A two-month shutdown notice for a free DNS resolver drew 351 points on Hacker News by the time MrKeyoor's brief captured it, an unusually loud response for infrastructure that most people never see. The concern is practical: Mullvad will turn off its public encrypted DNS service on November 2, 2026. Manual configurations must move, while Mullvad Browser will transfer people who kept its default settings automatically. Mullvad's larger bet is that funding a specialist nonprofit will do more for public DNS than continuing a parallel service.
Mullvad launched the public service in 2022 for people outside its VPN. It kept an internet provider from reading DNS lookups in transit and supplied the default resolver for Mullvad Browser when the VPN was disconnected. On September 3, the company said it would support Quad9 financially because operating a public, privacy-focused resolver is specialized work. The announcement gives no sponsorship amount or term, so the scale of that support remains unknown.
The shutdown has two migration tracks
Mullvad Browser users with the default DNS setting, including the bundled ad-blocking choice, are due to move to Quad9 automatically. The company says it will leave custom DNS selections alone. Anyone who manually entered a Mullvad hostname in a browser, operating system, router, local resolver or mobile profile has to replace it before the cutoff. Existing Mullvad profiles for iOS and macOS will stop working, according to the notice.
People who use Mullvad VPN do not need the public endpoints for ordinary VPN sessions. DNS requests already travel inside the VPN tunnel and use the resolver on the connected VPN server. Mullvad's technical guide says an additional encrypted DNS hop brings negligible security benefit inside the tunnel and is slower. That distinction matters because a device can contain several DNS settings, yet the VPN client may ignore the one stored by the operating system.
The date also creates a configuration risk rather than an account problem. The public resolver was free and available without a Mullvad subscription, so there is no account to transfer. A forgotten hostname such as base.dns.mullvad.net may sit in a router or phone profile long after the person who set it up has moved on. Mullvad lists six hostnames and their IPv4 and IPv6 addresses, all covered by the retirement notice.
Mullvad's filters do not have direct Quad9 twins
The outgoing service has separate profiles for plain resolution, ads and trackers, malware, social media, adult material and gambling. Its base profile combines ads, trackers and malware; family adds adult and gambling filters; all applies every listed category. Mullvad's service table spells out those combinations. Users who selected one of them were choosing a content policy as well as encrypted transport.
Quad9 organizes its public service differently. Its main 9.9.9.9 resolver blocks domains associated with threats, while 9.9.9.10 leaves threat blocking off. Each also has an EDNS Client Subnet variant intended to improve location-sensitive CDN responses. Quad9's service documentation provides DoH and DoT endpoints for all four choices, but it does not list equivalents for Mullvad's advertising, adult-content or social-media filters. A manual move can therefore change which names resolve even when encryption remains enabled.
Quad9's secure service is the closest match to Mullvad's malware-aware base profile. It blocks malicious domains without reproducing Mullvad's full mix of categories. People who depend on family or advertising filters will need a separate policy layer or another resolver that documents those categories. Quad9 describes 9.9.9.9 specifically as its threat-blocking service, which makes the boundary explicit.
Encryption changes who can see a lookup
DNS over HTTPS sends each DNS query and response through an HTTPS exchange. That protects the connection between the device and its chosen resolver from routine inspection or alteration on the path. The IETF's DoH specification says TLS supplies confidentiality and integrity for that channel. It does not make the resolver disappear from the trust model.
The same standard notes that IP addresses, persistent connections and HTTP metadata can correlate requests at the server. Choosing encrypted DNS therefore moves visibility away from the local network and internet provider toward the resolver. Quad9 says it does not log data containing end-user IP addresses, while its public site reports more than 230 resolver clusters across over 110 countries. Those are Quad9's own operational and privacy claims, and users still have to decide whether that policy fits their needs.
DoH and DNSSEC also solve different problems. HTTPS protects the trip to the resolver; DNSSEC can authenticate DNS data. The IETF says the protocols are independent and compatible, leaving the client either to validate answers or trust the resolver's validation. Quad9 says its blocking service returns NXDOMAIN for a blocked name and SERVFAIL when DNSSEC authentication fails, a difference that can help diagnose a broken lookup.
Verify the resolver after changing it
Changing a dropdown or configuration file only proves that a value was stored. Quad9 publishes a TXT query that reports the transport its resolver received. On macOS, Linux or another system with dig, its verification command is:
dig +short txt proto.on.quad9.net.
A reply containing doh or dot confirms that Quad9 received the lookup over HTTPS or TLS. do53-udp and do53-tcp mean the last hop reached Quad9 as plain DNS. An NXDOMAIN response means Quad9 did not handle that test query, according to the same diagnostic guide. Testing while a VPN is active and again after disconnecting can expose which layer owns DNS in each state.
Legacy DoH clients deserve an earlier trial. Quad9 disabled HTTP/1.1 for DNS over HTTPS in December 2025 and now expects HTTP/2. Its compatibility notes identify MikroTik RouterOS as lacking HTTP/2 in its DoH implementation and suggest resolvers or proxies such as Unbound, BIND, dnscrypt-proxy and AdGuard Home when a client cannot connect directly. DoT is another option where the device supports it.
ECS needs a deliberate choice too. Quad9 says its 9.9.9.11 service sends part of the client's address to authoritative servers so content networks can return a more location-appropriate result. The ordinary 9.9.9.9 option omits ECS. Quad9 calls ECS a privacy tradeoff and recommends leaving it disabled unless a service delivers the wrong regional content or fails to load.
The economics of a public resolver
Mullvad's decision concentrates more public encrypted DNS use on Quad9, including the default population of Mullvad Browser. The reason offered is division of labor: Mullvad says it can support more of the work by financing Quad9 than by duplicating part of it. Quad9, a Swiss nonprofit, says it is funded through grants, commercial and noncommercial partnerships, and individual donations. Its homepage currently reports 670 million average daily threat blocks and more than 25 intelligence providers, figures that indicate the operating scale Mullvad chose to back.
The operator swap changes query handling and policy. Resolver choice determines who handles queries and can also change the answers a client receives, a point covered in the IETF's operational guidance for DoH. Moving users to a larger nonprofit may reduce duplicated engineering, but it also removes an independently operated set of public endpoints and filter policies. Mullvad has disclosed the direction of its spending, though not enough financial detail to judge how much added capacity Quad9 can buy.
Before November 2, Mullvad still needs to ship the automatic browser change and explain exactly how retired endpoints will behave. Quad9 can make the effect of the sponsorship clearer by reporting any resulting capacity or traffic change. Manual users should inventory devices now, choose a matching policy rather than copying the first address they see, and verify the transport after the change. Mullvad's deadline leaves time for that test, provided the router and mobile profiles are found before the cutoff.