legal problem (granted, you could still call that both a scaling problem and a cost problem), not a technical nor infrastructural one. That's where Quad9 has specific experience with public hosting that Mullvad doesn't. I'm sure that the time, effort, money, and exposure that goes into responding and adhering to legal requests for a publicly offered service is something Mullvad wasn't expecting and would rather not be doing considering it's not their core focus.
- anvuong 13d agoWhat is intrinsic difficulty? A product at scale has many intrinsic dimensions, not just technical. Saying scaling is not an intrinsic difficulty is pretty weird given a highly scalable product usually looks nothing like their 1-user counterpart even when they have the same functionality.
- ApolloFortyNine 13d ago
- seethishat 12d agoThe announcement only mentions DoH and not DoT... I guess both are going away?
- 0xbadcafebee 13d agoThe old heads out there might remember a time when, rather than everyone using one service provider (ex. for Linux binaries/source), we all mutually agreed to use independently run mirrors closer to us. We sort of had to because of bandwidth and latency limits. But it meant that there were a thousand different people providing the same service. Impossible to censor everyone, everyone shares the load, too many places to hack if you wanted to massively compromise, and the users won. DNS is harder to do that way because it's hard to have limits on DNS. Perhaps DNS could be adapted with QUIC, to allow fast, encrypted DNS that's easier to rate-limit, and then it'd be easier for average people to run public mirrors with limits.
- david_shaw 13d agoIt's not that I don't trust Quad9 or dns.sb or any of the others, it's just that I trust Mullvad more. Sad to see this going away, but I assume this is so Mullvad can focus on their primary services.
- colincowardly 13d ago[dead]
- 0dayz 13d agoThat's a shame, even if I remember their DNS service being a bit unstable (it would at various points not be able to resolve or flat out it was down).
- iknowstuff 13d agoI compared pings recently and was getting like 200-300ms to the closest mullvad DoH server. Quad9 has an adblocking DoH DNS with decent latency.
- HelloUsername 12d agoWhat does everybody here think about Daniel Berntsson, founder and co-owner of Mullvad, personally donating 5 million Swedish krona to the populist Örebro party, criticized for its stances on race & immigration? I'm not trying to start an unhealthy discussion about this topic, genuinely curious about your opinion on the matter.
- geggo98 12d agoI have no insights in Swedish politics. His actions could be really bad, or mean nothing at all. Without proper context, it’s hard to say.
- BatteryMountain 12d agoHe is in his full right to support whatever party he wants? Those parties exists for a reason, a response to certain pressures. Nothing happens in isolation. If you zoom out a bit and if you can for a second try to empathize with both sides, you will often find that both sides of an issue is correct, reasonable & rational from their own perspectives. It is often more an emotional response than one of pure survival. The more you force things on people or suppress them, the more they will resist & push back. The rise of the far-right is not random or just pure evil manifesting out of thin air. It is like a acute inflammatory/immune system response. Obviously it can be exploited by bad actors to further inflame/divide & accelerate certain agendas. Often times extremism takes hold when certain justices are denied (which is in fact evil). Life is best if you assume the guy on the other side (90% of a group) is just a bro trying to survive & have no real bad intent towards you, they don't know you or have been in your shoes, and the other way around too. Thus it is very important to become non-reactive, become observant who is trying to stoke the flames, who benefits from the chaos and so on.
- fwn 12d agoIrrespective of political affiliations, I felt that Mullvad addressed the outrage in a mature and non culture war manner. Because of how they handled the situation, I have a lot more respect for the company. It's great that they didn't try to cancel the guy or get seduced into driving a wedge into their team. It is great they chose their principle over pleasing the crowd in such a transparent way. I have been a customer for many years. I once even used the cash payment option out of curiosity. Here is their statement: https://mullvad.net/en/blog/donation-controversy https://mullvad.net/en/blog/donation-controversy They even linked his (Swedish language) private blog on which he wrote on the issue: https://dberntsson.info/ https://dberntsson.info/
- navigate8310 12d agoQuad9 has horrible latency and frequent query failures, I hope Mullvad encourages them to improve their routes
- junaru 12d agoTheir DoH going down for hours multiple times is what forced me back to cloudflare, i don't trust cloudflare more but at least it works consistently. Additionally the default of blocking 'malware' doesn't jive with uncensored internet - that should be an opt in and not a default on their flagship address if they want to be taken seriously as unfiltered provider. If the encrypted endpoint can go down for extended periods and they curate list of 'malware' they are not something that should be considered a gateway to uncensored and open internet.
- gertop 12d agoI frequently get mini failures with quad9 and my DNS client is too dumb to retry with another server (or quad9 returns a valid but bogus response that prevents my client from hoping to the next server) so I had to ditch quad9. Quad9 also has worse latency but I could live with it, I just can't live with web pages failing to load several times per day(especially hacker News that has their DNS TTL set to 1 second) It doesn't happen with my ISP's servers nor with CloudFlare or google or even good ol' L3.
- johnhtodd 12d agoHi - I'm with Quad9 (CTO). I'm going to try to put together a single post replying to some of these topics. First: We welcome the Mullvad users who will be shifted onto our systems, and we appreciate that Mullvad contacted us instead of doing this unilaterally. Since we have no signup process, they could have just moved users across but we very much appreciate their cooperation and communication, both with us and with the users of the service - this is exactly how an ideal transfer should go, at least from our perspective. I'll try to make some short summaries of some of the points here, and a reply on each. "You should just run your own DNS server - it's easy." - Yes, we agree that for a small company or home running your own recursive resolver is a reasonable solution. You probably won't get the threat mitigation depth of service that Quad9 offers, but you may not want that. Privacy also suffers a bit, since it's still the same IP address (your home "public" address) sending queries to authoritative servers, probably unencrypted. A good middle compromise is to run PiHole or AdGuard software, and forward your queries to Quad9 via an encrypted connection. (see below) This mixes your queries in with a large number of other users, and gets the potential improvements of having a much larger active cache nearby which will have "hot" answers. Running a home resolver for yourself or even a few dozen (or even a few hundred) people is not difficult. But with all services, things change with scale. As the query volume and number of locations grow, you soon find yourself hitting all possible exception cases, instantly. Many millions of requests a second requires a lot of time, expertise, and money to ensure nearly 100% uptime. We are admittedly quite a small group - less than 10 full time - but even that is under-staffed for supporting more than 100 million daily users. We do quite a bit with a very small resource set, and I doubt it could be done less expensively with the same robustness for the same scale. Again, we appreciate Mullvad's sponsorship to help keep this expanding at our normal weekly growth rate of around 2%. "I want ad blocking, and Quad9 doesn't do that" - Correct, Quad9 does not do ad blocking at this time. There are good solutions like PiHole or AdGuard extensions that provide this functionality, and getting local control and logging of your DNS queries is probably useful for power users. There are also commercial platforms that provide this capability, and they may provide significantly more "knobs" for what you want to block. Quad9 is a non-profit - we're not out to corner the market, and as long as privacy and security is increased for the end user, we're all for commercial solutions! "Quad9 blocks domains in Germany" - Currently there are no mandatory blocks that Quad9 is integrating or enforcing on our DNS platform, from any external party. We did briefly block some domains as a result of legal actions against us in Germany. The good news is that we won that case in Germany, after two years and three appeals and an enormous amount of time and money (which despite Germany's "loser pays" rule, is not even close to expenditures.) https://quad9.net/news/blog/quad9-turns-the-sony-case-around-in-dresden/ https://quad9.net/news/blog/quad9-turns-the-sony-case-around... The bad news is that the identical thing is happening now in France where we have a number of legal cases open against Quad9, and we do not see an end to this any time soon as long as there is an open question in the EU about what a content-neutral intermediary is and is not required to do. "Mullvad exiting creates more centralization, and that is bad." On the fact that centralization is bad, we agree. DNS resolver centralization is not a great thing, and it seems to be trending in the wrong direction. It's not just large public resolvers - consolidation in the ISP industry is causing more and more of the world's internet-using population to utilize a smaller number of recursive servers. Those servers are operated (mostly) by law-abiding companies, and so there is a strong interest by various parties interested in control of content to "put a hand on the available throat" even though it's the wrong throat to choke. We're busy with some ideas of how to solve this, both from a legal defense position as well as a technology position - stay tuned in the coming months. In the meantime, you can contribute a few euros/francs/dollars to us and we'll have more funds to pay for legal defense in France and hopefully up to the EU courts. https://quad9.net/donate/ https://quad9.net/donate/ "Government agencies can tap data" - Quad9 is based in Switzerland. Despite what may be common knowledge from movies, there is a very formal and rigorous process for governments (Swiss or non-Swiss) to demand data. It is (ultimately) transparent, and managed in a way that is quite well structured - this is, after all, what the Swiss have been doing with financial data for many years. More importantly: Quad9 stores no user data about queries. There isn't anything to demand - the box of data is quite empty. Because of this technological decision and our wide announcement of it (https://quad9.net/about/transparency-report/ https://quad9.net/about/transparency-report/) we have never received a request for data. As for technological methods: Quad9 operates in 200+ widely-separated locations, with no backbone or central data transport network - it is intentionally 'islanded'. It would be a significant challenge to intercept data at all those locations, though we're certain that there are many queries that are observed due to their presence on various ISP or cable networks which are under surveillance. We support all major DNS encryption methods today (even the two that run on QUIC - HTTP/3 and DOQ) and we encourage users to use one of those for their communications to us. We are also one of the few major resolvers experimenting with ADOx, which encrypts messages between the recursive resolver and authoritative server. (https://dnsprivacy.org/adox_status_and_deployment/ https://dnsprivacy.org/adox_status_and_deployment/)
- dylanger 12d agoI used to use Mullvad's DoH Service because of ad blocking, it worked quite well with SoundCloud etc. Are there any alternatives?
- papyrus9244 12d agoThis obviously isn't for everyone, but the solution I use is: my own DNS server at home + wg to access it when I'm away.
- upcoming-sesame 12d agoHow's the latency when you're away?
- dylanger 9d agoI was considering setting something similar with Tailscale, I have a TS exitnode that sits on a VM alongside my VyOS/home router. I'd tempted to setup a DNS Forwarder up on that with Ad-Blocking then use Quad9 as upstream, then just have Tailscale be always on.
- vachina 12d agonextdns. I wonder why people use anything else at all
- burner420042 12d agoFor awhile I self-hosted adguard dns server. It supports iphone profiles thus forcing iOS DNS. I eventually disabled it due to timeout issues specific to iOS. Issue was something DNSSEC related. While reproing the issue I noted the average recursor round trip time from my OVH server hosted in Oregon to the default upstream DNS - Quad9 - was around 70ms. When I changed it to Hurricane Electric the roundtrip dropped to a steady 20ms. Later I changed it again to Cloudflare and the roundtrip was a consistent 2 to 3ms.
- lu7897859 12d ago[flagged]
- randobando772 12d ago[dead]
- Unified-Mentor 12d ago[dead]
- monster_truck 12d agoI'm not saying this is a canary, but I think it should be treated as such.
- dunder_cat 12d agoThis feels like a nitpick but it's important to mention anyway > Mullvad Browser uses them [ the DoH servers ] by default when you're not on Mullvad VPN, preventing your ISP from seeing the domains you visit. This is a half-truth until Encrypted Client Hello (ECH) is in-use for most of your traffic. Sure, you won't have clear-text DNS floating out there in the series of tubes. However, without ECH the hostname you're connecting to is exposed in the SNI field during TLS handshakes. I imagine most sites we are browsing will eventually be able to leverage ECH, so this should become less of an issue over time, but in the event you frequent any self-hosted operations (e.g. no Cloudflare or similar), encrypted client hello could still reveal identifying information since it requires still exposing an "outer SNI" that a valid certificate needs to be presented for. You only get to easily hide in with the masses when you use a big infrastructure provider as a consequence, since the common outer SNI of cloudflare-ech.com doesn't really reveal anything different than an IP <-> ASN database would. But if the outer SNI is "dunder-cat-enterprises.com", then all I've protected you from is your ISP snooping on the subdomain or pinpointing exactly which one of my domains you might be talking to.
- jiveturkey 12d agoEven ECH isn't that helpful. ISP still sees the IP addresses you connect to. Even when non-dedicated IPs are used, I'd be surprised if a quite basic traffic analysis (say, bytes transferred on first visit) wouldn't identify the domain. VPN providers at the tier of Mullvad should be precise about this stuff -- I think it's more than just a nitpick, considering the audience. oh god did I just use an emdash. Note that you need some flavor of secure DNS to enforce ECH. The protocol is designed to be downgradable.
- brendyn 10d agoApologies for political commentary, but I just say this in drew defaults blog: “ Daniel Berntsson Known for: Mullvad VPN (co-founder, co-owner) Daniel is the co-founder of Mullvad VPN, alongside Fredrik Strömberg. In June 2026, Daniel donated 5M Swedish Krona (~$500,000 USD) to the populist anti-immigration Örebro Party,[source] saying “it’s sad that it’s needed”. The party supports the ethnic cleansing of non-white people from Sweden, and Daniel’s donation represented, at the time, 72% of the party’s revenue. Daniel cited immigration as a motivating factor for his donation.”