Hacker News

126 points by mywacaday 3 hours ago | 32 comments

pbhjpbhj 2 hours ago

>We want a public service to be available. Going forward, we will support Quad9 instead of running it ourselves. Running a privacy-focused public DNS service is a highly specialized undertaking, and the Quad9 Foundation is the undisputed leader in the field. Rather than duplicating their efforts to achieve only part of what they do, we're putting those resources toward financially supporting Quad9 instead.

Brilliant.

assumed_throwaw 33 minutes ago

Unfortunately, Quad9 is censoring some domains in Europe (notably in France and Italy) following injunctions issued by rights holders [1]. That was not the case with Mullvad's DNS.

[1] https://quad9.net/news/blog/italian-blocking-demands-followi...

pbhjpbhj 2 hours ago

On the Quad9 website:

>Since Quad9 already performs DNSSEC validation, DNSSEC being enabled in the forwarder will cause a duplication of the DNSSEC process, significantly reducing performance and potentially causing false BOGUS responses.

This sounds dodgy. Surely that means Quad9 can poison my DNS?

Arainach 2 hours ago

Not if Quad9 is using DNSSEC, no.

What's the specific threat you're envisioning? If it involves Quad9 themselves being malicious, what would DNSSEC on the forwarding prevent?

This page explains how all of this works in detail: https://quad9.net/news/blog/quad9-enables-dnssec-on-all-serv...

zamadatix 2 hours ago

DNSSEC validation on your forwarder would prevent a maliciously modified record from Quad9 (or others) from being accepted locally - i.e. "Quad9 can poison my DNS".

I've always been of two minds on this. On one hand, that concern is beyond any reasonable level of security/performance/reliability tradeoff for most any user. At the same time, it is a bit of a shame DNS doesn't have a more scalable & performant approach to security which can just always be done without having to consider it a tradeoff, however minor in practice.

thenewnewguy 8 minutes ago

Technically yes, in practice the odds your local resolver is validating DNSSEC is slim (and if you're intentionally configured it to do so, switch to a provider that isn't Quad9).

oofdere 2 hours ago

Quad9 doesn't have an adblocking DNS service though, so it's not really a replacement.

ornornor 16 minutes ago

Mullvad had adblocking, malware blocking. And they didn’t block websites from governments blacklists in France and Italy. None of these features are available on Quad9.

Maybe it’s time to try nym.com?

1970-01-01 48 minutes ago

This is a very important detail. Adblock in 2026 is necessary and DNS will transparently do a lot of that work for you. It isn't just about lightning fast lookups and five-nines uptime anymore.

cortesoft 17 minutes ago

For blocking, I would much rather run my own service.

LetsGetTechnicl 9 minutes ago

I've been loving the Pihole setup I just set up. It uses Quad9 as the upstream provider and then I do all the blocking myself. I used to use NextDNS but this is so much better and free!

seany 2 hours ago

I'm all for supporting quad9; but what if we just disable dnssec instead, it really solves nothing and continued support of it just makes it show up in compliance guides unnecessarily.

iamnothere 43 minutes ago

Quad9 is a reasonable choice given the stance on privacy and the similar jurisdiction (Mullvad would probably face the same takedown orders as Quad9), but really anyone who cares about bypassing national blocking orders should run a local caching recursive resolver. Unbound is a great choice.

Unbound can also be used to block malware and advertising domains using shared public lists, or you can build your own list. Your resolver’s DNS queries could be piped through Mullvad or Tor if you want additional privacy.

mentalgear 58 minutes ago

I'm always wondering whether those centralized privacy services are not the easiest first target for three-letter-agencies to infiltrate to gain access to the most relevant users to track - and what currently would prevent them from doing so if they haven't already ? Maybe, as with the case of many TOR nodes , they might be running them.

autoexec 39 minutes ago

I don't think there's any company with useful information on the American public that isn't being forced to regularly hand over that data. That's probably been true to some extent for a long time (see Room 641A) but it's certainly gotten worse. At this point you can't check out a book from the library without the feds demanding that your librarian turn over a list of everything you've ever read, or rent a hotel room for a night without the hotel being forced to provide your information to the government.

Use an online service that's new enough and small enough and it might not be compromised, but the moment it gets popular men with guns and national security letters with gag orders will show up to install hardware on their prem, take over entire offices, or just demand reports.

VPNs and secure DNS services aren't there to keep your data from the NSA, ICE, or even the police. They are useful for keeping your ISP from selling your browsing history to anyone willing to pay them (https://www.mitnicksecurity.com/in-the-news/republicans-just...). It'll help keep a little of what you do online away from data brokers, keep your ISP from sending you DMCA notices, and not much else.

ajjahs 43 minutes ago

> and what currently would prevent them from doing so if they haven't already

they arent gods. some people actually have moral standards and dont just do whatever a foreign agency wants them to do

ianmurrays 2 hours ago

Does anyone know of good alternatives that also block ads? Seems Quad9 doesn't.

Dezvous 2 hours ago

NextDNS https://nextdns.io/

ornornor 15 minutes ago

Been using them for years. The price is reasonable too. It’s the only way I found to block ads everywhere on iOS (except the YT app, Mullvad’s Albania wireguard did that)

rdme 30 minutes ago

I'm using numa(https://github.com/razvandimescu/numa) for ad filtering and odoh mode for privacy (shameless plug)

hexfish 2 hours ago

https://joindns4.eu/for-public#resolver-options

mgrunwald_ 2 hours ago

https://controld.com/free-dns

SamDc73 2 hours ago

nextdns.io might be an option

https://adguard-dns.io/kb/general/dns-providers/ have a list of options that some of them have ad blocker

brettdav 48 minutes ago

What about Cloudflare’s public DNS? https://developers.cloudflare.com/1.1.1.1/setup/#1111-for-fa...

  1.1.1.2
  1.0.0.2
  2606:4700:4700::1112
  2606:4700:4700::1002

koeliga 43 minutes ago

Cloudflare DNS does not block ads, it only blocks malware

leumon 24 minutes ago

dns.adguard-dns.com

1vuio0pswjnm7 2 hours ago

These was one of the fastest DoH services for pipelined queries over single TCP connection

IME, it was much faster than Quad9 for this purpose

First Mullvad shuts down its Google search proxy

Now its DoH service

What's next

kennethrc 39 minutes ago

They lost me as a customer when they got rid of port forwarding, which is nice to have on the high seas

ornornor 14 minutes ago

Curious what alternative you found as a replacement. Could you share?

RamRodification 7 minutes ago

I'm not the person you are responding to, but Proton VPN? That's what I switched to after it turned out one of the two Mullvad founders took my money and gave it to a local lunatic politician.

em-bee 2 hours ago

disappointing, because alternatives matter too. quad9 and other well known servers are potentially blocked by some countries, so the more lesser known services there are the better.

DemiGuru 2 hours ago

Mullvad talks a lot about decentralization, then hands its resolver users to one of the biggest resolvers going. Quad9 is a good operator, and they actually fought Sony in German court instead of quietly complying. They still got ordered to block. That's the problem. A blocking order only hurts as much as the resolver it lands on is used, so every operator that shuts down and sends its users to Quad9 makes the next order a better deal for whoever files it.

nullmatrix 2 hours ago

[flagged]