>We want a public service to be available. Going forward, we will support Quad9 instead of running it ourselves. Running a privacy-focused public DNS service is a highly specialized undertaking, and the Quad9 Foundation is the undisputed leader in the field. Rather than duplicating their efforts to achieve only part of what they do, we're putting those resources toward financially supporting Quad9 instead.
Unfortunately, Quad9 is censoring some domains in Europe (notably in France and Italy) following injunctions issued by rights holders [1]. That was not the case with Mullvad's DNS.
> The German courts entirely disregarded our use of geo-IP lookups on queries, and asserted that since tests via a VPN were able to resolve the domain, we were in breach of court orders
Seriously, what the fuck? So you're supposed to block VPNs as well? What's next, Tor exit nodes? New VPN and Tor nodes as they pop up? I really don't like where this is going.
The entire point is that it can't be reasonably enforced with any granularity. Rights-holders want it to be like that so a copyright win in a single country means something has to be taken down globally.
Indeed it needs to happen, and even here on HN, it can be difficult for some to admit and acknowledge.
It'd be great for this to be the first major relinquishment of nation-state power to happen without violence, without backroom deals, without wedge politics and flag waving.
Just... let it go.
It's beyond obvious that copyright is not going to exist in 1000 years. Every creature on earth - especially the internet - survives by copying information. It's the most basic life force in the universe.
Copyright is serving exactly nobody today. It's time. Are there elder stateswo/men in the room who can see the writing on the wall and act with grace?
Except for nearly everyone who writes anything (including software) or other artistic pursuits to make a living. This includes a majority of people here on HN.
yeah I wouldn't be able to put food on the table if my employer didn't have exclusive license to the glue we use to stick together all that open source code we rely on. Which we now generate exclusively using AI, products of which are of unclear copyright status.
Modern IP law inhibits productivity more than it helps, imo. LLMs have fundamentally changed our line of work, and they have done so by completely ignoring the existing legal framework for IP. We should not defend the current implementation just because some people might suffer reduced earning potential.
Copyright was not designed to maximize productivity. It was designed to maximize creativity and inventiveness (or, as stated in the US Constitution, the progress of science and the useful arts).
I’ve written software all my life, copyright has never been relevant to my earnings at all, trade secrets have been to some extent.
Frankly copyright was meant to enable more sharing and benefiting the public domain, instead it’s become a cancer…
German federal LE agencies have been doing it for years. Threatening to put you on lists of wanted and sanctioned individuals as a basically islamic suicide bomber for not taking down tiny things globally.
That kind of thing isn't unheard of for police agencies with moral and oversight issues, though. Orgs start seeking for bigger reasons. A simple copyright issue creatively expounded into an imaginary global drug bombing cyber trafficking crime ring takedown creates a massive internal win. So they do that.
German courts think the internet revolves around German laws. There are some really insane cases, sometimes they will consider a website to fall under German jurisdiction simply for having a German-language version (somehow ignoring that Austria and Switzerland exist, ignoring German-speaking minorities in other countries, ignoring that a fully automated translation in 100+ languages is now possible at the click of a button).
There's some irony in Germany using censorship for the purpose of ensuring people don't get into reading materials that might convince them to become... fascists who censor people
There is no irony. The German government is proto-fascist, and has been for a while, as are several other European governments. Apparently the UK now arrests more people per capita for online speech than China does.
Progressivism was the American peer of fascism and communism, down to the eugenics (stopped in the 1970s, but continued via sterilizing autistic kids with hormones) and “scientific” racism (still endorsed by academia today, under euphemisms).
That’s why it’s endorsed by notable Nazi families and collaborators, eg, Soros family and Schwab family.
Mentioning evil Soros is like a 100% reliable political crackpot indicator, even though this here is a quite original take. He is usually an evil Jewish globalist, i.e. a nefarious leftist.
I think he seriously pissed off the right people in Russia who are now throwing whatever shit they can think of at the wall, and some of it sticks. They do not try to be consistent at all, anything that will convince someone is fine.
>Since Quad9 already performs DNSSEC validation, DNSSEC being enabled in the forwarder will cause a duplication of the DNSSEC process, significantly reducing performance and potentially causing false BOGUS responses.
This sounds dodgy. Surely that means Quad9 can poison my DNS?
I use Clouldflare DoT and enabled validation in systemd-resolved some time ago. Not because I would be particularly paranoid, but more out of curiosity how it works. I noticed no problems, except for with Atlassian. They use 2 second level domains (at least), one under .com signed and one under .net (unsigned) (IIRC). Most things worked like normal, but some Jira extension stopped working. Turned out that systemd did reject their signed subdomains. Could not figure out whether the rejection was justified or not. When I asked Claude 7 times about it, I also got 7 contradicting answers... Reported to Atlassian support that their signing is incorrect (some delegation missing). To my surprise they replied: Are you using systemd? And gave a bug number that systemd handles validation wrong in their case.
Haven't had time to study the bug and really understand the whole issue myself. Just left it there with the takeaway that local validation is currently not for non-experts.
(Sorry not at my computer. Details rather vague from memory.)
Wait, I must be misunderstanding you, because if you're resolving off Quad9, they can definitely poison your DNSSEC-signed records. Between a stub resolver and a recursor DNSSEC collapses down to a single "yes it was signed" bit in the header.
To protect yourself from an upstream resolver using DNSSEC, you need to be doing something akin to a full recursive lookup yourself. This is a flaw in the DNSSEC design and a reason why DoH took off instead.
I don't know the details but knot-resolver asks for DS records of the domain being looked up when forwarding to avoid needing to do a full recursive lookup to validate DNSSEC. As I recall from what I've read this works almost everywhere, including Quad9, but not Google DNS due to a bug that they claim to have identified three years ago but haven't fixed. But as I understand it this is not how recursive resolvers validate so it is extra data that the forwarding server needs to request and cache.
> To protect yourself from an upstream resolver using DNSSEC, you need to be doing something akin to a full recursive lookup yourself. This is a flaw in the DNSSEC design and a reason why DoH took off instead.
What? I don't see how you can call that a flaw in DNSSEC when DoH is no better in this regard; it doesn't even attempt to protect against a malicious recursive resolver. The only way to do that is to validate DNSSEC on the client.
DNSSEC and DoH provide different security services. But to get the benefit of DNSSEC, you need to resolve recursively. DoH works for stub resolvers. That's all I'm saying.
DNSSEC validation on your forwarder would prevent a maliciously modified record from Quad9 (or others) from being accepted locally - i.e. "Quad9 can poison my DNS".
I've always been of two minds on this. On one hand, that concern is beyond any reasonable level of security/performance/reliability tradeoff for most any user. At the same time, it is a bit of a shame DNS doesn't have a more scalable & performant approach to security which can just always be done without having to consider it a tradeoff, however minor in practice.
You are rely here on the assumption what your resolver already knows what the zone is DNSSEC signed. If your forwarder or resolver strips that information?..
1. The forwarder gets a response claiming the record is supposed to be DNNSEC signed from the parent (recursively traversing from the root). The forwarder checks the signature of this claim. If the signature is valid, the forwarder continues on to validate the signature of the record and checks its validity to know if the info was secure. If the signature is invalid, the forwarder knows any information any information is not able to be validated as secure
- Somewhere during the recursive checks through the root, the forwarder gets an unsigned (no DNSSEC) or invalidly signed (e.g. your stripped response) response. The forwarder knows any information is not able to be validated as secure.
- A claim for lack of configuration or support of DNSSEC records comes back. The forwarder knows any information is not able to be validated as secure.
So you always know whether or not the information was secure, it's just if it was insecure you don't know if it's because it was just never secured or if someone tried to tamper with it. And that should make sense, an insecure message is by definition one which you can't tell if it has been tampered with.
Technically yes, in practice the odds your local resolver is validating DNSSEC is slim (and if you're intentionally configured it to do so, switch to a provider that isn't Quad9).
That's something people should run themselves. I run Adguard Home on my router. Unlike the main Adguard product, Adguard Home is fully FOSS. It's been rock-solid for me, and improves on pi-hole in various ways - like full IPv6 support.
> That's something people should run themselves. I run Adguard Home on my router.
I'll second this. People should really be flashing their routers. OpenWRT is simple enough that if you're on HN I think you'll easily be able to do it. And like most routers, you set it up and forget it.
But you'll also get a bunch more benefits from OpenWRT, to make it worth your while.
- I was able to buy a router for <$100 that was WiFi 7 capable (W1700K[0]) and had better hardware than most consumer routers. You can find plenty of cheaper routers that are flashable and more capable.
- Adguard Home
- Split tunneling/VLANs: Since we're talking Mullvad, you can put devices behind Mullvad on a VLAN. So activate Mullvad by changing SSIDs.
- Trivial to put IOT devices on a VLAN (can make one directional too so you can access from your main network but they can't reach back. I throttle everything IOT)
- Tailscale
- QoS (Control the speed and prioritization of different connections)
- It's a fucking computer, you can even run shell scripts
[0] You don't need something like this unless you're getting >1Gbps from your ISP. Big thing I wanted is the 2 10G ports.
It's probably the software I trust the most on my network to 'just work', and with the local caching I can use slower upstream dns providers and still have sub 1ms average latency (no performance worries by excluding google and cloudflare). I don't use it for dhcp, but it is a good fit that it's available as well. Couldn't be happier.
I'd argue you don't need to run DoT/DoH yourself if it is just for your local network.
Setting up a local resolver, such as a Pi-Hole or Unbound on a firewall can serve unencrypted responses to your devices. Those resolvers in turn can use DoT/DoH with their upstream resolvers to encrypt the requests that go through untrusted networks on the Internet.
This is the best of both worlds, the simplicity of unencrypted DNS while encrypting traffic where it matters.
I stopped recommending anything I host myself for those people. When it breaks I'm the support team, and I'd rather not be. NextDNS free tier is what I give them now, takes two minutes, and I never hear about it again.
There's also Orion browser, but I found it to be a bit more glitchy, especially around sites like YouTube (fuck the app, I'm not watching videos there): https://orionbrowser.com/
Yes, I use Firefox on Android with ublock origin, it works great. But using adblocking DNS on your phone will also block most in-app ads which is a big quality of life improvement.
I could also use a VPN to keep my phone always on my home network and thus behind my own ad blocking DNS but Mullvad's adblocking DNS was really nice and convenient.
Really? I never found it effective unless I messed with certs on my phone.
For example, DNS blocking isn't going to block YouTube ads if you're using the app since they don't need to respect your DNS, but it will if you're in browser because they can't control that.
I've been using NextDNS [0] for a long time. It's worth the price because you can set up all kinds of different blocking profiles and have different ones on different devices, allows you to have overrides for local network items (or internals like on a Tailnet, Pangolin, Wireguard, etc) and a lot more. The ad blocking ends up working so well a lot not only are ads blocked on web pages but it works with some streaming audio ads as well as VoD that has ads injected. Highly recommend.
Mullvad had adblocking, malware blocking. And they didn’t block websites from governments blacklists in France and Italy. None of these features are available on Quad9.
This is a very important detail. Adblock in 2026 is necessary and DNS will transparently do a lot of that work for you. It isn't just about lightning fast lookups and five-nines uptime anymore.
I've been loving the Pihole setup I just set up. It uses Quad9 as the upstream provider and then I do all the blocking myself. I used to use NextDNS but this is so much better and free!
I'm all for supporting quad9; but what if we just disable dnssec instead, it really solves nothing and continued support of it just makes it show up in compliance guides unnecessarily.
I'm always wondering whether those centralized privacy services are not the easiest first target for three-letter-agencies to infiltrate to gain access to the most relevant users to track - and what currently would prevent them from doing so if they haven't already ? Maybe, as with the case of many TOR nodes , they might be running them.
I don't think there's any company with useful information on the American public that isn't being forced to regularly hand over that data. That's probably been true to some extent for a long time (see Room 641A) but it's certainly gotten worse. At this point you can't check out a book from the library without the feds demanding that your librarian turn over a list of everything you've ever read, or rent a hotel room for a night without the hotel being forced to provide your information to the government.
Use an online service that's new enough and small enough and it might not be compromised, but the moment it gets popular men with guns and national security letters with gag orders will show up to install hardware on their prem, take over entire offices, or just demand reports.
VPNs and secure DNS services aren't there to keep your data from the NSA, ICE, or even the police. They are useful for keeping your ISP from selling your browsing history to anyone willing to pay them (https://www.mitnicksecurity.com/in-the-news/republicans-just...). It'll help keep a little of what you do online away from data brokers, keep your ISP from sending you DMCA notices, and not much else.
For clarification, this is completely true of the US, without needing to speculate, thanks to a combination of FISA 702, the ECPA, CALEA, EO 12333, and the CLOUD act. It all has legal footing in the States.
However, it's not at all the reality of a vast swath of other countries (or, at least, not yet; see Chat Control v2). The US is particularly foul (and effective) when it comes to this practice, but anything outside of US jurisdiction that doesn't have an office in the US can't be touched by laws like these, and the laws of most other countries tend to be significantly less invasive than American ones when it comes to data interception and the practices surrounding it.
Adversaries don't always ask nicely. Sometimes they break in and silently take the data. These services centralize traffic flows and make it so that an adversary only needs to tap one or two circuits to get a full picture for all users of a service.
CIA is not stupid enough to break into a guarded data center in Switzerland or one of the less America friendly EU countries. They tell the NSA to look for security holes and spread narratives that only criminals use VPN hoping that a politician will notice and try to ban them, like what's happening in the UK.
Big tech services are less private than you think but almost every provider who cares about privacy is safer than you expect. Most of the people who work there are committed to their mission, and if they ever get a gag order someone will leak it in no time because they know exactly how to do it without exposing their identity.
Are you sure? Someone broke into a Hetzner data center and a Linode one, physically intercepted the Ethernet cables for jabber.ru, and got certificates signed on their behalf.
Why would they serve a secret subpoena and gag order, when instead they can just drive to a secluded location 5km away from the super secure datacenter, dig a few meters down, passively tap a strand or two, facility and service operators none the wiser?
They’ve already done both. When they can get a cooperative party (AT&T, for example), they colocate their splitter equipment. When they can’t, they tap undersea and overland cables.
When it’s a hostile environment entirely, they hack and do secret operations and bribe.
The data would/should be encrypted; while the NSA did successfully tap Google's inter-datacenter traffic before the Snowden leaks, since then it is encrypted, too. Hopefully other providers won't fall for that trick anymore, either.
IIRC, Google addressed the incident you're referring to by adding E2E encryption to sensitive inter-DC RPC sessions, rather than by fully encrypting inter-DC traffic at the link level. It would be nice to be able to reasonably expect carrier/ISP backbones to be secure against this threat, but in our actual reality this seems like fantastical thinking.
Quad9 is a reasonable choice given the stance on privacy and the similar jurisdiction (Mullvad would probably face the same takedown orders as Quad9), but really anyone who cares about bypassing national blocking orders should run a local caching recursive resolver. Unbound is a great choice.
Unbound can also be used to block malware and advertising domains using shared public lists, or you can build your own list. Your resolver’s DNS queries could be piped through Mullvad or Tor if you want additional privacy.
Been using them for years. The price is reasonable too. It’s the only way I found to block ads everywhere on iOS (except the YT app, Mullvad’s Albania wireguard did that)
I've found DoH was pretty unusable for me on Windows because the TCP connection doesn't seem to stay open between queries. No idea if it's a software or network issue, but big unpredictable delays on DNS queries broke all kinds of weird unexpected stuff.
I stopped using Mullvad when they discontinued OpenVPN support (another one to add to the parent list). OpenVPN, if nothing else, provides a wider array of connection options that have a better chance of fulfilling your specific network needs. It supports both UDP and TCP, unlike WireGuard.
I say this respectfully, but Mullvad is perhaps “dumbing down” their VPN service in an effort to simplify their operations and cater to a wider and more general audience.
I'm not the person you are responding to, but Proton VPN? That's what I switched to after it turned out one of the two Mullvad founders took my money and gave it to a local lunatic politician.
I did too, but I really miss Mullvad's static port forwarding system. It's a pain having to continually run a NAT-PMP client, and it doesn't work when you're connecting to ProtonVPN on your router.
> Running a privacy-focused public DNS service is a highly specialized undertaking
This seems like an overstatement: I have been running my own recursive DNS with Unbound for years and never thought it was a "highly specialized undertaking." It took perhaps a couple of hours to set up in the pre-AI age. I filter ads and trackers using an aggressive blacklist[0].
This dude has been doing it for 25 years, and actually this is a dns provider for domain names which I'm decently sure makes it more complicated than public dns.
They're allowed to say they don't want to pay for it anymore, I just think their logic is bad. Or maybe their lawyer said they're running risks just ignoring takedown and they didn't want to deal with it anymore.
They mean it's authoritative DNS, not a resolver. The two are completely different services. Authoritative DNS is the side that serves the records for your website, resolver is the part that follows the tree of authoritative servers on behalf of the client.
It's a legal problem (granted, you could still call that both a scaling problem and a cost problem), not a technical nor infrastructural one. That's where Quad9 has specific experience with public hosting that Mullvad doesn't.
I'm sure that the time, effort, money, and exposure that goes into responding and adhering to legal requests for a publicly offered service is something Mullvad wasn't expecting and would rather not be doing considering it's not their core focus.
What is intrinsic difficulty? A product at scale has many intrinsic dimensions, not just technical. Saying scaling is not an intrinsic difficulty is pretty weird given a highly scalable product usually looks nothing like their 1-user counterpart even when they have the same functionality.
The old heads out there might remember a time when, rather than everyone using one service provider (ex. for Linux binaries/source), we all mutually agreed to use independently run mirrors closer to us. We sort of had to because of bandwidth and latency limits. But it meant that there were a thousand different people providing the same service. Impossible to censor everyone, everyone shares the load, too many places to hack if you wanted to massively compromise, and the users won.
DNS is harder to do that way because it's hard to have limits on DNS. Perhaps DNS could be adapted with QUIC, to allow fast, encrypted DNS that's easier to rate-limit, and then it'd be easier for average people to run public mirrors with limits.
disappointing, because alternatives matter too. quad9 and other well known servers are potentially blocked by some countries, so the more lesser known services there are the better.
Mullvad talks a lot about decentralization, then hands its resolver users to one of the biggest resolvers going. Quad9 is a good operator, and they actually fought Sony in German court instead of quietly complying. They still got ordered to block. That's the problem. A blocking order only hurts as much as the resolver it lands on is used, so every operator that shuts down and sends its users to Quad9 makes the next order a better deal for whoever files it.
Translation: one of Mullvad’s two cofounders has donated money to Örebropartiet, a left-leaning Swedish political party that promotes strict and restrictive immigration laws.
There's no such thing as a left-leaning party that harsh on immigration. Only parties that call themselves left-leaning. You may as well speak of a capitalist party that wants to seize and redistribute the means of production.
which shows how thoroughly they've been subverted by their purported enemy. siding with the capital on its quest to drive the wages down and the rents up will rightfully be their doom. no amount of progressive signaling can make up for that betrayal. the age of unprecedented prosperity is almost over in the west, and the modern left will perish with it.
is there a single party in Europe campaigning on the promise of more immigration, I wonder? if so, how do they fare? :)
Or that the Nazis are socialist because they have socialist in their name instead of it being a front name to hide their fascist and racist intentions.
They are not far right, AFAICT they are “right” Marxists, probably most similar to Albanian Hoxhaism.
If you aren’t familiar with splits inside Marxism-Leninism, the “left” is most often represented by Trotskyism with the “right” tendency being more like Stalinism and North Korean Juche. (Note that these left/right terms aren’t universally used or applied because every faction claims to be correct.)
I think it is more accurate to think of them as syncretic. (that is what Wikipedia has them listed as) Their main focus seems to be on nationalism/anti-immigration rather than socialism. Many fascist parties historically flirt with socialist policies as a way to make inroads with working class voters so it is not always straightforward.
Whoever openly spouts the concept of "remigration" [1] has no business being called anything else but far-right.
> In its political program for the 2026 Swedish general election the Örebro Party writes that they want to "stop the ongoing population replacement" and make Sweden a monocultural society, rather than a multicultural one. The party also writes that this "will be a Sweden where ethnic Swedes are once again the clear majority."
In particular, the "population replacement" is the most clear sign. That's as antisemitic and far-right as it gets [2].
Is Kim Jong Un far right? Seems like a stretch. (North Korea’s immigration policies are even more restrictive than what they want.)
Btw, Malcom Kyeyune, who has a podcast with the party’s founder, is a black child of an immigrant, adopts an avatar on Twitter of Kim Jong Un’s sister, and semi-ironically stans for North Korea on a regular basis.
yes, obviously he is. There is also no law of the universe that prevents a black person from interviewing a far right person or supporting a far right party.
>We want a public service to be available. Going forward, we will support Quad9 instead of running it ourselves. Running a privacy-focused public DNS service is a highly specialized undertaking, and the Quad9 Foundation is the undisputed leader in the field. Rather than duplicating their efforts to achieve only part of what they do, we're putting those resources toward financially supporting Quad9 instead.
Brilliant.
Unfortunately, Quad9 is censoring some domains in Europe (notably in France and Italy) following injunctions issued by rights holders [1]. That was not the case with Mullvad's DNS.
[1] https://quad9.net/news/blog/italian-blocking-demands-followi...
> The German courts entirely disregarded our use of geo-IP lookups on queries, and asserted that since tests via a VPN were able to resolve the domain, we were in breach of court orders
Seriously, what the fuck? So you're supposed to block VPNs as well? What's next, Tor exit nodes? New VPN and Tor nodes as they pop up? I really don't like where this is going.
The entire point is that it can't be reasonably enforced with any granularity. Rights-holders want it to be like that so a copyright win in a single country means something has to be taken down globally.
My fear exactly.
Sounds more like we should end copyright worldwide.
Indeed it needs to happen, and even here on HN, it can be difficult for some to admit and acknowledge.
It'd be great for this to be the first major relinquishment of nation-state power to happen without violence, without backroom deals, without wedge politics and flag waving.
Just... let it go.
It's beyond obvious that copyright is not going to exist in 1000 years. Every creature on earth - especially the internet - survives by copying information. It's the most basic life force in the universe.
Copyright is serving exactly nobody today. It's time. Are there elder stateswo/men in the room who can see the writing on the wall and act with grace?
> Copyright is serving exactly nobody today
Except for nearly everyone who writes anything (including software) or other artistic pursuits to make a living. This includes a majority of people here on HN.
yeah I wouldn't be able to put food on the table if my employer didn't have exclusive license to the glue we use to stick together all that open source code we rely on. Which we now generate exclusively using AI, products of which are of unclear copyright status.
Modern IP law inhibits productivity more than it helps, imo. LLMs have fundamentally changed our line of work, and they have done so by completely ignoring the existing legal framework for IP. We should not defend the current implementation just because some people might suffer reduced earning potential.
Copyright was not designed to maximize productivity. It was designed to maximize creativity and inventiveness (or, as stated in the US Constitution, the progress of science and the useful arts).
I’ve written software all my life, copyright has never been relevant to my earnings at all, trade secrets have been to some extent. Frankly copyright was meant to enable more sharing and benefiting the public domain, instead it’s become a cancer…
For every rule there is an exception.
German federal LE agencies have been doing it for years. Threatening to put you on lists of wanted and sanctioned individuals as a basically islamic suicide bomber for not taking down tiny things globally.
That kind of thing isn't unheard of for police agencies with moral and oversight issues, though. Orgs start seeking for bigger reasons. A simple copyright issue creatively expounded into an imaginary global drug bombing cyber trafficking crime ring takedown creates a massive internal win. So they do that.
>So you're supposed to block VPNs as well? What's next, Tor exit nodes? New VPN and Tor nodes as they pop up?
Trivial to do nowadays: https://focsec.com/
>I really don't like where this is going.
German courts think the internet revolves around German laws. There are some really insane cases, sometimes they will consider a website to fall under German jurisdiction simply for having a German-language version (somehow ignoring that Austria and Switzerland exist, ignoring German-speaking minorities in other countries, ignoring that a fully automated translation in 100+ languages is now possible at the click of a button).
German courts and technology are not always the best friends
There's some irony in Germany using censorship for the purpose of ensuring people don't get into reading materials that might convince them to become... fascists who censor people
There is no irony. The German government is proto-fascist, and has been for a while, as are several other European governments. Apparently the UK now arrests more people per capita for online speech than China does.
I would like to see your definition of fascism under which the German government is proto-fascist.
An authoritarian state that exercises oppressive power through legalistic institutions in league with a corporate oligarchy.
Progressivism was the American peer of fascism and communism, down to the eugenics (stopped in the 1970s, but continued via sterilizing autistic kids with hormones) and “scientific” racism (still endorsed by academia today, under euphemisms).
That’s why it’s endorsed by notable Nazi families and collaborators, eg, Soros family and Schwab family.
Mentioning evil Soros is like a 100% reliable political crackpot indicator, even though this here is a quite original take. He is usually an evil Jewish globalist, i.e. a nefarious leftist.
I think he seriously pissed off the right people in Russia who are now throwing whatever shit they can think of at the wall, and some of it sticks. They do not try to be consistent at all, anything that will convince someone is fine.
On the Quad9 website:
>Since Quad9 already performs DNSSEC validation, DNSSEC being enabled in the forwarder will cause a duplication of the DNSSEC process, significantly reducing performance and potentially causing false BOGUS responses.
This sounds dodgy. Surely that means Quad9 can poison my DNS?
I use Clouldflare DoT and enabled validation in systemd-resolved some time ago. Not because I would be particularly paranoid, but more out of curiosity how it works. I noticed no problems, except for with Atlassian. They use 2 second level domains (at least), one under .com signed and one under .net (unsigned) (IIRC). Most things worked like normal, but some Jira extension stopped working. Turned out that systemd did reject their signed subdomains. Could not figure out whether the rejection was justified or not. When I asked Claude 7 times about it, I also got 7 contradicting answers... Reported to Atlassian support that their signing is incorrect (some delegation missing). To my surprise they replied: Are you using systemd? And gave a bug number that systemd handles validation wrong in their case.
Haven't had time to study the bug and really understand the whole issue myself. Just left it there with the takeaway that local validation is currently not for non-experts.
(Sorry not at my computer. Details rather vague from memory.)
Not if Quad9 is using DNSSEC, no.
What's the specific threat you're envisioning? If it involves Quad9 themselves being malicious, what would DNSSEC on the forwarding prevent?
This page explains how all of this works in detail: https://quad9.net/news/blog/quad9-enables-dnssec-on-all-serv...
Wait, I must be misunderstanding you, because if you're resolving off Quad9, they can definitely poison your DNSSEC-signed records. Between a stub resolver and a recursor DNSSEC collapses down to a single "yes it was signed" bit in the header.
To protect yourself from an upstream resolver using DNSSEC, you need to be doing something akin to a full recursive lookup yourself. This is a flaw in the DNSSEC design and a reason why DoH took off instead.
I don't know the details but knot-resolver asks for DS records of the domain being looked up when forwarding to avoid needing to do a full recursive lookup to validate DNSSEC. As I recall from what I've read this works almost everywhere, including Quad9, but not Google DNS due to a bug that they claim to have identified three years ago but haven't fixed. But as I understand it this is not how recursive resolvers validate so it is extra data that the forwarding server needs to request and cache.
> To protect yourself from an upstream resolver using DNSSEC, you need to be doing something akin to a full recursive lookup yourself. This is a flaw in the DNSSEC design and a reason why DoH took off instead.
What? I don't see how you can call that a flaw in DNSSEC when DoH is no better in this regard; it doesn't even attempt to protect against a malicious recursive resolver. The only way to do that is to validate DNSSEC on the client.
DNSSEC and DoH provide different security services. But to get the benefit of DNSSEC, you need to resolve recursively. DoH works for stub resolvers. That's all I'm saying.
DNSSEC validation on your forwarder would prevent a maliciously modified record from Quad9 (or others) from being accepted locally - i.e. "Quad9 can poison my DNS".
I've always been of two minds on this. On one hand, that concern is beyond any reasonable level of security/performance/reliability tradeoff for most any user. At the same time, it is a bit of a shame DNS doesn't have a more scalable & performant approach to security which can just always be done without having to consider it a tradeoff, however minor in practice.
You are rely here on the assumption what your resolver already knows what the zone is DNSSEC signed. If your forwarder or resolver strips that information?..
At a high level, one of 3 things happens:
1. The forwarder gets a response claiming the record is supposed to be DNNSEC signed from the parent (recursively traversing from the root). The forwarder checks the signature of this claim. If the signature is valid, the forwarder continues on to validate the signature of the record and checks its validity to know if the info was secure. If the signature is invalid, the forwarder knows any information any information is not able to be validated as secure
- Somewhere during the recursive checks through the root, the forwarder gets an unsigned (no DNSSEC) or invalidly signed (e.g. your stripped response) response. The forwarder knows any information is not able to be validated as secure.
- A claim for lack of configuration or support of DNSSEC records comes back. The forwarder knows any information is not able to be validated as secure.
So you always know whether or not the information was secure, it's just if it was insecure you don't know if it's because it was just never secured or if someone tried to tamper with it. And that should make sense, an insecure message is by definition one which you can't tell if it has been tampered with.
Technically yes, in practice the odds your local resolver is validating DNSSEC is slim (and if you're intentionally configured it to do so, switch to a provider that isn't Quad9).
Quad9 doesn't have an adblocking DNS service though, so it's not really a replacement.
That's something people should run themselves. I run Adguard Home on my router. Unlike the main Adguard product, Adguard Home is fully FOSS. It's been rock-solid for me, and improves on pi-hole in various ways - like full IPv6 support.
But you'll also get a bunch more benefits from OpenWRT, to make it worth your while.
[0] You don't need something like this unless you're getting >1Gbps from your ISP. Big thing I wanted is the 2 10G ports.It's probably the software I trust the most on my network to 'just work', and with the local caching I can use slower upstream dns providers and still have sub 1ms average latency (no performance worries by excluding google and cloudflare). I don't use it for dhcp, but it is a good fit that it's available as well. Couldn't be happier.
I could, but DoH/DoT seems very involved to run yourself, and sometimes I need to give a recommendation to someone less tech-savvy.
I'd argue you don't need to run DoT/DoH yourself if it is just for your local network.
Setting up a local resolver, such as a Pi-Hole or Unbound on a firewall can serve unencrypted responses to your devices. Those resolvers in turn can use DoT/DoH with their upstream resolvers to encrypt the requests that go through untrusted networks on the Internet.
This is the best of both worlds, the simplicity of unencrypted DNS while encrypting traffic where it matters.
I stopped recommending anything I host myself for those people. When it breaks I'm the support team, and I'd rather not be. NextDNS free tier is what I give them now, takes two minutes, and I never hear about it again.
I use Mullvad's adblocking DNS server on my phone which is not always behind my home router.
If you're on Android, FF supports add-ons.
If you're on an iPhone, uBlock is now supported: https://apps.apple.com/us/app/ublock-origin-lite/id674534269...
There's also Orion browser, but I found it to be a bit more glitchy, especially around sites like YouTube (fuck the app, I'm not watching videos there): https://orionbrowser.com/
Yes, I use Firefox on Android with ublock origin, it works great. But using adblocking DNS on your phone will also block most in-app ads which is a big quality of life improvement.
I could also use a VPN to keep my phone always on my home network and thus behind my own ad blocking DNS but Mullvad's adblocking DNS was really nice and convenient.
Really? I never found it effective unless I messed with certs on my phone.
For example, DNS blocking isn't going to block YouTube ads if you're using the app since they don't need to respect your DNS, but it will if you're in browser because they can't control that.
For apps I always use revanced.
The uBlock Origin lite that can run on iOS is very limited compared to the uBlock Origin that runs on Firefox Android.
Sure, but you're on iPhone. It's better than nothing.
I'm on your side but telling people to buy a new phone doesn't solve their problem. Short of that uBlock and/or Orion are their best options
It's not the same thing at all. Mullvad DNS blocks all ads across the system.
I've been using NextDNS [0] for a long time. It's worth the price because you can set up all kinds of different blocking profiles and have different ones on different devices, allows you to have overrides for local network items (or internals like on a Tailnet, Pangolin, Wireguard, etc) and a lot more. The ad blocking ends up working so well a lot not only are ads blocked on web pages but it works with some streaming audio ads as well as VoD that has ads injected. Highly recommend.
[0] https://nextdns.io
Up until the developers roll their host files into their app. That's why a pihole doesn't stop ads when you use the YouTube app.
Look, I still run AdGuard on my router, but it's not the same thing
Mullvad had adblocking, malware blocking. And they didn’t block websites from governments blacklists in France and Italy. None of these features are available on Quad9.
Maybe it’s time to try nym.com?
This is a very important detail. Adblock in 2026 is necessary and DNS will transparently do a lot of that work for you. It isn't just about lightning fast lookups and five-nines uptime anymore.
For blocking, I would much rather run my own service.
I've been loving the Pihole setup I just set up. It uses Quad9 as the upstream provider and then I do all the blocking myself. I used to use NextDNS but this is so much better and free!
Technitium is also really good as a performant local blocker and recursive dns server. I have been running mine for years now and it is fast as well.
I've been using Control D and have been happy with it so far
I'm all for supporting quad9; but what if we just disable dnssec instead, it really solves nothing and continued support of it just makes it show up in compliance guides unnecessarily.
I'm always wondering whether those centralized privacy services are not the easiest first target for three-letter-agencies to infiltrate to gain access to the most relevant users to track - and what currently would prevent them from doing so if they haven't already ? Maybe, as with the case of many TOR nodes , they might be running them.
I don't think there's any company with useful information on the American public that isn't being forced to regularly hand over that data. That's probably been true to some extent for a long time (see Room 641A) but it's certainly gotten worse. At this point you can't check out a book from the library without the feds demanding that your librarian turn over a list of everything you've ever read, or rent a hotel room for a night without the hotel being forced to provide your information to the government.
Use an online service that's new enough and small enough and it might not be compromised, but the moment it gets popular men with guns and national security letters with gag orders will show up to install hardware on their prem, take over entire offices, or just demand reports.
VPNs and secure DNS services aren't there to keep your data from the NSA, ICE, or even the police. They are useful for keeping your ISP from selling your browsing history to anyone willing to pay them (https://www.mitnicksecurity.com/in-the-news/republicans-just...). It'll help keep a little of what you do online away from data brokers, keep your ISP from sending you DMCA notices, and not much else.
For clarification, this is completely true of the US, without needing to speculate, thanks to a combination of FISA 702, the ECPA, CALEA, EO 12333, and the CLOUD act. It all has legal footing in the States.
However, it's not at all the reality of a vast swath of other countries (or, at least, not yet; see Chat Control v2). The US is particularly foul (and effective) when it comes to this practice, but anything outside of US jurisdiction that doesn't have an office in the US can't be touched by laws like these, and the laws of most other countries tend to be significantly less invasive than American ones when it comes to data interception and the practices surrounding it.
> and what currently would prevent them from doing so if they haven't already
they arent gods. some people actually have moral standards and dont just do whatever a foreign agency wants them to do
Adversaries don't always ask nicely. Sometimes they break in and silently take the data. These services centralize traffic flows and make it so that an adversary only needs to tap one or two circuits to get a full picture for all users of a service.
CIA is not stupid enough to break into a guarded data center in Switzerland or one of the less America friendly EU countries. They tell the NSA to look for security holes and spread narratives that only criminals use VPN hoping that a politician will notice and try to ban them, like what's happening in the UK.
Big tech services are less private than you think but almost every provider who cares about privacy is safer than you expect. Most of the people who work there are committed to their mission, and if they ever get a gag order someone will leak it in no time because they know exactly how to do it without exposing their identity.
Are you sure? Someone broke into a Hetzner data center and a Linode one, physically intercepted the Ethernet cables for jabber.ru, and got certificates signed on their behalf.
https://notes.valdikss.org.ru/jabber.ru-mitm/
https://news.ycombinator.com/item?id=37961166
Why would they serve a secret subpoena and gag order, when instead they can just drive to a secluded location 5km away from the super secure datacenter, dig a few meters down, passively tap a strand or two, facility and service operators none the wiser?
They’ve already done both. When they can get a cooperative party (AT&T, for example), they colocate their splitter equipment. When they can’t, they tap undersea and overland cables.
When it’s a hostile environment entirely, they hack and do secret operations and bribe.
The data would/should be encrypted; while the NSA did successfully tap Google's inter-datacenter traffic before the Snowden leaks, since then it is encrypted, too. Hopefully other providers won't fall for that trick anymore, either.
IIRC, Google addressed the incident you're referring to by adding E2E encryption to sensitive inter-DC RPC sessions, rather than by fully encrypting inter-DC traffic at the link level. It would be nice to be able to reasonably expect carrier/ISP backbones to be secure against this threat, but in our actual reality this seems like fantastical thinking.
Quad9 is a reasonable choice given the stance on privacy and the similar jurisdiction (Mullvad would probably face the same takedown orders as Quad9), but really anyone who cares about bypassing national blocking orders should run a local caching recursive resolver. Unbound is a great choice.
Unbound can also be used to block malware and advertising domains using shared public lists, or you can build your own list. Your resolver’s DNS queries could be piped through Mullvad or Tor if you want additional privacy.
It's not that I don't trust Quad9 or dns.sb or any of the others, it's just that I trust Mullvad more.
Sad to see this going away, but I assume this is so Mullvad can focus on their primary services.
Does anyone know of good alternatives that also block ads? Seems Quad9 doesn't.
NextDNS https://nextdns.io/
Been using them for years. The price is reasonable too. It’s the only way I found to block ads everywhere on iOS (except the YT app, Mullvad’s Albania wireguard did that)
The price is so reasonable, I think the risk is that you’re paying mainly with your data?
https://controld.com/free-dns
https://joindns4.eu/for-public#resolver-options
https://github.com/AdguardTeam/AdGuardHome/releases
Trivial to self-host, and gives you full control of blocking.
nextdns.io might be an option
https://adguard-dns.io/kb/general/dns-providers/ have a list of options that some of them have ad blocker
I'm using numa(https://github.com/razvandimescu/numa) for ad filtering and odoh mode for privacy (shameless plug)
So this is something to use instead of pihole?
Several (European) alternatives are available: https://eualternative.eu/categories/public-dns/
dot.sb
dns.adguard-dns.com
What about Cloudflare’s public DNS? https://developers.cloudflare.com/1.1.1.1/setup/#1111-for-fa...
Cloudflare DNS does not block ads, it only blocks malware
These was one of the fastest DoH services for pipelined queries over single TCP connection
IME, it was much faster than Quad9 for this purpose
First Mullvad shuts down its Google search proxy
Now its DoH service
What's next
I've found DoH was pretty unusable for me on Windows because the TCP connection doesn't seem to stay open between queries. No idea if it's a software or network issue, but big unpredictable delays on DNS queries broke all kinds of weird unexpected stuff.
They lost me as a customer when they got rid of port forwarding, which is nice to have on the high seas
I stopped using Mullvad when they discontinued OpenVPN support (another one to add to the parent list). OpenVPN, if nothing else, provides a wider array of connection options that have a better chance of fulfilling your specific network needs. It supports both UDP and TCP, unlike WireGuard.
I say this respectfully, but Mullvad is perhaps “dumbing down” their VPN service in an effort to simplify their operations and cater to a wider and more general audience.
Curious what alternative you found as a replacement. Could you share?
I'm not the person you are responding to, but Proton VPN? That's what I switched to after it turned out one of the two Mullvad founders took my money and gave it to a local lunatic politician.
I've heard AirVPN being mentioned around, if it interests you.
I switched to ProtonVPN which has a heavy emphasis on port forwarding.
I did too, but I really miss Mullvad's static port forwarding system. It's a pain having to continually run a NAT-PMP client, and it doesn't work when you're connecting to ProtonVPN on your router.
Also had a ChatGPT alternative with less surveillance
Discontinued
> Running a privacy-focused public DNS service is a highly specialized undertaking
This seems like an overstatement: I have been running my own recursive DNS with Unbound for years and never thought it was a "highly specialized undertaking." It took perhaps a couple of hours to set up in the pre-AI age. I filter ads and trackers using an aggressive blacklist[0].
[0] https://github.com/hagezi/dns-blocklists
You can't compare running a single service in your home network with the operations it takes to serve a public DNS
>https://freedns.afraid.org/
This dude has been doing it for 25 years, and actually this is a dns provider for domain names which I'm decently sure makes it more complicated than public dns.
They're allowed to say they don't want to pay for it anymore, I just think their logic is bad. Or maybe their lawyer said they're running risks just ignoring takedown and they didn't want to deal with it anymore.
> this is a dns provider for domain names which I'm decently sure makes it more complicated than public dns
Can you expand on this? Isn't all DNS for domain names?
They mean it's authoritative DNS, not a resolver. The two are completely different services. Authoritative DNS is the side that serves the records for your website, resolver is the part that follows the tree of authoritative servers on behalf of the client.
Hey dang can I get my rate limit removed yet?
This is a scaling problem, not an intrinsic difficulty. Mullvad already had the infrastructure in place. I suspect the real reason is cost-cutting.
It's a legal problem (granted, you could still call that both a scaling problem and a cost problem), not a technical nor infrastructural one. That's where Quad9 has specific experience with public hosting that Mullvad doesn't.
I'm sure that the time, effort, money, and exposure that goes into responding and adhering to legal requests for a publicly offered service is something Mullvad wasn't expecting and would rather not be doing considering it's not their core focus.
What is intrinsic difficulty? A product at scale has many intrinsic dimensions, not just technical. Saying scaling is not an intrinsic difficulty is pretty weird given a highly scalable product usually looks nothing like their 1-user counterpart even when they have the same functionality.
How much traffic is your public DNS serving?
That's a shame, even if I remember their DNS service being a bit unstable (it would at various points not be able to resolve or flat out it was down).
The old heads out there might remember a time when, rather than everyone using one service provider (ex. for Linux binaries/source), we all mutually agreed to use independently run mirrors closer to us. We sort of had to because of bandwidth and latency limits. But it meant that there were a thousand different people providing the same service. Impossible to censor everyone, everyone shares the load, too many places to hack if you wanted to massively compromise, and the users won.
DNS is harder to do that way because it's hard to have limits on DNS. Perhaps DNS could be adapted with QUIC, to allow fast, encrypted DNS that's easier to rate-limit, and then it'd be easier for average people to run public mirrors with limits.
disappointing, because alternatives matter too. quad9 and other well known servers are potentially blocked by some countries, so the more lesser known services there are the better.
There is always the option of running your own locally.
This is probably service you can host locally with the lowest maintenance and hardware requirements so it isn't even a hassle to do it yourself.
Mullvad talks a lot about decentralization, then hands its resolver users to one of the biggest resolvers going. Quad9 is a good operator, and they actually fought Sony in German court instead of quietly complying. They still got ordered to block. That's the problem. A blocking order only hurts as much as the resolver it lands on is used, so every operator that shuts down and sends its users to Quad9 makes the next order a better deal for whoever files it.
Their founder supports Nazis.
Pretty unapologetically, too. He's still doing it and will keep doing it the more you give him money.
Source?
Translation: one of Mullvad’s two cofounders has donated money to Örebropartiet, a left-leaning Swedish political party that promotes strict and restrictive immigration laws.
And “donated money” here means “his donations amounted to 72% of the party's entire 2025 revenue”[0].
[0]: https://www.flamman.se/techprofil-ger-miljoner-till-orebropa...
There's no such thing as a left-leaning party that harsh on immigration. Only parties that call themselves left-leaning. You may as well speak of a capitalist party that wants to seize and redistribute the means of production.
which shows how thoroughly they've been subverted by their purported enemy. siding with the capital on its quest to drive the wages down and the rents up will rightfully be their doom. no amount of progressive signaling can make up for that betrayal. the age of unprecedented prosperity is almost over in the west, and the modern left will perish with it.
is there a single party in Europe campaigning on the promise of more immigration, I wonder? if so, how do they fare? :)
Or that the Nazis are socialist because they have socialist in their name instead of it being a front name to hide their fascist and racist intentions.
First I thought it must be the usual Israel-related dogwhistle, but nope, it's legitimate and related to Swedish far-right Örebropartiet [1].
(Next time, might be worth to add a source yourself to prevent downvotes)
[1] https://www.reddit.com/r/ProtonMail/comments/1uivm45/mullvad...
They are not far right, AFAICT they are “right” Marxists, probably most similar to Albanian Hoxhaism.
If you aren’t familiar with splits inside Marxism-Leninism, the “left” is most often represented by Trotskyism with the “right” tendency being more like Stalinism and North Korean Juche. (Note that these left/right terms aren’t universally used or applied because every faction claims to be correct.)
I think it is more accurate to think of them as syncretic. (that is what Wikipedia has them listed as) Their main focus seems to be on nationalism/anti-immigration rather than socialism. Many fascist parties historically flirt with socialist policies as a way to make inroads with working class voters so it is not always straightforward.
Whoever openly spouts the concept of "remigration" [1] has no business being called anything else but far-right.
> In its political program for the 2026 Swedish general election the Örebro Party writes that they want to "stop the ongoing population replacement" and make Sweden a monocultural society, rather than a multicultural one. The party also writes that this "will be a Sweden where ethnic Swedes are once again the clear majority."
In particular, the "population replacement" is the most clear sign. That's as antisemitic and far-right as it gets [2].
[1] https://en.wikipedia.org/wiki/%C3%96rebro_Party#Immigration_...
[2] https://en.wikipedia.org/wiki/Great_Replacement_conspiracy_t...
Is Kim Jong Un far right? Seems like a stretch. (North Korea’s immigration policies are even more restrictive than what they want.)
Btw, Malcom Kyeyune, who has a podcast with the party’s founder, is a black child of an immigrant, adopts an avatar on Twitter of Kim Jong Un’s sister, and semi-ironically stans for North Korea on a regular basis.
yes, obviously he is. There is also no law of the universe that prevents a black person from interviewing a far right person or supporting a far right party.
Calling Kim Jong Un “far right” is a special level of ultra-left idiocy. I’m guessing you consider Marx a “moderate” then.