Standard
DNS queries carried inside an ordinary HTTPS connection, specified in RFC 8484.
Mullvad shuts off its six public encrypted DNS endpoints on November 2 and points users to Quad9, whose four service variants block no ads. Quad9 also answers plaintext on port 53, so an address-only swap keeps resolving while dropping filtering and encryption.
Reality
CERT-In bundled 14 ISC BIND CVEs, including cache-poisoning and zone-data modification flaws, under one HIGH rating on 21 September 2026. The batch suits one planned upgrade window, provided recursion and zone transfers are locked down until it runs.
Reality
On 2026-09-12 four jobs died on getaddrinfo while Chrome browsed normally, because Chrome resolves over DoH and Node and Python ask the router. The answer was a probe that logs one JSON line every five minutes.
Reality
RFC 9849 encrypts the ClientHello, so the domain field that SNI allowlists and passive TLS logs depend on stops appearing on the wire. In return, operators inherit a key rotation duty; the spec sets no fixed interval.
Reality
Cloudflare and Google DoH/DoT endpoints are failing on Russian networks, but the largest public measurement found no protocol-wide block. That makes the breakage messier, not milder.
Perspective Coverage
3 publishersReality