Our public encrypted DNS service uses DNS over HTTPS (DoH) and DNS over TLS (DoT). This protects your DNS queries from being snooped on by third parties when not connected to our VPN service as your DNS queries are encrypted between your device and our DNS server.
This service is primarily meant to be used when you are disconnected from our VPN service , or on devices where it's not possible or desirable to connect to the VPN. When you are already connected to our VPN service the security benefits of using encrypted DNS is negligible and it will always be slower than using the DNS resolver on the VPN server that you are connected to.
You can use this privacy-enhancing service even if you are not a Mullvad customer.
What this guide covers
Mullvad encrypted DNS service features
How to use this service Web browsers Mobile device operating systems Android iOS / iPadOS Desktop operating systems Windows 11 macOS Linux
Mobile device operating systems Android iOS / iPadOS
Desktop operating systems Windows 11 macOS Linux
How do I know it’s working?
How the content blocking works
Mullvad encrypted DNS service features
This service provides encrypted DNS queries with the following features:
Content blocking : We provide basic content blocking options to block ads, trackers, malware, adult content, gambling and social media.
QNAME minimization : This enables our DNS servers to resolve your queries while giving it as little information as possible the queries to other DNS servers involved in the resolving process.
A limited DNS resolver is listening on port UDP/TCP 53 only to aid with resolving hostnames related to this service (dns.mullvad.net, adblock.mullvad.net and so on) so that clients can first resolve the IP of the resolver before querying it over encrypted DNS.
Wikipedia: DNS over TLS
Wikipedia: DNS over HTTPS
Hostnames and content blockers
The table below shows the different hostname options and their content blockers. Refer to this when configuring the DNS with the instructions below.
IP-addresses and ports
The table below shows the IP-addresses that you need to configure some DNS resolvers.
These IPs can only be used with DNS resolvers that support DoH or DoT, not with DNS over UDP/53 or TCP/53.
How to use this service
Below you can find configuration instructions for different web browsers and operating systems.
The Mullvad Browser uses the Mullvad DNS service (without content blockers) by default. We recommend that you use our encrypted DNS service only when you are not connected to Mullvad VPN. When you are connected to Mullvad VPN the DNS queries will be sent through the encrypted VPN tunnel to the DNS server on the Mullvad VPN server that you are connected to, and that is faster.
Turning off DNS over HTTPS (when using Mullvad VPN)
Click on the button in the top right corner and select Settings .
Click on Privacy & Security in the left column.
Scroll down to the bottom.
Under Enable secure DNS using select Off .
Turning on DNS over HTTPS (when not using Mullvad VPN)
The first two DNS options above are included in the browser settings. To change it to one of the other options, follow these instructions:
Click on the button in the top right corner and select Settings .
Click on Privacy & Security in the left column.
Scroll down to the bottom.
Under Enable secure DNS using select Max Protection .
Under Choose provider click on the drop down list and select Custom .
In the text field that appears, paste one of the following, then press Enter on your keyboard to set it.
Firefox (desktop version)
Click on the button in the top right corner and select Settings .
Click on Privacy & Security in the left column.
Scroll down to the bottom.
Under Enable secure DNS using select Max Protection .
Under Choose provider click on the drop down list and select Custom .
In the text field that appears, paste one of the following, then press Enter on your keyboard to set it.
Chrome / Brave / Edge
Click on Privacy and security (in Chrome, Brave) or Privacy, , and services (in Edge).
Click on Security (in Chrome, Brave).
Enable Use secure DNS .
Select With: Custom (in Chrome, Brave) or Choose a service provider (in Edge).
Enter one of the following and press Tab on the keyboard:
If it says "Please verify that this is a valid provider or try again later" then wait a moment.
Mobile device operating systems
Follow these steps to use DNS over TLS:
Open the Android Settings app.
Tap on Network & internet .
Select Private DNS provider hostname .
On the input line, enter one of these: dns.mullvad.net adblock.dns.mullvad.net base.dns.mullvad.net extended.dns.mullvad.net family.dns.mullvad.net all.dns.mullvad.net
If Android is unable to connect to the DNS then the DNS server that you are routed to is likely too far away and the latency is prohibitive. In this case it will not work.
We provide DNS configuration profiles for Apple devices.
Note: If you have enabled iCloud Private Relay then the DNS queries may go to DNS servers provided by Apple even if you use our DNS profile.
Open Safari and go to our GitHub repository.
Tap on for example base .
The profiles are available in two versions (DoH and DoT). Tap on either one.
Tap on Allow to download the profile.
Open the Files app and tap on the downloaded profile. It should say "Profile Downloaded". If it shows the text contents of the file instead then do this: a) In the Files app, long press (tap and hold down your finger) on the DNS profile. b) Tap on Open With . c) Tap on Preview with Quick Look . This will remove the checkmark so it will not use Quick Look for this file type. d) Tap one time on the DNS profile and it should say "Profile Downloaded".
Open the Settings app.
Scroll to the top and tap on Profile Downloaded .
Enter your iPhone/iPad passcode.
You can then view, change and remove installed configuration profiles in the Settings app in General > VPN & Device Management .
Desktop operating systems
Note: This is not available in Windows 10 and some VMs may not be able to use it.
Open the Settings app.
Click on Network & internet in the left side.
Click on Wi-Fi or Ethernet depending on which one you use. You can tell by the icon in the top which says "🌐 Connected".
If you clicked on Wi-Fi then click on Hardware properties and proceed to the step. If you clicked on Ethernet then just proceed to the step.
Click on the Edit button to DNS server assignment .
Select Manual in the drop-down list.
In the Preferred DNS field, enter the IP address for the DNS option that you want to use, for example 194.242.2.4 . 194.242.2.2 - 194.242.2.3 - 194.242.2.4 - 194.242.2.5 - 194.242.2.6 - 194.242.2.9 -
Under DNS over HTTPS , select On (manual template) in the drop-down list.
Under DNS over HTTPS template enter the address to the IP that you selected before, for example .
Check in the network details in the same window if you get an IPv6 address from your Internet provider. In that case click on the Edit button to DNS server assignment again.
Scroll down to the bottom and enable IPv6 .
Scroll down again and in the Preferred DNS field, enter the IPv6 address for the DNS option that you want to use, for example 2a07:e340::4 . 2a07:e340::2 - 2a07:e340::3 - 2a07:e340::4 - 2a07:e340::5 - 2a07:e340::6 - 2a07:e340::9 -
Under DNS over HTTPS , select On (manual template) in the drop-down list.
Under DNS over HTTPS template enter the address to the IP that you selected, for example .
If you sometimes use Wi-Fi and sometimes use Ethernet then go back to step 1 and add the same settings for the other network. Otherwise make sure that the other network is disconnected completely to prevent Windows from using the DNS from that.
Open Safari and go to our GitHub repository.
Click on for example base .
The profiles are available in two versions (DoH and DoT). Click on either one.
Click on View raw . The profile is then downloaded.
Open the System Settings app.
Click on Profile Downloaded in the left column in the top under your username.
Double-click on the downloaded profile.
Click on Install... in the bottom left corner.
Enter your macOS login password and click on OK .
You can view and remove installed configuration profiles in General > Device Management .
Open Safari and go to our GitHub repository.
Click on for example base .
The profiles are available in two versions (DoH and DoT). Click on either one.
Click on Allow to download the profile.
Open the System Settings app.
In the left column, click on Privacy & Security .
On the right side, scroll to the bottom and click on Profiles .
Double-click on the Mullvad Encrypted DNS profile that you downloaded.
In the bottom left corner, click on Install...
Enter your macOS login password and click on OK .
You can view and remove installed configuration profiles in Privacy & Security > Profiles .
For older versions, refer to the macOS User Guide .
You can select DNS profiles in the System Settings app in Network > VPN & Filters in the Filters & Proxies section.
In macOS 13 and earlier it's recommended to only install one profile since having multiple profiles does not work well.
Chrome / Brave / Edge :
The DNS profile works right away in Safari and Firefox, however if you are using Chromium based browsers such as Chrome, Brave or Edge then they will not use the DNS profile unless you disable the built in browser DNS client. Open the Terminal and run the following commands:
Linux (Ubuntu and Fedora)
These instructions use systemd-resolved .
Make sure that systemd-resolved is enabled by running this command: sudo systemctl enable systemd-resolved
Open the Settings app and go to Network. Click on the settings icon for your connected network. On the IPv4 and IPv6 tabs, turn off Automatic using the radio button to DNS , and leave the DNS field blank, then click on Apply . Disable and enable the network using the on/off button to make sure it takes effect.
Edit the following file with nano or your favorite text editor: Fedora: First copy the config file: cp /usr/lib/systemd/resolved.conf /etc/systemd/ and then edit it: sudo nano /etc/systemd/resolved.conf Ubuntu: Edit the existing config file: sudo nano /etc/systemd/resolved.conf Add the following lines in the bottom under [Resolve]. Remove one # from the beginning of a line with the DNS option that you want to use: #DNS=194.242.2.2#dns.mullvad.net #DNS=194.242.2.3#adblock.dns.mullvad.net #DNS=194.242.2.4#base.dns.mullvad.net #DNS=194.242.2.5#extended.dns.mullvad.net #DNS=194.242.2.6#family.dns.mullvad.net #DNS=194.242.2.9#all.dns.mullvad.net DNSSEC=no DNSOverTLS=yes Domains=~.
Save the file by pressing Ctrl + O and then Enter, and then Ctrl +X on your keyboard.
Create a symbolic link to make sure that /etc/resolv.conf uses systemd-resolved: sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
Restart systemd-resolved by running this command: sudo systemctl restart systemd-resolved
Restart NetworkManager with this command: sudo systemctl restart NetworkManager
Verify the DNS settings with: resolvectl status (it should show the Mullvad DNS under Global > Current DNS Server)
In case it doesn't work, change to this setting in/etc/systemd/resolved.conf:
DNSOverTLS=opportunistic
Note that you can enable DNSSEC if you want, however some websites with incorrect DNSSEC information will not be able to load and the web browser will not tell you why.
How do I know it’s working?
After you have followed the instructions above, go to . You should have no DNS leaks. Click on “No DNS leaks” for details; the server that is listed should have “dns” in its name, for example “se-mma- dns -001.mullvad.net”.
We use anycast routing which means that ideally the nearest DNS server should be used. If one server is down, the -closest should be used and so on. Keep in mind that nearest is in terms of networking hops, this can differ between your ISP and their connectivity to our hosting providers. You can check which DNS server you are using by expanding the DNS box in our Connection check .
Using a specific DNS server
If you do not require any DNS content blocker, just an unfiltered DNS, then you can use one of the server names below.
How the content blocking works
Mullvad curates a collection of "theme" lists whose content is sourced from publicly available block lists. When the client queries for a hostname that matches an item in the block list our resolver simply lies to the client and says that the hostname does not exist.
This means that whatever content was attempted to be loaded by the browser is not loaded and is therefore not shown on the screen.
For more information on which domains are blocked by which lists and which community lists make up the curated Mullvad lists please see our GitHub .
DNS content blocking can not block all ads and trackers. For example it can not block YouTube ads. To block more ads and trackers in your web browser we recommend using the uBlock Origin extension. This is included in the Mullvad Browser .
Earlier versions of this guide contained references to doh.mullvad.net and dot.mullvad.net. These hostnames has been replaced with the common dns.mullvad.net hostname and are subject to future deprecation. We urge all users to use the new hostnames that include dns.mullvad.net.
The following IPs are not used anymore: 193.19.108.2 and 193.19.108.3.
If you enable the use of our SOCKS5 proxy in Firefox and enable the setting Proxy DNS when using SOCKS v5 then the DNS queries will not use the public encrypted DNS service and the DNS content blockers won't work. Our SOCKS5 proxy only works when you are connected to Mullvad, and we recommend that you don't use the the public DNS service when you are connected to Mullvad, for reasons stated above . Instead you can enable the DNS content blockers in the Mullvad app settings.
We have Mullvad DNS servers in different locations to provide redundancy. The DNS service uses an anycast IP address which uses BGP (Border Gateway Protocol) to decide to which DNS server it sends the queries. This is managed by the Internet provider that you are using (or if you use a VPN, the ISP for the VPN server) and they sometimes decide to send it to a server in a different continent. This can make the DNS queries slow or time out completely. Android is particularly sensitive and it can just give up if the latency is too high.
This is why we recommend that you do not use the public encrypted DNS service when you are connected to Mullvad VPN. It is faster to use the DNS on the WireGuard server.
It is possible to use a specific DNS server (without anycast), however only without any DNS content blockers.
You can see which specific Mullvad DNS server you are using in the DNS box in our Connection check .
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
