On Sunday, November 2nd, Mullvad switches off its free public encrypted DNS servers. If you ever typed a Mullvad DNS address into your phone, laptop, router or Pi-hole, that setting stops working that day. Mullvad is sending people to Quad9 and paying to support it. Three weeks after the Mullvad servers go dark, Quad9 leaves France. A Paris court fined it for refusing to make its DNS lie about pirate sports streams, and Congress is considering two bills that would bring the same idea to the US.
The one-sentence version: Spend two minutes this week replacing any Mullvad DNS setting you configured by hand, and then think about the bigger question this raises: the small number of free, no-account resolvers we rely on are coming under legal pressure to become censorship tools.
Why I'm covering a settings change
Most of the time a provider shutting down a free service is a one-paragraph story. This one isn't, for two reasons.
First, a lot of people set up Mullvad DNS precisely because privacy folks like me recommended it. It was free, needed no account, came from a company that famously doesn't want to know who you are, and had something nobody else did as cleanly: ready-made filter lists you could subscribe to just by picking a hostname. That's a real loss, and people deserve a proper replacement plan rather than "just use something else."
Second, while I was working out where to point everyone, it turned out the replacement Mullvad recommends is in a legal fight that goes right to the heart of what a DNS resolver is supposed to be. That deserves more than a footnote.
Settings first, then the fight.
A quick refresher: what DNS actually does
DNS is the internet's phone book. You type closednetwork.io, your device asks a resolver what that name's address is, and the resolver answers. Only then does your browser connect.
The privacy problem is in the default. Unless you've changed it, your resolver usually belongs to your internet provider, and those lookups often travel in plain text. HTTPS protects what's on the page, but the lookup has already told your ISP which site you're visiting. It's like sealing your letter in an envelope and then writing the whole thing on the outside.
Encrypted DNS fixes that. DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) wrap the lookup in encryption and send it to a resolver you chose. Your ISP sees an encrypted connection to that resolver and nothing more. The resolver still sees your lookups, which is exactly why it matters who runs it.
What Mullvad announced, and why
Mullvad announced this on September 3rd. The reasoning is refreshingly honest. Inside Mullvad VPN, the public servers are redundant, because VPN users already get Mullvad's internal DNS. And running a serious public resolver is, in Mullvad's words, a "highly specialized undertaking." So rather than run one halfway, Mullvad is redirecting the money to sponsor Quad9, which it calls "the undisputed leader in the field."
You don't often see a company say "someone else does this better, so we'll fund them." Credit where it's due.
Are you affected?
| Your setup | What happens on Nov 2 | What to do |
|---|---|---|
| Mullvad VPN subscriber | Nothing. DNS inside the VPN keeps working, and so do the VPN's content blockers. | Nothing |
| Mullvad Browser, default DNS settings | Moved to Quad9 automatically | Nothing |
| Mullvad Browser, custom DNS (base / extended / family) | Not migrated. Mullvad won't touch custom settings. | Set it back to default, or choose a new provider |
| Mullvad DNS typed in by hand anywhere (Android Private DNS, iOS/macOS profile, router, Pi-hole, Tailscale, browser) | Stops working | Replace it before Nov 2 |
Mullvad specifically warns that its iOS and macOS DoH profiles will stop working.
Why you shouldn't wait and see: when a DNS server disappears, you don't always get a clean error. Sometimes pages just hang. On some setups, though, the device quietly falls back to your ISP's resolver. Everything works, nothing looks wrong, and your lookups are back in plain text. Breaking loudly is the good outcome. Breaking quietly is the bad one.
What to switch to
1. You just want private DNS: Quad9
This is Mullvad's recommendation, and it would have been mine anyway. Quad9 is run by a Swiss non-profit foundation, blocks known malware and phishing domains by default, and says it doesn't identify individual users or IP addresses. Setup guides, including ready-made iPhone and Mac profiles, are at docs.quad9.net.
- DNS-over-HTTPS:
https://dns.quad9.net/dns-query - DNS-over-TLS / Android Private DNS:
dns.quad9.net - Plain IPv4:
9.9.9.9and149.112.112.112
The catch: Quad9 filters malware, not ads. If ad blocking was why you used Mullvad DNS, read on.
2. You want Mullvad-style filter lists, free, no account: Control D's free resolvers
This was news to me, and credit to Techlore's walkthrough for surfacing it. Control D, from the team behind Windscribe VPN, publishes a set of free, no-account resolvers: unfiltered, malware, ads and tracking, social, family-friendly, and more. Each tier has its own address. You copy one in and you're done, which is the closest thing to the old Mullvad experience. Control D says it doesn't log or store your DNS queries.
Copy the exact hostname for the tier you want straight from Control D's page rather than from a blog post, this one included.
The Tailscale gotcha: Techlore found that Tailscale's built-in Control D option seems to require an ID from a paid Control D account. The free resolver IDs didn't work. The only free route inside Tailscale was Control D's legacy unencrypted addresses, which rather defeats the purpose. If you've found a workaround, tell me.
3. You want to tune it yourself: NextDNS
NextDNS has a free tier with a monthly query allowance. Instead of one pre-built list, you assemble your own from a large menu of community blocklists. It integrates natively with Tailscale, routers and every major OS. You're curating rather than subscribing. For some people that's a chore. For a lot of this audience, it's the fun part.
4. Self-hosters: own the filter, rent the upstream
This is a good excuse to run Pi-hole or AdGuard Home on your network. Your box does the filtering and forwards encrypted queries to Quad9, Control D or NextDNS upstream. Next time a provider changes course, you edit one line in one place instead of hunting through six devices and a smart TV.
Meanwhile, in Paris
Here's the part that turns this from a settings story into a Closed Network story.
On October 21st, a Paris court ruled against Quad9 in a case brought by beIN Sports, according to TorrentFreak's reporting. beIN wants pirate tennis streams blocked. The underlying order, which now covers 58 domains, requires resolvers like Quad9 to stop resolving them, in effect to pretend those sites don't exist. Quad9 refused. beIN had asked for €10,000 a day for every domain still reachable, which across 58 domains works out to €580,000 a day. The court set the penalty at €1,000 a day instead, running until the blocking measures end on November 14th. Quad9 estimates the total at about €24,000 plus legal costs.
Quad9's response, in its own post: it will stop serving users in France on Tuesday, November 24th, while it appeals.
"We categorically refuse to alter or lie to you about the DNS responses you receive in a way that opposes your expectations."
That's the whole job of a resolver in one sentence. This is the line that should worry you:
"Quad9 cannot survive the accumulation of penalties yet to be assessed in 20 other pending cases."
This isn't one fine. It's a strategy.
The trap
The EFF's write-up explains why Quad9 had no good option. Quad9 is free and requires no sign-up. It keeps no user files, so it has no reliable way to know who is in France. That left two choices:
- Block the sites for everyone on Earth, which would extend French law to the whole world, or
- Leave France.
It chose to leave. And look at what the order actually achieves. Quad9 doesn't host anything, so not one pirate stream goes offline. French users switch resolvers and the tennis keeps streaming. EFF calls this the predictable result of trying to turn infrastructure providers into "copyright police."
Put the timelines side by side and the irony is hard to miss. Mullvad is sending its users to Quad9 just as Quad9 is being squeezed out of a European country by copyright blocking orders. The Mullvad money helps Quad9 fight. But it shows how few independent, no-account public resolvers exist, and how much pressure they're under.
"That's France." It's also Congress.
If you're in the US and just relaxed, don't. As EFF points out, Congress is considering site-blocking bills that would put DNS resolvers in scope. There are two.
The American Copyright Protection Act (H.R. 10364), from Rep. Darrell Issa, was introduced on September 14th. A copyright holder petitions a designated federal judge to declare a site a "foreign piracy site." The judge can then order providers to take "all reasonable steps" to keep US users away from it. As reported, covered providers include broadband ISPs, public DNS resolvers and VPNs with 100,000 or more monthly US users. Orders last up to 12 months, and providers get 10 days to comply, or less for live events. (The full introduced text hadn't been published when these details were reported. They come from a discussion draft and analysis of the introduced bill.)
The DEFEND IP Act (Senate: S. 5529, led by Sens. Tillis, Coons, Blackburn and Schiff; House version led by Reps. Lofgren and Cline) merges two earlier proposals, FADPA and Block BEARD. I read the House text posted by Rep. Lofgren's office. It's narrower, and the definitions section is the interesting part. A covered "service provider" is:
- a broadband provider with at least 50,000 subscribers, or
- a public DNS resolver with annual revenue above $100,000,000.
It then explicitly excludes:
- "an entity that provides domain name system resolution functions or services exclusively through encrypted DNS protocols"
- "an entity that exclusively provides virtual private network services or similar service that encrypt and route user traffic through intermediary servers"
- premises operators: coffee shops, libraries, airlines, universities.
That revenue threshold points at the Googles and Cloudflares of the world, not a non-profit like Quad9. Note the word exclusively, though. A provider that offers encrypted DNS and plain DNS, or a VPN and other services, doesn't obviously get the exemption.
Look at what that exclusion admits. The people drafting a blocking bill wrote out the services where blocking stops working: encrypted-only DNS and VPNs. So the fight over scope isn't a technicality. It's about whether the privacy tools we talk about every week become enforcement points.
Timing: Issa is retiring at the end of this year, and Sen. Tillis's term ends in January. If either bill moves, expect it in the lame-duck session, the quiet weeks when few people are paying attention. That's exactly when to call your representative.
EFF's verdict on these bills: "They're a threat to the open internet, and don't help creators or creativity." And Quad9 put the long-term risk better than I can: "Once the tools of censorship are built, they are rarely used sparingly or justly." Today it's tennis. A court-ordered blocking system doesn't care what it blocks, and once it exists it's available for the next request.
Your two-minute checklist
- Phone. Android: Settings → Network & internet → Private DNS. iPhone: Settings → General → VPN & Device Management. Remove any Mullvad DNS entry or profile.
- Computer and browser. Check your OS DNS settings and your browser's secure-DNS setting. In Mullvad Browser, if you chose a custom DNS option, set it back to default.
- Everything else. Router, Pi-hole, AdGuard Home, Tailscale, anywhere you typed a Mullvad address.
- Pick a replacement. Quad9 for plain private DNS, Control D's free resolvers for managed filtering, NextDNS to tune it yourself.
- Test it. Run a DNS leak test and confirm the resolver shown is the one you picked, not your ISP.
If you're in France, you'll be doing this twice. Quad9 stops serving you on November 24th.
The bigger lesson
In the space of two months, two of the most trusted free resolvers changed course. One stepped back on purpose and handled it well, with two months' notice and money for a successor. The other is being pushed out of a country for refusing to lie. Neither had anything to do with you, and both affect you.
So know who runs your resolver. Know which laws can reach them. And have a plan B, ideally one you control.
— Simon
Sources & further reading
- Mullvad, "Shutting down our public encrypted DNS servers and sponsoring Quad9 instead" (3 Sept 2026)
- Quad9, "Farewell, France" (22 Oct 2026)
- EFF, "French Courts' Site-Blocking Orders Drive Quad9 Out of France" (27 Oct 2026)
- TorrentFreak, "DNS Resolver Quad9 Will Leave France After Court Orders Piracy Blocking Penalty" (22 Oct 2026)
- TorrentFreak, "Unified U.S. Site Blocking Bill Targets ISPs and DNS Resolvers But Spares VPNs" (28 Sept 2026)
- TorrentFreak, "Two U.S. Site-Blocking Bills Compete Over VPN Rules and ISP Liability" (3 Oct 2026)
- DEFEND IP Act, House bill text as posted by Rep. Lofgren's office
- Lawyerd, "Site blocking reaches the US: Issa files H.R. 10364" (16 Sept 2026)
- Techlore, "Mullvad DNS Shuts Down November 2nd: What to Do" (27 Oct 2026)
- Quad9 setup guides · Control D free DNS · NextDNS