Shared Hosting 
WordPress Hosting 
VPS Hosting 
Dedicated Servers 
Mullvad scheduled its public encrypted DNS service to be discontinued on 2 November 2026. It announced the change in September, said it would sponsor the Swiss nonprofit Quad9 instead, and told anyone who had typed Mullvad's resolver into a phone, router or browser to switch before the deadline. If that was you, you need a new privacy DNS resolver, and it is worth choosing one on evidence rather than habit.
Every website, app and update check starts with a DNS lookup. Whoever answers those lookups sees a running list of the names you look up, from which address, and when. This guide compares the main privacy DNS servers and public resolvers on what their own policies say they keep, and covers running your own resolver on a VPS. Every claim below comes from the provider's own pages, listed at the end.
The short version
For most people, Quad9 is the privacy DNS choice: a Swiss nonprofit whose privacy policy says it does not collect or record IP addresses, and the service Mullvad now funds. Cloudflare's 1.1.1.1 is fast and audited, but it is a US company that keeps a truncated IP for up to 25 hours. AdGuard DNS adds ad blocking. DNS4EU gives you an EU-run option with an unfiltered tier. Google Public DNS keeps your full IP for 24 to 48 hours, so it is the baseline to move away from, not towards.
What a DNS resolver can see
When you type a site name, your device asks a resolver for its IP address. The resolver sees the name you asked for, the IP address the question came from, and the time. Over a day, that adds up to a fairly complete picture of what you do online, even if every website you visit uses HTTPS.
Encrypted DNS, either DNS over HTTPS (DoH) or DNS over TLS (DoT), stops your internet provider and anyone else on the network from reading or tampering with those lookups on the way. It does not hide them from the resolver itself, which has to read the question to answer it. That is why the resolver's own logging policy matters more than whether it supports encryption. Encrypted DNS also does not hide everything from your provider: in most connections the site name is still visible in the TLS handshake unless Encrypted Client Hello (ECH) is in use.
Privacy DNS resolvers at a glance
| Resolver | Operator | Your IP address | What is kept | Filtering |
|---|---|---|---|---|
| Quad9 9.9.9.9 |
Quad9 Foundation, Zurich, Switzerland (nonprofit) | Not collected or recorded; held in RAM only while answering | No user-identifiable per-query logs; aggregate and query-label counters without user IP addresses | Malware and phishing blocking |
| Cloudflare 1.1.1.1 |
Cloudflare, United States | Truncated, then deleted within 25 hours | Resolver logs deleted within 25 hours; aggregated data kept indefinitely | None on 1.1.1.1 |
| AdGuard DNS 94.140.14.14 |
Adguard Software Limited, Cyprus | Says it does not process personal data on public servers | Anonymous list of domains requested in the last 24 hours; aggregate metrics | Ads and trackers |
| DNS4EU 86.54.11.100 (unfiltered) |
Consortium led by Whalebone, Czech Republic; EU co-funded | Fully anonymised before being logged, according to DNS4EU | Resolver data under its Public Resolvers Policy; no private user data, according to DNS4EU | Optional: protective, child, ad-blocking or unfiltered |
| Google Public DNS 8.8.8.8 |
Google, United States | Full IP in temporary logs, deleted within 24 to 48 hours (longer for security and abuse) | Sampled permanent logs with city or region location | None |
| Mullvad DNS | Mullvad, Sweden | Public encrypted DNS scheduled to be discontinued on 2 November 2026. Mullvad recommends Quad9 and is sponsoring it | ||
Each privacy DNS resolver in detail
Best for most peopleQuad9
Quad9 is run by a nonprofit foundation in Zurich, and its privacy policy names the Swiss Federal Data Protection and Information Commissioner as its supervisory authority. The policy says Quad9 does not collect or record IP addresses: source addresses are held in memory only while a query is answered and never written to permanent storage. What it keeps is aggregate, such as counters per queried name, the first and most recent time a name was seen, and how much traffic arrives from different networks, none of it tied to a user's IP address. Its standard addresses block domains its threat-intelligence partners flag as malicious.
Addresses: 9.9.9.9 and 149.112.112.112, IPv6 2620:fe::fe. Encrypted DNS: DoH, DoT and DNSCrypt. Worth knowing: Mullvad called the Quad9 Foundation "the undisputed leader in the field" when it chose to fund it rather than keep running its own service.
Fast and auditedCloudflare 1.1.1.1
Cloudflare's resolver policy says it truncates your IP address, deletes the truncated address and all resolver logs within 25 hours, never sells the data or uses it for advertising, and has its practices audited by one of the big four accounting firms. Two exceptions are written into the same page: randomly sampled packets from at most 0.05% of traffic, kept for troubleshooting and attack mitigation, and aggregated data kept indefinitely for Cloudflare Radar.
Addresses: 1.1.1.1 and 1.0.0.1. Encrypted DNS: DoH and DoT. Worth knowing: Cloudflare is a US company that also sits in front of a large share of the web. Our look at Cloudflare and privacy covers what that means.
Blocks adsAdGuard DNS
AdGuard's privacy policy says it does not process personal data when you use its public servers. It keeps an anonymous list of domains requested in the last 24 hours, which it says cannot be linked to the person who asked, plus aggregate counts used to tune its filters. The company is registered in Cyprus.
Address: 94.140.14.14. Worth knowing: the default servers block ads and trackers for every device on your network, which is the reason most people pick it.
EU-runDNS4EU
DNS4EU launched on 9 June 2025. It is run by a consortium from ten EU countries led by the Czech company Whalebone, was co-funded by the European Union, and says all resolution happens within the EU under GDPR. It says a client's IP address is fully anonymised before being logged on the resolver and that no private data is collected. It offers five variants, from a protective filter with optional child protection and ad blocking down to an unfiltered tier.
Unfiltered address: 86.54.11.100 (unfiltered.joindns4.eu). Encrypted DNS: DoH and DoT on every variant. Worth knowing: "unfiltered" does not mean nothing is ever blocked. DNS4EU says court-ordered domain blocks apply to every variant, including the unfiltered one, and it publishes a register of them.
BaselineGoogle Public DNS
Google's privacy page is clear about what it keeps. Temporary logs store your full IP address alongside your query and are deleted within 24 to 48 hours, though Google may keep information longer for security and abuse. A sample goes into permanent logs, with your IP replaced by a city or region-level location. Google says it does not link these logs to your other Google activity except for security and abuse. It is reliable, but it is not a privacy DNS choice, and it is the one to move away from.
Running your own privacy DNS resolver on a VPS
The alternative to trusting any public resolver is to run your own. A recursive resolver such as Unbound on a small VPS looks names up directly from the authoritative servers, so no third-party resolver ever sees your full list of lookups. Paired with a self-hosted VPN, every device you own can use it from anywhere.
It is worth being clear about the trade-off. A public resolver mixes your lookups in with millions of other people's. Your own resolver sends every lookup from one IP address that belongs to you, so the authoritative servers it talks to see that address, and the queries from your VPS to those servers are not encrypted. Self-hosting gives you control and removes the resolver company from the picture. It does not make you anonymous. A middle ground is to run Unbound locally and forward queries to Quad9 over DoT, a privacy DNS setup that keeps a local cache and blocklist while sending encrypted queries to a resolver that does not record IP addresses.
A 1.5 GB Packetra Cloud VPS is far more than a resolver needs, and leaves room for a VPN and other services alongside it. Our list of things to run on a VPS has more ideas, and if you want the server in Switzerland, our guide to Swiss data protection law explains what that changes.
How to switch to a privacy DNS resolver
- Android: open Settings, find Private DNS (usually under Network or Connections), choose the provider hostname option and enter dns.quad9.net or your chosen provider's DoT hostname.
- iPhone and Mac: install your provider's configuration profile. Mullvad says its old profiles stop working and should be replaced, and Quad9 publishes its own.
- Firefox: Settings, Privacy & Security, then DNS over HTTPS, and pick a provider or enter a custom address.
- Chrome: Settings, Privacy and security, Security, then Use secure DNS, and choose a provider.
- Router: set the resolver addresses in your router's DNS settings to cover every device at home. Many routers only accept plain DNS addresses, so the lookups leave your network unencrypted unless the router supports DoT.
If you use a VPN, its own DNS normally handles your lookups while it is connected. Mullvad gave that as one reason for closing its public service: its VPN's internal DNS already covers its users.
FAQ
What is the best privacy DNS server?
For most people, Quad9. Its privacy policy says it does not collect or record IP addresses, it is a Swiss nonprofit, and it blocks known malicious domains. If you want ads blocked as well, AdGuard DNS; if you want an EU-run service, DNS4EU's unfiltered tier.
What replaced Mullvad DNS?
Mullvad recommends Quad9 and says it will financially support it instead of running its own public resolver. Its public encrypted DNS was scheduled to be discontinued on 2 November 2026. DNS inside Mullvad VPN is not affected.
Is 1.1.1.1 private?
More private than most. Cloudflare says it deletes the truncated IP address and resolver logs within 25 hours and has the policy audited. It is still a US company and keeps aggregated data indefinitely.
Does a privacy DNS server hide my browsing from my internet provider?
With encrypted DNS, it hides your DNS lookups from your provider, but not from the resolver you send them to, and your provider can usually still see site names in the TLS handshake unless Encrypted Client Hello is in use. A VPN covers more.
Should I run my own DNS resolver?
If you want no third-party resolver to see your lookups and are comfortable maintaining a server, yes. Just remember that a self-hosted resolver gives you control, not anonymity, because every lookup comes from your own server's IP.
Sources
- Mullvad: Shutting down our public encrypted DNS servers and sponsoring Quad9 instead, 3 September 2026
- Mullvad: DNS over HTTPS and DNS over TLS (discontinuation notice)
- Quad9: Data and Privacy Policy
- Quad9: How Quad9 handles your data (2025)
- Cloudflare: 1.1.1.1 public DNS resolver privacy commitments
- AdGuard DNS: Privacy Policy, last updated 6 August 2024
- DNS4EU: Public service launched and DNS4EU for Public (logging, court-ordered blocks)
- Google Public DNS: Your Privacy
Last reviewed: 2 November 2026
Research note: Logging and retention details are taken from each provider's own policy pages as of the review date and can change. Packetra does not run a public DNS resolver, and none of the services listed here paid for inclusion. If anything here is out of date, tell us and we will correct it.
