>We want a public service to be available. Going forward, we will support Quad9 instead of running it ourselves. Running a privacy-focused public DNS service is a highly specialized undertaking, and the Quad9 Foundation is the undisputed leader in the field. Rather than duplicating their efforts to achieve only part of what they do, we're putting those resources toward financially supporting Quad9 instead.
Unfortunately, Quad9 is censoring some domains in Europe (notably in France and Italy) following injunctions issued by rights holders [1]. That was not the case with Mullvad's DNS.
>Since Quad9 already performs DNSSEC validation, DNSSEC being enabled in the forwarder will cause a duplication of the DNSSEC process, significantly reducing performance and potentially causing false BOGUS responses.
This sounds dodgy. Surely that means Quad9 can poison my DNS?
DNSSEC validation on your forwarder would prevent a maliciously modified record from Quad9 (or others) from being accepted locally - i.e. "Quad9 can poison my DNS".
I've always been of two minds on this. On one hand, that concern is beyond any reasonable level of security/performance/reliability tradeoff for most any user. At the same time, it is a bit of a shame DNS doesn't have a more scalable & performant approach to security which can just always be done without having to consider it a tradeoff, however minor in practice.
This is a very important detail. Adblock in 2026 is necessary and DNS will transparently do a lot of that work for you. It isn't just about lightning fast lookups and five-nines uptime anymore.
I'm all for supporting quad9; but what if we just disable dnssec instead, it really solves nothing and continued support of it just makes it show up in compliance guides unnecessarily.
Quad9 is a reasonable choice given the stance on privacy and the similar jurisdiction (Mullvad would probably face the same takedown orders as Quad9), but really anyone who cares about bypassing national blocking orders should run a local caching recursive resolver. Unbound is a great choice.
Unbound can also be used to block malware and advertising domains using shared public lists, or you can build your own list. Your resolver’s DNS queries could be piped through Mullvad or Tor if you want additional privacy.
I'm always wondering whether those centralized privacy services are not the easiest first target for three-letter-agencies to infiltrate to gain access to the most relevant users to track - and what currently would prevent them from doing so if they haven't already ? Maybe, as with the case of many TOR nodes , they might be running them.
I don't think there's any company with useful information on the American public that isn't being forced to regularly hand over that data. That's probably been true to some extent for a long time (see Room 641A) but it's certainly gotten worse. At this point you can't check out a book from the library without the feds demanding that your librarian turn over a list of everything you've ever read, or rent a hotel room for a night without the hotel being forced to provide your information to the government.
Use an online service that's new enough and small enough and it might not be compromised, but the moment it gets popular men with guns and national security letters with gag orders will show up to install hardware on their prem, take over entire offices, or just demand reports.
VPNs and secure DNS services aren't there to keep your data from the NSA, ICE, or even the police. They are useful for keeping your ISP from selling your browsing history to anyone willing to pay them. It'll help keep a little of what you do online away from data brokers and not much else.
disappointing, because alternatives matter too. quad9 and other well known servers are potentially blocked by some countries, so the more lesser known services there are the better.
>We want a public service to be available. Going forward, we will support Quad9 instead of running it ourselves. Running a privacy-focused public DNS service is a highly specialized undertaking, and the Quad9 Foundation is the undisputed leader in the field. Rather than duplicating their efforts to achieve only part of what they do, we're putting those resources toward financially supporting Quad9 instead.
Brilliant.
Unfortunately, Quad9 is censoring some domains in Europe (notably in France and Italy) following injunctions issued by rights holders [1]. That was not the case with Mullvad's DNS.
[1] https://quad9.net/news/blog/italian-blocking-demands-followi...
On the Quad9 website:
>Since Quad9 already performs DNSSEC validation, DNSSEC being enabled in the forwarder will cause a duplication of the DNSSEC process, significantly reducing performance and potentially causing false BOGUS responses.
This sounds dodgy. Surely that means Quad9 can poison my DNS?
Not if Quad9 is using DNSSEC, no.
What's the specific threat you're envisioning? If it involves Quad9 themselves being malicious, what would DNSSEC on the forwarding prevent?
This page explains how all of this works in detail: https://quad9.net/news/blog/quad9-enables-dnssec-on-all-serv...
DNSSEC validation on your forwarder would prevent a maliciously modified record from Quad9 (or others) from being accepted locally - i.e. "Quad9 can poison my DNS".
I've always been of two minds on this. On one hand, that concern is beyond any reasonable level of security/performance/reliability tradeoff for most any user. At the same time, it is a bit of a shame DNS doesn't have a more scalable & performant approach to security which can just always be done without having to consider it a tradeoff, however minor in practice.
Quad9 doesn't have an adblocking DNS service though, so it's not really a replacement.
This is a very important detail. Adblock in 2026 is necessary and DNS will transparently do a lot of that work for you. It isn't just about lightning fast lookups and five-nines uptime anymore.
I'm all for supporting quad9; but what if we just disable dnssec instead, it really solves nothing and continued support of it just makes it show up in compliance guides unnecessarily.
Quad9 is a reasonable choice given the stance on privacy and the similar jurisdiction (Mullvad would probably face the same takedown orders as Quad9), but really anyone who cares about bypassing national blocking orders should run a local caching recursive resolver. Unbound is a great choice.
Unbound can also be used to block malware and advertising domains using shared public lists, or you can build your own list. Your resolver’s DNS queries could be piped through Mullvad or Tor if you want additional privacy.
I'm always wondering whether those centralized privacy services are not the easiest first target for three-letter-agencies to infiltrate to gain access to the most relevant users to track - and what currently would prevent them from doing so if they haven't already ? Maybe, as with the case of many TOR nodes , they might be running them.
I don't think there's any company with useful information on the American public that isn't being forced to regularly hand over that data. That's probably been true to some extent for a long time (see Room 641A) but it's certainly gotten worse. At this point you can't check out a book from the library without the feds demanding that your librarian turn over a list of everything you've ever read, or rent a hotel room for a night without the hotel being forced to provide your information to the government.
Use an online service that's new enough and small enough and it might not be compromised, but the moment it gets popular men with guns and national security letters with gag orders will show up to install hardware on their prem, take over entire offices, or just demand reports.
VPNs and secure DNS services aren't there to keep your data from the NSA, ICE, or even the police. They are useful for keeping your ISP from selling your browsing history to anyone willing to pay them. It'll help keep a little of what you do online away from data brokers and not much else.
> and what currently would prevent them from doing so if they haven't already
they arent gods. some people actually have moral standards and dont just do whatever a foreign agency wants them to do
Does anyone know of good alternatives that also block ads? Seems Quad9 doesn't.
What about Cloudflare’s public DNS? https://developers.cloudflare.com/1.1.1.1/setup/#1111-for-fa...
Cloudflare DNS does not block ads, it only blocks malware
NextDNS https://nextdns.io/
https://joindns4.eu/for-public#resolver-options
nextdns.io might be an option
https://adguard-dns.io/kb/general/dns-providers/ have a list of options that some of them have ad blocker
https://controld.com/free-dns
These was one of the fastest DoH services for pipelined queries over single TCP connection
IME, it was much faster than Quad9 for this purpose
First Mullvad shuts down its Google search proxy
Now its DoH service
What's next
They lost me as a customer when they got rid of port forwarding, which is nice to have on the high seas
disappointing, because alternatives matter too. quad9 and other well known servers are potentially blocked by some countries, so the more lesser known services there are the better.