🛡️ Free Premium DNS — Block Ads, Trackers & Malware at DNS Level

Tutorials & Methods
, ,
1

:locked: Mullvad Encrypted DNS — Premium Ad-Blocking DNS for Free

No subscription needed. No Mullvad account required. Just point your device at their servers and your DNS goes dark.

:world_map: What This Is

Mullvad runs a free encrypted DNS service with built-in content blocking. Your DNS queries get encrypted via DoH (DNS over HTTPS) or DoT (DNS over TLS) — meaning your ISP, network admin, or anyone snooping between you and the DNS server sees nothing.

The kicker? You don’t need to be a Mullvad customer to use it.

:shield: Pick Your Filter Level

6 Options — From Zero Blocking to Nuclear
Hostname Ads Trackers Malware Adult Gambling Social Media
dns.mullvad.net — — — — — —
adblock.dns.mullvad.net :white_check_mark: :white_check_mark: — — — —
base.dns.mullvad.net :white_check_mark: :white_check_mark: :white_check_mark: — — —
extended.dns.mullvad.net :white_check_mark: :white_check_mark: :white_check_mark: — — :white_check_mark:
family.dns.mullvad.net :white_check_mark: :white_check_mark: :white_check_mark: :white_check_mark: :white_check_mark: —
all.dns.mullvad.net :white_check_mark: :white_check_mark: :white_check_mark: :white_check_mark: :white_check_mark: :white_check_mark:

base is the sweet spot for most people — kills ads, trackers, and malware without breaking social media or anything else.

all is scorched earth. Everything blocked. Good for focus mode or kid-proofing a device.

:globe_showing_europe_africa: Server IPs

IPv4 & IPv6 — Copy What You Need
Hostname IPv4 IPv6 DoH Port DoT Port
dns.mullvad.net 194.242.2.2 2a07:e340::2 443 853
adblock.dns.mullvad.net 194.242.2.3 2a07:e340::3 443 853
base.dns.mullvad.net 194.242.2.4 2a07:e340::4 443 853
extended.dns.mullvad.net 194.242.2.5 2a07:e340::5 443 853
family.dns.mullvad.net 194.242.2.6 2a07:e340::6 443 853
all.dns.mullvad.net 194.242.2.9 2a07:e340::9 443 853

These IPs only work with DoH or DoT resolvers — not plain DNS over port 53.

:globe_with_meridians: Browser Setup

Firefox / Mullvad Browser
  1. Menu → Settings → Privacy & Security
  2. Scroll to the bottom → Enable secure DNS using → select Max Protection
  3. Choose provider → select Custom
  4. Paste one of these and press Enter:
https://dns.mullvad.net/dns-query
https://adblock.dns.mullvad.net/dns-query
https://base.dns.mullvad.net/dns-query
https://extended.dns.mullvad.net/dns-query
https://family.dns.mullvad.net/dns-query
https://all.dns.mullvad.net/dns-query

Mullvad Browser already uses dns.mullvad.net by default — only change it if you want content blocking.

Chrome / Brave / Edge
  1. Settings → Privacy and security (Chrome/Brave) or Privacy, search, and services (Edge)
  2. Click Security (Chrome/Brave)
  3. Enable Use secure DNS
  4. Select Custom (Chrome/Brave) or Choose a service provider (Edge)
  5. Enter one of these and press Tab:
https://dns.mullvad.net/dns-query
https://adblock.dns.mullvad.net/dns-query
https://base.dns.mullvad.net/dns-query
https://extended.dns.mullvad.net/dns-query
https://family.dns.mullvad.net/dns-query
https://all.dns.mullvad.net/dns-query

If it says “Please verify that this is a valid provider” — wait a moment, it resolves itself.

:mobile_phone: Mobile Setup

Android 9+
  1. Settings → Network & internet → Private DNS
  2. Select Private DNS provider hostname
  3. Enter one of these:
dns.mullvad.net
adblock.dns.mullvad.net
base.dns.mullvad.net
extended.dns.mullvad.net
family.dns.mullvad.net
all.dns.mullvad.net
  1. Tap Save

If it won’t connect — the nearest Mullvad DNS server is too far and latency is too high. Try a VPN to route closer.

iOS / iPadOS
  1. Open Safari → go to Mullvad’s GitHub DNS profiles
  2. Tap the filter level you want (e.g., base)
  3. Pick DoH or DoT version
  4. Tap View raw → Allow to download
  5. iOS 18: Open Files app → tap the downloaded profile
  6. Settings → Profile Downloaded → Install → enter passcode → Install → Done

Manage profiles later in Settings → General → VPN & Device Management.

:warning: If iCloud Private Relay is enabled, Apple may override your DNS profile.

:laptop: Desktop Setup

Windows 11
  1. Settings → Network & internet → Wi-Fi or Ethernet
  2. (Wi-Fi users: click Hardware properties first)
  3. Click Edit next to DNS server assignment → select Manual
  4. Enable IPv4 → enter the IP for your chosen filter:
Filter IPv4 DoH Template
None 194.242.2.2 https://dns.mullvad.net/dns-query
Adblock 194.242.2.3 https://adblock.dns.mullvad.net/dns-query
Base 194.242.2.4 https://base.dns.mullvad.net/dns-query
Extended 194.242.2.5 https://extended.dns.mullvad.net/dns-query
Family 194.242.2.6 https://family.dns.mullvad.net/dns-query
All 194.242.2.9 https://all.dns.mullvad.net/dns-query
  1. Under DNS over HTTPS → select On (manual template) → enter the matching DoH URL
  2. Click Save
  3. If you have IPv6 — repeat with the IPv6 address (e.g., 2a07:e340::4 for base)

:warning: Not available on Windows 10. Set up both Wi-Fi and Ethernet if you use both.

macOS

macOS 15+:

  1. Open Safari → go to Mullvad’s GitHub DNS profiles
  2. Click your filter level → pick DoH or DoT → View raw → downloads automatically
  3. System Settings → Profile Downloaded → double-click → Install → enter password

macOS 13–14:

  1. Same download steps as above
  2. System Settings → Privacy & Security → scroll to Profiles → double-click the profile → Install

Chromium browsers (Chrome/Brave/Edge) need an extra step — open Terminal and run:

defaults write com.google.Chrome BuiltInDnsClientEnabled -bool false
defaults write com.brave.Browser BuiltInDnsClientEnabled -bool false
defaults write com.microsoft.Edge BuiltInDnsClientEnabled -bool false

Safari and Firefox work immediately without this.

Linux (Ubuntu / Fedora)
  1. Enable systemd-resolved:
sudo systemctl enable systemd-resolved

  1. Settings → Network → your connection → IPv4/IPv6 tabs → turn off Automatic next to DNS → leave DNS field blank → Apply → toggle network off and on

  2. Edit the config:

# Ubuntu:
sudo nano /etc/systemd/resolved.conf

# Fedora (copy first):
cp /usr/lib/systemd/resolved.conf /etc/systemd/
sudo nano /etc/systemd/resolved.conf
  1. Add under [Resolve] — uncomment ONE DNS line:
#DNS=194.242.2.2#dns.mullvad.net
#DNS=194.242.2.3#adblock.dns.mullvad.net
#DNS=194.242.2.4#base.dns.mullvad.net
#DNS=194.242.2.5#extended.dns.mullvad.net
#DNS=194.242.2.6#family.dns.mullvad.net
#DNS=194.242.2.9#all.dns.mullvad.net
DNSSEC=no
DNSOverTLS=yes
Domains=~.
  1. Fix resolv.conf and restart:
sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
sudo systemctl restart systemd-resolved
sudo systemctl restart NetworkManager
  1. Verify:
resolvectl status

Should show Mullvad DNS under Global → Current DNS Server.

If it doesn’t work, try changing DNSOverTLS=yes to DNSOverTLS=opportunistic.

:globe_showing_europe_africa: Server Locations

Pick a Specific Server If You Want

Anycasted by default — routes you to the nearest server automatically. But if you want a specific one:

Server Country City
de-fra-dns-001.mullvad.net :germany: Germany Frankfurt
gb-lon-dns-001.mullvad.net :united_kingdom: UK London
gb-lon-dns-301.mullvad.net :united_kingdom: UK London
se-got-dns-001.mullvad.net :sweden: Sweden Göteborg
se-mma-dns-001.mullvad.net :sweden: Sweden Malmö
se-sto-dns-001.mullvad.net :sweden: Sweden Stockholm
sg-sin-dns-101.mullvad.net :singapore: Singapore Singapore
us-dal-dns-001.mullvad.net :united_states: USA Dallas
us-nyc-dns-601.mullvad.net :united_states: USA New York

Use format: https://[server]/dns-query

:white_check_mark: How to Verify It’s Working

Go to :backhand_index_pointing_right: mullvad.net/check

You should see no DNS leaks. Click “No DNS leaks” for details — the server listed should have “dns” in its name like se-mma-dns-001.mullvad.net.

:warning: Good to Know

A Few Things Before You Set and Forget

  • Already on Mullvad VPN? Don’t use this. Your DNS is already encrypted through the VPN tunnel and it’ll be faster than going through the public DNS service. Use the content blockers in the Mullvad app settings instead.

  • DNS can’t block everything. YouTube ads, for example, slip through because they come from the same domain as the videos. Pair this with uBlock Origin for full coverage.

  • Old hostnames deprecated. If you’re still using doh.mullvad.net or dot.mullvad.net — switch to the new dns.mullvad.net format. Old ones are getting retired.

  • Old IPs retired. 193.19.108.2 and 193.19.108.3 are no longer active.

  • SOCKS5 proxy users: If you enable Mullvad’s SOCKS5 proxy in Firefox with “Proxy DNS when using SOCKS v5” enabled, the encrypted DNS and content blockers won’t work.

Encrypted DNS with ad-blocking. Free. No account needed. Just configure and forget. :locked:

11 Likes
2

FIX setup:

  1. Go to Settings → Network & Internet → Private DNS
  2. Select Private DNS provider hostname
  3. Enter: adblock.dns.mullvad.net
  4. Save. Done.

This uses DNS over TLS (DoT) — your queries are encrypted AND ad/tracker domains get blocked before they ever load. Works system-wide, including inside VPN tunneling apps.

Before: ads everywhere.
After: clean UI, zero ads. The app developer can’t monetize your eyeballs anymore.

Tested :white_check_mark: — :100: working.

2 Likes
3

Thanks a lot

2 Likes