What the original roundup says
MakeUseOf's piece, by Alvin Wanjala, starts from a correct point. Every time you open a site, your device sends a DNS lookup. Traditional DNS travels as plain text, so your ISP can read it even when the site itself uses HTTPS. The article recommends switching to an encrypted DNS provider instead of a VPN. It argues that VPNs add latency and that good ones cost money.
The six providers it picks:
- AdGuard Public DNS: ad and tracker blocking, with DNSCrypt, DoH, DoT and DoQ support
- Control D: from the team behind Windscribe, pitched as the "best for customization"
- dns0.eu: an EU-focused resolver
- Mullvad: the VPN company's free encrypted resolver
- Quad9: a Swiss non-profit with malware blocking
- Cloudflare 1.1.1.1: sold mainly on speed
The list is a fair starting point, but it's out of date.
Correction #1: dns0.eu shut down a year ago
dns0.eu announced on October 20, 2025 that it had discontinued its service because it wasn't sustainable in time or resources. BleepingComputer reported the shutdown at the time. The operators suggested DNS4EU or NextDNS instead.
If you set up dns0.eu on a PC, phone or router back when it ran, check that setting now. A dead resolver doesn't fail gracefully. Lookups stall or fail outright, or the device quietly falls back to some other server you didn't pick.
Correction #2: Mullvad's public DNS closes November 2
This is the more urgent problem, and the MakeUseOf piece doesn't mention it. Mullvad's help page now says the public encrypted DNS service will be discontinued on November 2, 2026. That's less than two weeks away.
Mullvad also says it will put money into Quad9 rather than keep running its own resolver. CyberInsider reported that Mullvad will shut down its public DoH servers on November 2, 2026, and will instead financially support privacy-focused DNS provider Quad9. Mullvad's reasoning is that its public resolvers are unnecessary when using Mullvad VPN — traffic is already encrypted and Mullvad VPN's internal DNS handles all queries.
Who needs to act:
- Mullvad VPN customers: nothing changes in most cases. Mullvad says the shutdown does not impact customers of our VPN if DNS content blockers are used.
- Mullvad Browser on default settings: users on its default DNS will be moved to Quad9 automatically.
- Anyone who typed a Mullvad hostname or IP into Windows, a browser or a router: you have to switch yourself. Users who manually configured Mullvad's public DNS service will need to migrate before the cutoff date.
- iPhone, iPad and Mac users with Mullvad profiles: Mullvad says its existing iOS and macOS DoH profiles will stop working when the public service closes. Delete those profiles. Don't leave them in place.
On Windows, the addresses to look for are in the 194.242.2.x range and the 2a07:e340:: IPv6 range, plus any DoH template containing dns.mullvad.net. The six retired hostnames range from dns.mullvad.net (nothing blocked) to all.dns.mullvad.net.
Summary: Of the six providers on the list, one is already gone and another closes on November 2. That leaves four: AdGuard, Control D, Quad9 and Cloudflare.
What encrypted DNS hides, and what it doesn't
The article closes by promising that switching DNS stops your ISP from tracking "your every move." It doesn't.
Encrypted DNS (DoH or DoT) protects the trip between your PC and the resolver. Your ISP can no longer read your lookups off the wire. But the ISP still carries your traffic, and it still sees the IP addresses you connect to. Depending on whether a site and your browser support Encrypted Client Hello, the site name may also show up during the TLS handshake. Encrypted DNS removes one easy way to watch you, not every way.
Encrypted DNS also moves your trust to a new company. Cloudflare's own documentation says that with standard DoH, queries are encrypted but the resolver still sees both your IP address and the domain you look up. Cloudflare offers Oblivious DoH, which splits those two pieces of information between a proxy and a target, as the fix for that. So the question isn't just whether your DNS is encrypted. It's also who receives the lookups and what they keep.
The VPN-versus-DNS framing is also off. A VPN and an encrypted resolver do different jobs. A VPN hides your destinations from the ISP and gives that visibility to the VPN operator. Calling encrypted DNS "the simplest and most effective solution" compares two tools that aren't solving the same problem.
Checking the remaining four against their own policies
Several of the article's privacy claims are broader than what the providers themselves publish.
| Provider | What the article says | What the provider's own docs say |
|---|---|---|
| Cloudflare 1.1.1.1 | Keeps logs for 24 hours and "doesn't collect identifiable data" | Doesn't keep the source IP in permanent storage, but shortens IPs and keeps limited resolver logs for up to 25 hours. Shares anonymized data with APNIC for research and may keep aggregated statistics indefinitely. Supports DoH and DoT. The plain resolver doesn't filter; 1.1.1.1 for Families blocks malware and adult content. |
| Control D | "Fully customizable, even in the free version" | The free resolvers need no account, support DoH, DoT and DoQ, and keep no query logs. They come as fixed filter presets (unfiltered, malware, ads and tracking, social, family-friendly and others). Custom rules, per-device profiles and analytics are paid features. |
| Quad9 | Doesn't log personal data; Swiss law means you're safe | Quad9's policy treats every IP address that queries it as personal data and says it never links an IP address to a query name. It does share limited statistics with threat-intelligence partners and licenses aggregated data, sometimes for a fee. A Swiss address alone guarantees nothing; the policy is what counts. |
| AdGuard Public DNS | Supports four encrypted protocols, deletes data after 24 hours, blocks ads | We couldn't confirm these claims against AdGuard's current official policy, so treat them as MakeUseOf's description until you've read AdGuard's terms yourself. |
Control D's docs also add two warnings the article skipped. Some third-party blocklists are overzealous and block legitimate sites. And hotel or airport Wi-Fi sign-in pages may not load until you've accepted the portal. If the café Wi-Fi suddenly can't find its own login page, your filtered resolver is the likely cause.
Setting up encrypted DNS in Windows 11
Windows 11 can handle DNS-over-HTTPS on its own, no extra app needed. Mullvad's setup guide makes a point that applies to any provider: the encrypted option isn't available in Windows 10, and some virtual machines can't use it.
Steps for Windows 11:
- Open Settings and select Network & internet.
- Click Wi-Fi or Ethernet, depending on how you're connected. On Wi-Fi, also click Hardware properties.
- Next to DNS server assignment, click Edit and switch to Manual.
- Turn on IPv4 and enter your chosen resolver in Preferred DNS. Examples: Quad9 is
9.9.9.9, Cloudflare is1.1.1.1, Control D's free ads-and-tracking preset is76.76.2.2. - Under DNS over HTTPS, pick a mode. Windows may fill in a template automatically for well-known resolvers. If it doesn't, choose On (manual template) and paste the provider's DoH URL. For Control D's ads-and-tracking preset, that's
[url]https://freedns.controld.com/p2[/url]. - Click Save. If your ISP gives you an IPv6 address, repeat the steps under IPv6 with the provider's IPv6 address. Otherwise IPv6 lookups can go around your new setting.
- If you switch between Wi-Fi and Ethernet, configure both adapters. Otherwise Windows may use whichever one you forgot.
Common problems:
- The browser ignores the Windows setting. Chromium-based browsers, including Edge, have their own secure DNS setting that can override the operating system. Mullvad's docs note this for Chrome, Brave and Edge on macOS. Check Settings > Privacy in your browser and make sure it isn't pointing somewhere you didn't intend.
- Sites suddenly won't load. If the old resolver was dns0.eu or Mullvad, it's dead. Replace it. If you're on a filtering preset, try the unfiltered one to see whether a blocklist is the cause.
- No internet on hotel Wi-Fi. Temporarily switch DNS back to Automatic (DHCP), sign in to the portal, then switch back.
Summary: The setup takes about five minutes on Windows 11. Most failures come from forgetting IPv6, forgetting the second adapter, or a browser using its own DNS setting.
Bottom line
MakeUseOf is right that your ISP's plain-text DNS is a privacy weak point, and that fixing it on Windows 11 is free and quick. Its list now needs to be about a third shorter, and its promises need scaling back. Encrypted DNS stops your ISP from reading your lookups. It doesn't make you invisible, and it hands those lookups to a company whose logging policy you should actually read.
If your PC or router still points at Mullvad's public resolvers, move it before November 2. Quad9 is the replacement Mullvad itself is backing. If it still points at dns0.eu, it hasn't been resolving anything for months.