DNS Speed Test

What Is Mullvad DNS

Mullvad DNS is a public recursive DNS resolver operated by Mullvad AB, a Swedish privacy company that has been running a commercial VPN service since 2009. Unlike the major DNS providers — Google, Cloudflare, OpenDNS — Mullvad's DNS resolver exists primarily to support its privacy-first VPN product, not as a standalone advertising or data collection platform. The DNS service launched alongside Mullvad's VPN and has since become available to anyone, even users who do not subscribe to the VPN.

The core pitch is straightforward: Mullvad DNS resolves domain names quickly and does not log what you ask it. There is no analytics dashboard, no query history, no email-based account system. Mullvad does not even know how many people use its DNS resolver because it does not track usage. The company does not ask for your email address, phone number, or payment information to use the VPN either — you get a randomly generated account number and that is the entire identity system.

For users who care about privacy but also need acceptable performance, Mullvad DNS occupies an interesting niche. It is not the fastest resolver on the market — Cloudflare and Google hold that title — but it is significantly faster than many privacy-oriented alternatives, and it does not compromise on its no-logging commitment. The trade-off is a smaller server footprint and no anycast network of the scale that Cloudflare or Google operate.

The service supports DNS-over-HTTPS (DoH), DNS-over-TLS (DoT), and DNS-over-QUIC (DoQ) protocols, which means your DNS queries are encrypted in transit regardless of which protocol your device or network supports. It also offers an ad-blocking DNS variant that filters known advertising and tracking domains at the resolver level, similar to what AdGuard DNS and NextDNS provide.

Speed Benchmarks and Performance

We tested Mullvad DNS against seven other major public resolvers from locations across North America, Europe, Asia-Pacific, and Africa. Each test used DNS-over-HTTPS queries against popular domains, with 50 queries per resolver per location. The numbers below represent average response times.

Mullvad DNS shines in Europe, where its Stockholm-based infrastructure delivers sub-10-millisecond response times. In London and Frankfurt, Mullvad matches or beats most competitors. The reason is geographic proximity — Mullvad's resolver nodes are concentrated in Northern Europe, and European users benefit from short physical paths to those servers.

Outside Europe, the picture changes. In North America, Mullvad averages 18 milliseconds from New York, which is competitive but roughly 10 milliseconds behind Cloudflare. The gap widens in the Asia-Pacific region — Tokyo at 26 ms, Sydney at 32 ms — because Mullvad does not operate resolver infrastructure in those regions. Queries from these locations must route back to European servers, adding transit time.

The performance profile matters for practical browsing. A typical modern webpage triggers 20-40 DNS lookups during initial load. At 18 ms average (Mullvad from New York), that translates to roughly 360-720 milliseconds of cumulative DNS time. At 8 ms (Cloudflare from New York), the same page load incurs 160-320 milliseconds. The difference of 200-400 milliseconds is noticeable on fast connections but mostly disappears on slower networks where the DNS time is a smaller fraction of total page load.

For European users, Mullvad DNS is effectively on par with the fastest public resolvers. For users in North America, it is a solid second-tier option. For users in Asia-Pacific or South America, Cloudflare or Google will deliver better raw speed — but speed is not the only factor when choosing a DNS resolver, as the privacy sections below explain.

Privacy: No Logs, No BS

Mullvad DNS operates under the same privacy philosophy as the Mullvad VPN: collect nothing, log nothing, retain nothing. When your device sends a DNS query to Mullvad's resolver, the resolver processes the query, returns the answer, and discards the transaction data. There is no query log, no source IP record, no timestamp database, no analytics pipeline.

This is not a marketing claim — it is verifiable. Mullvad has engaged Assured AB (now part of Truesec Group), a Swedish cybersecurity firm, to perform independent audits of both its VPN and DNS infrastructure. The audit reports confirm that no user activity data is collected or stored. Mullvad also publishes transparency reports when compelled to respond to legal requests, and in each case the company has been able to confirm that it holds no user data to surrender.

Compare this to Google Public DNS, which retains anonymized query logs for 24 to 48 hours. Google strips IP addresses from the logs after that window, but the query data (which domains were resolved, when, and from which network range) exists in identifiable form during that period. Cloudflare purges logs within 24 hours and engages KPMG for annual audits, which is stronger than Google but still involves short-term retention. Mullvad retains nothing.

The practical implication is that Mullvad DNS cannot comply with a data request even if it wanted to. There is no data to hand over. For journalists, activists, privacy-conscious individuals, or anyone who simply prefers not to have their browsing history stored by a corporation, this is a meaningful distinction.

One caveat worth noting: DNS encryption (DoH, DoT) protects your queries in transit — between your device and Mullvad's resolver. The resolver itself must decrypt the query to process it, so Mullvad can technically see what domain you are asking about at the moment of resolution. The no-logging policy means they choose not to record that information. If you need end-to-end encryption where even the resolver cannot see your queries, no public DNS service currently offers that — you would need a recursive resolver running locally on your own device.

Swedish Jurisdiction and Legal Framework

Mullvad AB is incorporated in Sweden and subject to Swedish law. This matters for several reasons. Sweden is a member of the European Union, which means Mullvad falls under the General Data Protection Regulation (GDPR). GDPR requires explicit consent for data collection, mandates data minimization, and gives users the right to request deletion of their data. For a company that already collects nothing, GDPR compliance is straightforward — but the regulatory framework provides an additional layer of legal accountability.

Sweden is not part of the Five Eyes intelligence-sharing alliance (USA, UK, Canada, Australia, New Zealand). It is not part of the Fourteen Eyes group either. Sweden does participate in some intelligence cooperation agreements, but it does not have the same mass surveillance infrastructure that characterizes Five Eyes nations. The Swedish legal framework requires specific court orders for surveillance, and the bar for obtaining such orders is higher than in many other jurisdictions.

For comparison, Cloudflare is headquartered in the United States and subject to FISA orders and National Security Letters, which can compel data disclosure with gag orders that prevent the company from acknowledging the request. Google operates under similar US jurisdiction. Quad9 is based in Switzerland, which provides strong privacy protections but is part of the broader European intelligence cooperation framework. Mullvad's Swedish jurisdiction sits in a middle ground — not the strongest possible privacy jurisdiction (that would be Iceland or Panama for VPN companies), but significantly stronger than US-based providers.

The practical effect for DNS users is this: if a government agency wanted to compel Mullvad to start logging DNS queries, the Swedish legal system would require a specific legal basis, and Mullvad would have the opportunity to challenge the request in court. More importantly, since Mullvad currently logs nothing, there is no existing data to retroactively access — any surveillance order would require prospective data collection, which raises additional legal hurdles under GDPR.

DoH, DoT, and DoQ Support

Mullvad supports all three major encrypted DNS protocols, giving you flexibility regardless of your device, browser, or network restrictions.

DNS-over-HTTPS (DoH)

Mullvad's DoH endpoint is https://dns.mullvad.net/dns-query. DoH wraps DNS queries inside standard HTTPS traffic on port 443, making your DNS lookups indistinguishable from regular web browsing. This is the most firewall-friendly encrypted DNS protocol because port 443 is rarely blocked — blocking it would break most of the modern web. All major browsers support DoH natively: Chrome, Firefox, Edge, Brave, and Opera.

DNS-over-TLS (DoT)

Mullvad's DoT hostname is dns.mullvad.net, running on port 853. DoT encrypts DNS queries using TLS but uses a dedicated port rather than sharing port 443 with HTTPS traffic. This makes DoT easier for network administrators to identify and manage, but also means restrictive networks can block it more easily by simply filtering port 853. DoT is well-suited for Android's Private DNS setting and for Linux systems using systemd-resolved.

DNS-over-QUIC (DoQ)

Mullvad supports DoQ at dns.mullvad.net on port 784. DoQ uses the QUIC transport protocol, which combines the transport and cryptographic handshakes into a single round trip. This eliminates the connection setup overhead of traditional TLS, reducing latency by 1-2 milliseconds on each query. Android 14 and later support DoQ natively, and browser support is growing.

All three protocols use TLS 1.3, which is the latest and most secure version of the TLS protocol. TLS 1.3 removes legacy cipher suites, reduces the handshake to a single round trip, and provides forward secrecy by default — meaning that even if Mullvad's private key were compromised in the future, past sessions could not be decrypted.

Ad Blocking and Content Filtering

Mullvad provides two DNS resolver variants with built-in content filtering. These work by maintaining blocklists of known advertising, tracking, and malicious domains. When your device tries to resolve a domain on the blocklist, the Mullvad resolver returns a NXDOMAIN response (domain not found) instead of the real IP address, preventing the connection from ever being established.

Mullvad DNS (Ad Blocking)

Endpoint: dns.mullvad.net for DoH and DoT. This blocks known advertising and tracking domains across the web. The blocklists are sourced from community-maintained filter lists and Mullvad's own curation. The blocking is lighter than dedicated ad-blocking services like AdGuard — it focuses on known tracker networks and major ad platforms rather than attempting to block every possible advertisement on every page.

Mullvad DNS (Family Friendly)

Endpoint: adblock.dns.mullvad.net. This adds adult content filtering on top of the standard ad and tracker blocking. It is designed for networks where children have access, providing DNS-level content filtering that works across all devices — including smart TVs, game consoles, and IoT hardware that do not support browser extensions or parental control software.

The limitation of DNS-level ad blocking is the same as any resolver-based filtering: it only works at the domain level. If an advertisement is served from the same domain as the content you want to visit, DNS blocking cannot distinguish between them. Modern CDNs and ad platforms increasingly serve ads from first-party domains, which reduces the effectiveness of DNS-level blocking compared to browser-based ad blockers like uBlock Origin. For comprehensive ad blocking, DNS filtering works best as a first layer combined with a browser extension.

Mullvad VPN Integration

Mullvad DNS is tightly integrated with the Mullvad VPN application. When you connect to Mullvad VPN, all DNS queries are automatically routed through Mullvad's DNS resolver over an encrypted tunnel. This means your DNS queries are protected by two layers of encryption: the VPN tunnel itself, and the DoH/DoT encryption on the DNS protocol.

The VPN integration removes the need to manually configure DNS settings on your device. When the Mullvad app is connected, it handles DNS resolution transparently. When the app is disconnected, your device reverts to whatever DNS resolver is configured at the system level. This is a common pattern among VPN providers, but Mullvad's implementation is notable for its simplicity — there are no complex settings to configure, no DNS leak protection toggles to worry about, and no conditional access rules.

For users who want the privacy of Mullvad DNS without the full VPN, the standalone DNS configuration described in the setup section below works independently. You do not need a Mullvad VPN subscription to use the DNS resolver. The DNS service is free and has no connection to your VPN account.

One practical consideration: when using Mullvad VPN, the DNS resolver sees your VPN exit node IP rather than your real IP. This means the DNS queries are already anonymized at the network level, and the no-logging policy provides an additional layer of protection. If you use Mullvad DNS without the VPN, your real IP address is visible to the resolver (though Mullvad does not log it). For maximum privacy, combine both.

Setup Guide for All Platforms

Configuring Mullvad DNS takes under two minutes on any device. The instructions below cover every major operating system and browser.

Windows 11

Open Settings, go to Network & Internet, and select your active connection (Wi-Fi or Ethernet). Click Properties, find DNS server assignment, and click Edit. Choose Manual, enable IPv4, and enter the Mullvad DNS IP address. For encrypted DNS, select Encrypted only (DNS over HTTPS) from the dropdown. Windows 11 has built-in DoH templates — if Mullvad is not listed, choose Custom and enter https://dns.mullvad.net/dns-query. Click Save.

macOS

Open System Settings, go to Network, and select your active connection. Click Details, then go to the DNS tab. Click the plus button under DNS Servers and add Mullvad's DNS IP. Click OK to apply. For DoH on macOS Ventura and later, the system may attempt encrypted DNS automatically when the server supports it. For more control, configure DoH in your browser settings.

Android

Go to Settings, then Network & Internet (or Connections), then Private DNS. Select Private DNS provider hostname and enter dns.mullvad.net. This enables DNS over TLS system-wide. Android 14 and later also support DoQ if you configure it through a compatible app.

iOS

iOS does not have a built-in system-wide DoH setting. The simplest approach is to install the Mullvad VPN app from the App Store, which configures DNS automatically when connected. For standalone DNS without the VPN, configure DoH in your browser — Safari does not support custom DoH endpoints, but Chrome and Firefox for iOS do.

Linux (systemd-resolved)

Edit /etc/systemd/resolved.conf and set DNSOverTLS=yes under the [Resolve] section, then set the DNS server to Mullvad's address. Restart the service with sudo systemctl restart systemd-resolved. For DoH, use a dedicated resolver like dnscrypt-proxy or odoh-client configured to point at Mullvad's DoH endpoint.

Routers

Log in to your router's admin interface (usually 192.168.1.1 or 192.168.0.1). Find the DNS settings under WAN, Internet, or DHCP. Replace the existing DNS servers with Mullvad's DNS addresses. Save and restart the router. Every device on the network will now use Mullvad DNS automatically.

Google Chrome

Open Settings, go to Privacy and Security, click Security, and under Advanced find Use secure DNS. Toggle it on, select Custom, and enter https://dns.mullvad.net/dns-query. Chrome will route all DNS queries through Mullvad DoH regardless of your system DNS settings.

Mozilla Firefox

Open Settings, go to Privacy & Security, scroll to DNS over HTTPS, and select Max Protection. Choose Custom from the provider dropdown and enter https://dns.mullvad.net/dns-query. Firefox handles DoH independently of the operating system, so this works even if your system DNS is set to something else.

Frequently Asked Questions

Related Reading

• DNS Speed Test — Benchmark 17+ Resolvers
• Fastest DNS Servers — Global Benchmarks
• DNS Providers Comparison
• Best DNS Servers for Privacy

Test Your DNS Speed

Find out whether Mullvad DNS is actually the fastest resolver from your network. Our DNS speed test benchmarks 17+ servers using real DNS-over-HTTPS queries and measures actual response times from your location. The results will show you exactly how dns.mullvad.net compares to other resolvers on your specific connection.

Run DNS Speed Test