Hacker News

> The German courts entirely disregarded our use of geo-IP lookups on queries, and asserted that since tests via a VPN were able to resolve the domain, we were in breach of court orders

Seriously, what the fuck? So you're supposed to block VPNs as well? What's next, Tor exit nodes? New VPN and Tor nodes as they pop up? I really don't like where this is going.

I use Clouldflare DoT and enabled validation in systemd-resolved some time ago. Not because I would be particularly paranoid, but more out of curiosity how it works. I noticed no problems, except for with Atlassian. They use 2 second level domains (at least), one under .com signed and one under .net (unsigned) (IIRC). Most things worked like normal, but some Jira extension stopped working. Turned out that systemd did reject their signed subdomains. Could not figure out whether the rejection was justified or not. When I asked Claude 7 times about it, I also got 7 contradicting answers... Reported to Atlassian support that their signing is incorrect (some delegation missing). To my surprise they replied: Are you using systemd? And gave a bug number that systemd handles validation wrong in their case.

Haven't had time to study the bug and really understand the whole issue myself. Just left it there with the takeaway that local validation is currently not for non-experts.

(Sorry not at my computer. Details rather vague from memory.)

Not if Quad9 is using DNSSEC, no.

What's the specific threat you're envisioning? If it involves Quad9 themselves being malicious, what would DNSSEC on the forwarding prevent?

This page explains how all of this works in detail: https://quad9.net/news/blog/quad9-enables-dnssec-on-all-serv...

Technically yes, in practice the odds your local resolver is validating DNSSEC is slim (and if you're intentionally configured it to do so, switch to a provider that isn't Quad9).

That's something people should run themselves. I run Adguard Home on my router. Unlike the main Adguard product, Adguard Home is fully FOSS. It's been rock-solid for me, and improves on pi-hole in various ways - like full IPv6 support.

Mullvad had adblocking, malware blocking. And they didn’t block websites from governments blacklists in France and Italy. None of these features are available on Quad9.

Maybe it’s time to try nym.com?

This is a very important detail. Adblock in 2026 is necessary and DNS will transparently do a lot of that work for you. It isn't just about lightning fast lookups and five-nines uptime anymore.

I've been using Control D and have been happy with it so far

For clarification, this is completely true of the US, without needing to speculate, thanks to a combination of FISA 702, the ECPA, CALEA, EO 12333, and the CLOUD act. It all has legal footing in the States.

However, it's not at all the reality of a vast swath of other countries (or, at least, not yet; see Chat Control v2). The US is particularly foul (and effective) when it comes to this practice, but anything outside of US jurisdiction that doesn't have an office in the US can't be touched by laws like these, and the laws of most other countries tend to be significantly less invasive than American ones when it comes to data interception and the practices surrounding it.

Adversaries don't always ask nicely. Sometimes they break in and silently take the data. These services centralize traffic flows and make it so that an adversary only needs to tap one or two circuits to get a full picture for all users of a service.

Been using them for years. The price is reasonable too. It’s the only way I found to block ads everywhere on iOS (except the YT app, Mullvad’s Albania wireguard did that)

they block duolingo

So this is something to use instead of pihole?

Cloudflare DNS does not block ads, it only blocks malware

I stopped using Mullvad when they discontinued OpenVPN support (another one to add to the parent list). OpenVPN, if nothing else, provides a wider array of connection options that have a better chance of fulfilling your specific network needs. It supports both UDP and TCP, unlike WireGuard.

I say this respectfully, but Mullvad is perhaps “dumbing down” their VPN service in an effort to simplify their operations and cater to a wider and more general audience.

Curious what alternative you found as a replacement. Could you share?

>https://freedns.afraid.org/

This dude has been doing it for 25 years, and actually this is a dns provider for domain names which I'm decently sure makes it more complicated than public dns.

They're allowed to say they don't want to pay for it anymore, I just think their logic is bad. Or maybe their lawyer said they're running risks just ignoring takedown and they didn't want to deal with it anymore.

This is a scaling problem, not an intrinsic difficulty. Mullvad already had the infrastructure in place. I suspect the real reason is cost-cutting.

Translation: one of Mullvad’s two cofounders has donated money to Örebropartiet, a left-leaning Swedish political party that promotes strict and restrictive immigration laws.

They are not far right, AFAICT they are “right” Marxists, probably most similar to Albanian Hoxhaism.

If you aren’t familiar with splits inside Marxism-Leninism, the “left” is most often represented by Trotskyism with the “right” tendency being more like Stalinism and North Korean Juche. (Note that these left/right terms aren’t universally used or applied because every faction claims to be correct.)