Mullvad public DNS shuts down on 2 November: what to check now

Cover: AI-generated editorial illustration, not an event photograph or product screenshot.

Users who manually configured Mullvad’s public encrypted DNS should review that setting before 2 November 2026. Mullvad announced the shutdown on 3 September and is supporting Quad9 instead. This is a deadline reminder, not a new shutdown announcement. It concerns the public DNS service; it does not mean Mullvad VPN is closing.

The immediate question is where the old configuration lives: a browser, an Apple configuration profile, a router, or another device. Changing the wrong setting can leave the actual dependency untouched. For readers who installed a privacy tool months ago and then forgot about it, this is a useful moment to record which service performs each job.

Who needs to act before 2 November?

According to Mullvad’s dated announcement, manual users should move before the November deadline. Default and included ad-blocking DNS choices in Mullvad Browser will migrate automatically; customized choices will not be overwritten. Existing Mullvad DNS profiles on iOS and macOS need replacement. Those distinctions matter more than whether someone happens to have a paid VPN subscription.

Start by identifying the device and application affected. A household may have one browser using its own resolver while other applications follow the operating system. A router can provide a third configuration layer. An inventory need not be elaborate: device, setting location, current provider and date reviewed are enough to make the change traceable.

Public DNS and VPN-internal DNS perform different roles

Mullvad says its VPN already uses internal DNS inside the encrypted connection. The public resolver serves users outside that arrangement, including browser users. Its announcement also supplies a useful historical detail: the public encrypted service has operated since 2022. The company describes its decision as supporting a specialist rather than continuing to run a parallel public service.

A VPN and encrypted DNS should therefore be assessed separately. DNS resolves names into the information an application needs to reach a destination. A VPN establishes a traffic path through another network endpoint. Our explanation of how a VPN works provides the broader context. The practical lesson is to document which component controls name resolution, instead of assuming that installing several privacy products automatically combines every advertised protection.

Which Quad9 service should you select?

Quad9’s official service table distinguishes threat-blocking and non-blocking variants, with additional ECS choices. The familiar 9.9.9.9 service includes threat blocking. Its documented encrypted endpoints are dns.quad9.net for DNS over TLS and https://dns.quad9.net/dns-query for DNS over HTTPS. The table also lists IPv4 and IPv6 addresses.

Use the format requested by the setting you are editing. An address field, a hostname field and a full HTTPS endpoint field are different inputs. Copying a correct value into the wrong kind of field is still a configuration error. Follow the current official instructions for that platform and selected service, rather than copying an isolated screenshot from an older tutorial.

Quad9’s documentation overview describes support for DoH, DoT and DNSCrypt and explains its nonprofit operating model. Its privacy statements are the provider’s published commitments; this article does not independently audit them or measure resolver speed. Choose a resolver with an understanding of its operating policy as well as the technical transport it supports.

Apple profiles require an extra compatibility check

The official iOS instructions warn that most VPN clients, iCloud Private Relay and some network software do not follow the installed DNS profile. A profile can therefore be present without controlling the connection you are testing. Quad9 directs VPN users toward the VPN client’s own supported custom-DNS settings and documentation.

The same principle appears in the macOS guide. Check the intended setup before installing a replacement profile. A work-managed device may also have configuration controlled by its administrator; changing a personal setting is not evidence that the managed policy has changed. Our Apple VPN guide can help frame the device questions, while the vendor’s current instructions remain the source for installation steps.

Another useful detail is profile lifetime. At the time of checking, Quad9’s Apple guides give an expiry date of 19 January 2027 for the profiles they describe. A successful installation today is not a promise of permanent operation. Record the expiry shown by the profile you actually obtain and recheck the official download page near that date. We have not installed a profile on readers’ devices or verified their individual settings.

A cautious migration checklist

1. Find the existing dependency. Review the browser’s secure-DNS selection, installed system profiles and any router configuration you maintain. Note where a custom Mullvad endpoint appears.
2. Record the current setup. Keep a local note of the setting location and previous choice so you can diagnose problems without guessing. Do not publish screenshots containing account details or network credentials.
3. Choose the replacement deliberately. Decide which documented Quad9 variant fits the intended policy. Use the platform-specific instructions, including any interaction with a VPN or Private Relay.
4. Verify the intended connection path. Check the browser and operating-system context you changed. Quad9’s guides link to its resolver-check page; a result from one application does not describe every application on the device.
5. Keep a maintenance note. Save the review date, official documentation link and any profile expiry. This turns a one-off fix into a configuration you can revisit.

If browsing fails after a change, avoid changing several unrelated options at once. Identify whether the failure follows a particular browser, network or device. Compare the symptoms with the documented configuration and seek the relevant provider’s support if needed. Our VPN troubleshooting guide offers a structured starting point; it should not be used to assume that every connection failure is a VPN fault.

Does this require buying a new VPN?

No purchase is required merely to replace a public resolver configuration. Quad9 documents public DNS services, while a paid VPN subscription is a separate buying decision. Readers reviewing their wider setup can consult the Mullvad store’s recorded subscription terms or our VPN plan comparison. Those pages help compare billing commitments; they do not establish that an unrelated subscription fixes a DNS configuration.

The practical priority this week is continuity: identify an old manual dependency and replace it before the published deadline. Default browser migration and manual device configuration follow different paths. Taking a few minutes to distinguish them is more useful than adding another product without understanding which setting it controls.

Sources and verification scope

Sources were checked on 26 October 2026. The shutdown date and migration scope come from Mullvad’s 3 September announcement. Resolver variants, Apple compatibility limits and profile dates come from Quad9’s current documentation. This is original explanatory analysis, not a hands-on DNS benchmark, independent privacy audit or evidence that the scheduled shutdown has already happened.