Swapping Mullvad's retiring DNS address for Quad9's drops ad filtering and encryption
Mullvad shuts off its six public encrypted DNS endpoints on November 2 and points users to Quad9, whose four service variants block no ads. Quad9 also answers plaintext on port 53, so an address-only swap keeps resolving while dropping filtering and encryption.
The Engineer · Build desk
What happened
- Mullvad announced the change on September 3, ending a public encrypted resolver it had run since 2022 and sponsoring Quad9 in its place.
- Five of the six retiring Mullvad endpoints filtered ads, so only one of them returned unfiltered answers.
- Mullvad VPN users keep the DNS inside the tunnel; the public service covered Mullvad Browser outside the VPN and devices pointed at it by hand.
- Mullvad's iOS and macOS DNS profiles do not auto-update and stop working on November 2, and Quad9 publishes replacement profiles.
- Mullvad Browser migrates only its default and bundled-adblock DNS settings to Quad9 and leaves customized settings untouched.
Why it matters
- constraint A config that still resolves after the swap says nothing about its transport, so encryption has to be set and checked on each client.
- cost Anyone who depended on the five filtering endpoints now has to run blocking locally, for example rebuilt from Mullvad's GitHub blocklists, because Quad9 offers no replacement.
- cost Owners of many machines pay per host: browser and Windows adapter DoH settings sit outside the files a grep can sweep, so each one needs a hand check.
The encryption guarantee lived on Mullvad's side of the connection. Mullvad's docs state the addresses "can only be used with DNS resolvers that support DoH or DoT, not with DNS over UDP/53 or TCP/53". The only port 53 listener was a limited one for bootstrapping Mullvad's own hostnames [5]. A client that got answers from Mullvad was therefore getting them over HTTPS or TLS, whatever its own settings allowed [4]. Quad9 serves cleartext queries on port 53 on purpose, and it offers 9953 as a second port for networks that restrict traffic [4]. According to a migration write-up posted to dev.to, 9.9.9.9 pasted into a plain DNS field that held 194.242.2.4 resolves on day one, and the transport has moved from TLS to cleartext without a signal [14].
Filtering goes the same way. Mullvad blocked a domain by returning NXDOMAIN, and its own docs say the resolver "simply lies to the client and says that the hostname does not exist" [9]. Quad9 tells the truth about those names in all four of its variants [3].
The audit has a trap of its own. The author's first grep matched only IP addresses and missed two configs that referenced Mullvad by hostname [10]. The corrected pattern is `194\.242\.2\.[2-9]|2a07:e340|dns\.mullvad\.net`, run across /etc/resolv.conf, /etc/systemd/resolved.conf, /etc/NetworkManager/conf.d and /etc/dnsmasq.conf [16]. A typical hit is `DNS=194.242.2.4#base.dns.mullvad.net` on line 27 of resolved.conf [11]. The IPv6 prefix in that pattern turned up a stale 2a07:e340::4 line in a VM clone that had been dead for months [10].
Config files are only part of the surface. Firefox keeps a custom DoH provider in about:config under network.trr.uri. Chromium browsers show theirs under Settings, Privacy and security, Security [12]. Windows 11 stores per-adapter DoH templates apart from the resolver addresses. `Get-DnsClientDohServerAddress | Where-Object DohTemplate -match "mullvad"` lists any still aimed at Mullvad [13]. On iOS the profiles sit under Settings, General, VPN and Device Management, and on macOS under Device Management. The author puts the swap at about a minute per device [7].
The September 3 announcement and the November 2 cutoff leave 60 days [17]. The write-up's fix is to configure the transport explicitly [15]. I'd set and verify the transport before rebuilding any blocklist. A page full of ads gets noticed, and the author's point is that nothing warns you about cleartext [14].
What to watch
- Which Quad9 service the Mullvad Browser bundled-adblock configuration is moved to, given that none of Quad9's four variants filters ads.
- Whether Quad9's replacement iOS and macOS profiles pin DoH or DoT; that setting decides whether the Apple swap keeps encryption.
- How clients with a missed Mullvad entry behave after November 2, given the author found a VM that ran for months on a dead resolver line.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap0
- Incentives
- Insufficient
- Confidence50
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
On September 3, Mullvad announced it is shutting down the public encrypted DNS servers it has run since 2022 and sponsoring Quad9 instead.
- [2]
Mullvad's six public DNS addresses, given as 194.242.2.2 through 194.242.2.9, stop answering on November 2, 2026.
- [3]
Five of the six Mullvad endpoints filtered ads. Quad9, the designated successor, filters ads in zero of its four service variants.
- [4]
Mullvad's endpoints only ever spoke DNS over HTTPS or TLS. Quad9 answers plaintext on port 53 by design, with 9953 as an alternate port for restrictive networks.
- [5]
Mullvad's docs state that its IPs "can only be used with DNS resolvers that support DoH or DoT, not with DNS over UDP/53 or TCP/53"; the endpoints never answered plaintext on port 53 apart from a limited listener to bootstrap Mullvad's own hostnames.
- [6]
Mullvad VPN users keep using the internal DNS inside the tunnel; the public service existed for Mullvad Browser users outside the VPN and anyone who pointed a device at it directly.
- [7]
Mullvad's iOS and macOS DNS profiles, from its encrypted-dns-profiles GitHub repo, are not auto-updated and stop working on November 2; they appear under Settings, General, VPN and Device Management on iOS (Device Management on macOS). Quad9 publishes equivalent profiles, and swapping takes about a minute per device.
- [8]
Mullvad will not touch customized Mullvad Browser DoH settings; only the default and bundled-adblock configurations auto-migrate to Quad9.
- [9]
Mullvad's filtering works by answering NXDOMAIN for blocked domains; its docs say the resolver "simply lies to the client and says that the hostname does not exist". The blocklists are published on GitHub, so the behavior can be rebuilt.
- [10]
The author's first grep matched only the IP addresses and missed two configs that referenced Mullvad hostnames; the corrected pattern also matches the IPv6 prefix and found a stale 2a07:e340::4 line in a VM clone that had been silently dead for months.
- [11]
An example hit: /etc/systemd/resolved.conf:27:DNS=194.242.2.4#base.dns.mullvad.net
- [12]
Firefox keeps a custom DoH provider in about:config under network.trr.uri; Chromium browsers show the secure DNS provider in Settings, Privacy and security, Security. There is no grep for these settings.
- [13]
Windows 11 stores per-adapter DoH templates separately from resolver addresses; Get-DnsClientDohServerAddress | Where-Object DohTemplate -match "mullvad" finds those pointing at Mullvad.
- [14]
Pasting 9.9.9.9 into a plain DNS field that used to hold 194.242.2.4 makes resolution work on day one, while the transport silently changes from TLS to cleartext and nothing warns the user.
- [15]
The write-up's fix is to configure the transport explicitly.
- [16]
The corrected grep pattern is 194\.242\.2\.[2-9]|2a07:e340|dns\.mullvad\.net, run over /etc/resolv.conf, /etc/systemd/resolved.conf, /etc/NetworkManager/conf.d and /etc/dnsmasq.conf.
- [17]
The announcement and the shutdown are 60 days apart.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- dev.toMullvad Public DNS Shuts Down Nov 2: 5 Checks I Ran First
1 article · October 3, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.