Mullvad shuts down its public DoH DNS servers and backs Quad9 instead

Mullvad is shutting down the public encrypted DNS (DNS-over-HTTPS) servers it has operated since 2022, and will redirect its resources toward financially sponsoring the Quad9 Foundation rather than continuing to run the service itself. The announcement was made in a blog post on Mullvad's site, which surfaced on the front page of Hacker News.

What is being retired

The servers being decommissioned are Mullvad's public DoH resolvers, which anyone could point their browser or operating system at to keep their DNS lookups away from prying eyes. According to Mullvad, the servers filled two roles outside of its own VPN product: they served as the default resolver for Mullvad Browser whenever the browser is used without Mullvad VPN connected, and they operated as a free public service that anyone could configure manually.

Inside Mullvad VPN, the public resolvers were effectively redundant. The company notes that VPN traffic is already encrypted and that its internal DNS handles all queries, so the public endpoints existed mainly for people outside its VPN ecosystem.

Why Mullvad is stepping back

Mullvad says it still wants a privacy-respecting public DNS service to exist — it just no longer believes it should be the one operating it. In the post, the company describes running a privacy-focused public resolver as a highly specialized undertaking and calls Quad9 the leader in the field. Rather than duplicating that work and achieving only part of what Quad9 already does, Mullvad has decided to fund Quad9 directly.

The move is a notable example of a privacy company choosing to consolidate rather than fragment: instead of maintaining parallel infrastructure for the same goal, Mullvad is effectively consolidating users onto a dedicated DNS nonprofit with its backing.

What users need to do

The hard deadline is November 2, 2026, after which manually configured Mullvad DoH servers will stop resolving. The blog post breaks the migration down by user group:

• Manual configurations: anyone who hand-configured Mullvad's DoH endpoint in a browser or app must switch to an alternative, such as Quad9, before the deadline.
• Mullvad Browser: users who kept the default DoH settings, including the ad-blocking variant, will be migrated to Quad9 automatically. Users who customized their DoH configuration will not be touched, and anyone running a manual variant of Mullvad's resolver — base, extended, family or otherwise — is asked to revert to the defaults.
• iOS and macOS profiles: existing Mullvad DoH configuration profiles for iOS and macOS will simply stop working, and users need to replace them with Quad9's equivalent profiles.

Mullvad points users to Quad9's own setup guides for the migration steps.

Why it matters

Encrypted DNS is one of the quiet workhorses of online privacy. Traditional DNS queries are sent in the clear, which lets an ISP or network operator see every domain a customer looks up even when the actual traffic is encrypted. DoH closes that gap, which is why privacy-oriented browsers and tools increasingly default to it — and why Mullvad Browser leaned on these servers whenever the VPN itself was not in use.

That also means the shutdown touches more than Mullvad's own customers: anyone who adopted the public endpoints as a free privacy tool, or who relies on Mullvad Browser's out-of-the-box protection, is affected by the change. The automatic migration softens the impact for default configurations, but customized setups and mobile profiles require manual action before the November deadline.

The bigger signal, though, is about consolidation in the privacy infrastructure space. Mullvad has concluded that operating a public resolver is better left to an organization that specializes in it, and it is putting money behind that conclusion. For users, that means one fewer independent DoH option — but potentially a better-funded Quad9, which will inherit both Mullvad's sponsorship and a chunk of its user base.