Mullvad closes its public DNS on 2 November: how to switch to Quad9 (and set up encrypted DNS properly)
If you ever pasted a Mullvad DNS-over-HTTPS address into your browser, phone or router, it stops working after 2 November. Here is what to change, and which Quad9 address to use.
By OwnYourStack Admin · Published
Mullvad, the VPN provider, has been running free public encrypted DNS servers since 2022. On 3 September 2026 it announced that it is shutting them down and sponsoring the Quad9 Foundation instead. Anyone who configured Mullvad’s DNS-over-HTTPS (DoH) servers by hand has until 2 November 2026 to move.
Who is affected
- Manual DoH settings. If you typed a Mullvad DoH address into a browser, router, Pi-hole, AdGuard Home or similar, change it before the deadline.
- Mullvad Browser users. Those on the default DoH setting, or the built-in ad-blocking option, will be moved to Quad9 automatically. If you had picked a specific Mullvad variant (base, extended or family) by hand, Mullvad says to switch back to the default. Customised settings are not changed for you.
- iOS and macOS profiles. Existing Mullvad DoH profiles will stop working and need replacing with Quad9’s own profiles.
- Mullvad VPN subscribers. Mullvad says nothing changes while you are connected to the VPN, because queries then go through its internal DNS.
Why Mullvad is stepping back
Mullvad’s explanation is that running a privacy-focused public DNS service is a specialised job, and that the Quad9 Foundation leads the field. Rather than duplicate that work, it is putting the resources into funding Quad9.
Meet Quad9
Quad9 is run by the Quad9 Foundation, a non-profit based in Switzerland, which was founded by the Global Cyber Alliance, IBM and PCH. Its site states that, in normal use, no data containing your IP address is logged in any Quad9 system, and that no account or sign-up is needed. It validates DNSSEC on all its addresses. As with any resolver, that is a statement to weigh rather than something you can verify yourself, so choose the provider whose policy and jurisdiction you are comfortable with.
| Variant | What it does | IPv4 | DoH address | DoT hostname |
|---|---|---|---|---|
| Recommended | Blocks known malicious domains, validates DNSSEC | 9.9.9.9, 149.112.112.112 | https://dns.quad9.net/dns-query | dns.quad9.net |
| Secured with ECS | As above, with EDNS client subnet enabled | 9.9.9.11, 149.112.112.11 | https://dns11.quad9.net/dns-query | dns11.quad9.net |
| Unsecured | No malware blocking; DNSSEC validation only (for experts) | 9.9.9.10, 149.112.112.10 | https://dns10.quad9.net/dns-query | dns10.quad9.net |
IPv6 addresses for each variant are listed on Quad9’s service page (the recommended pair is 2620:fe::fe and 2620:fe::9). Quad9 advises entering all the addresses for the variant you choose, so that one failing path does not leave you without DNS.
How to switch
In a browser
In Firefox, open Settings, then Privacy & Security, then DNS over HTTPS, choose a custom provider and enter https://dns.quad9.net/dns-query. Chromium-based browsers have a similar “secure DNS” setting under Privacy and security, where you can choose a custom provider.
On Android
Use Private DNS (under network settings) and enter the hostname dns.quad9.net. Android uses DNS-over-TLS for this setting, which is why it takes a hostname rather than a web address.
On iPhone, iPad and Mac
Remove any Mullvad DNS profile and install Quad9’s own profile from the Quad9 site.
On your network
If you run a network-wide ad blocker, change its upstream resolver. In AdGuard Home that is under DNS settings; in Pi-hole it is under the DNS settings page. We compared the two in Pi-hole or AdGuard Home in 2026. On a router, look for custom DNS servers in the WAN or internet settings and use the Quad9 IP addresses above.
A quick check afterwards
Quad9 runs a test page on its website that tells you whether you are using its service. Visit it from each device you changed. If a device quietly falls back to your internet provider’s DNS, you are no worse off than before, but you will have lost the encryption you meant to have.
Sources: Mullvad VPN, “Shutting down our public encrypted DNS servers and sponsoring Quad9 instead”, 3 September 2026; Quad9 service addresses and features.
