Mullvad is retiring public encrypted DNS; manual users must migrate before November 2
Mullvad’s public encrypted DNS is being retired. Check who migrates automatically to Quad9, which settings need changing and what happens to filtering.
Record checked: October 26, 2026.
Mullvad is retiring its public encrypted DNS service and financially supporting Quad9 instead. Its announcement, dated September 3, 2026, tells users who manually configured Mullvad’s DNS-over-HTTPS (DoH) servers to switch before November 2, 2026. Default Mullvad Browser DNS settings will migrate automatically; custom Mullvad DNS settings and existing Apple DoH profiles require action. Source: Mullvad announcement.
This is not an announcement that Mullvad VPN—or its internal DNS—is shutting down.
What is changing, and what is not
Mullvad says it has operated public DoH servers since 2022. The service is available without a Mullvad subscription and is intended primarily for use outside the VPN. Its help page documents both DoH and DNS-over-TLS (DoT), which encrypt queries between the device and Mullvad’s public resolver. Sources: announcement and encrypted DNS documentation.
Mullvad distinguishes that service from the DNS resolver on the connected VPN server. It says additional encrypted DNS offers negligible security benefit inside its VPN and is slower than using that internal resolver. Users relying only on the VPN’s internal DNS therefore do not need to replace it because of this announcement. A separately configured public resolver still needs attention, including on devices used when the VPN is disconnected. Source: Mullvad documentation.
Mullvad’s stated reason is resource allocation: it considers public privacy-focused DNS a specialized undertaking and will support Quad9 financially rather than duplicate its work. The announcement does not specify the sponsorship amount or duration. Source: announcement.
Who needs to act
| Current setup | What to do |
|---|---|
| Mullvad Browser with default DoH settings | Mullvad says these users will migrate automatically to Quad9. |
| Mullvad Browser with its included ad-blocking DNS option | Also covered by automatic migration. Check the filtering difference below. |
| Mullvad Browser with custom DoH settings | Custom settings will not be changed. If you manually selected a Mullvad variant, return to the default as Mullvad instructs, or configure a replacement yourself. |
| Mullvad DoH configured manually in another browser, operating system or resolver | Replace it before November 2, 2026. |
| Existing iOS or macOS Mullvad DoH profile | Replace the profile; Mullvad explicitly says existing profiles will stop working. |
These migration rules come from Mullvad’s announcement. It does not name the browser release carrying the automatic change or give an exact shutdown time or timezone. Do not treat November 2 as a last-minute migration window.
Also check Android Private DNS and other DoT configurations. Mullvad’s help page lists the same public service’s DoT hostnames, although the announcement’s explicit deadline sentence refers to manually configured DoH. The notice does not provide a separate DoT timetable. Source: public DNS specifications.
Moving to Quad9 without losing track of the settings
For manual configurations, Quad9 documents its standard DoH endpoint as https://dns.quad9.net/dns-query and its DoT authentication name as dns.quad9.net. Use the appropriate encrypted protocol—not merely a replacement DNS IP address—if you want to retain encrypted transport. Source: Quad9 FAQ.
- Android 9 and later: in Private DNS, select Private DNS provider hostname, enter
dns.quad9.net, then save. Quad9’s guide says this method is not used while a VPN is active and does not work with Quad9 Connect installed and enabled. See Quad9’s Android instructions. - Apple devices: follow Quad9’s iOS profile guide or macOS profile guide. Both warn that iCloud Private Relay and most VPN clients can override the profile. The profiles currently documented expire on January 19, 2027 and automatically disable at expiry; set a reminder to install a replacement beforehand.
- After changing settings: use Quad9’s configuration check, which its documentation recommends. A positive result confirms Quad9 use for that check, not every application’s DNS behavior or the transport protocol by itself. Source: Quad9 FAQ.
Filtering is not a like-for-like replacement
Mullvad’s public DNS options include combinations of ad, tracker, malware, adult-content, gambling and social-media blocking. Source: Mullvad’s hostname table.
Quad9 describes its blocking service as protection against malicious domains, including phishing, malware and exploit kits; it explicitly says it does not provide content filtering. Moving to Quad9 should therefore not be assumed to preserve Mullvad’s ad-blocking or family-filtering behavior, even where the browser migration is automatic. Source: Quad9 FAQ.
As of this record’s date, the shutdown remains a planned change. The announcement establishes the migration deadline and affected configurations; it does not establish that the retirement or every automatic browser migration has already completed.