Three stories reached the Hacker News front page within a day of each other. Mullvad announced it is shutting down its public encrypted DNS servers. The Swiss non-profit Quad9 and the Berlin non-profit deSEC surfaced alongside it. And Statichost.eu, a one-person European hosting service, drew several hundred points for refusing to run on AWS or Cloudflare.
Read together, they are one story about the same layer: the parts of your stack that nobody in your organisation ever procured, has a contract for, or could name under questioning.
TL;DR
- Mullvad closes its public encrypted DNS on 2 November 2026 and will sponsor Quad9 instead, because running a privacy-focused public resolver duplicated specialist work someone else already does well.
- Free public infrastructure is paid for in exactly three ways, and each fails differently: cross-subsidy (ends at a strategy review), philanthropy (ends when donations dip), grant funding (ends on a calendar someone else set).
- Cloudflare’s 1.1.1.1 went dark globally for 62 minutes on 14 July 2025 after a pre-production topology change. Nobody who depended on it was owed anything, because nobody was paying.
- NIS2 Article 3(1) makes DNS service providers essential entities regardless of size, the directive’s heaviest classification. If your product resolves names for internet end-users, that definition may include you.
- DNS4EU, the EU’s own answer to resolver dependency, offers its free public service to individual citizens and not for commercial use. It is not the fallback your company thinks it is.
What Mullvad did, and why it is the right call
Mullvad has run public DNS-over-HTTPS resolvers since 2022, open to anyone, and used them as the default in Mullvad Browser whenever it was not connected to the VPN. On 3 September it announced the service closes on 2 November 2026. Browser users on the default configuration migrate to Quad9 automatically. Anyone who typed those hostnames into a router, a container image or a client’s firewall has to move themselves.
The reasoning is unusually clean for a shutdown notice: running a privacy-focused public resolver is specialist work, the Quad9 Foundation already leads that field, and Mullvad would rather fund it than duplicate it. That is a good decision. It is also one fewer independently operated resolver and more traffic concentrated on a single Swiss foundation. Consolidating onto the specialist improves the quality of the operation and worsens the concentration; anyone telling you both can be optimised at once is selling something.
Three ways free infrastructure gets paid for
Cross-subsidy. A commercial company runs it as a side effect of strategy: brand, telemetry, standards influence, or a belief that the internet needs it. Mullvad’s resolver was this. So are 1.1.1.1 and 8.8.8.8. The failure mode is not collapse, it is a strategy review, and if you are lucky you get sixty days’ notice. If you are unlucky you get an incident: on 14 July 2025, Cloudflare’s 1.1.1.1 was globally unreachable for 62 minutes after a configuration change made five weeks earlier attached its prefixes to a non-production service topology. The postmortem was a model of transparency. It was not an SLA, because there was no contract, because it was free.
Philanthropy. A foundation operates the service on donations. Quad9 is a Swiss Stiftung in Zürich, founded by Global Cyber Alliance, IBM and Packet Clearing House, running over 230 resolver clusters in more than 110 countries and blocking an average of 670 million malicious lookups a day, on a budget that comes entirely from sponsors and donors. Which is why Mullvad’s contribution matters. The failure mode is quieter than a shutdown notice: budgets tighten, footprints shrink, the nearest cluster to Dublin becomes one in another country, and your p99 resolution time drifts upward with no announcement attached.
Grant funding. Public money builds the thing and the plan for afterwards is written in the future tense. DNS4EU launched in June 2025 under Digital Europe Programme project 101095329, led by the Czech firm Whalebone with a consortium including CZ.NIC, NASK and deSEC, and its founding rationale is precisely the dependency this article is about. It was co-funded through 2025 with commercial sustainability as the plan thereafter, which is why the site now separates a free public resolver from paid offerings for telcos, governments and enterprises.
There is a detail in that split most people miss. The free DNS4EU public service is offered to individual citizens and not for commercial use. If you have quietly filed DNS4EU as the sovereign fallback for a client’s production estate, you filed the wrong product. The one you need has an invoice attached.
Now find it in your risk register
You have an SBOM, a vendor list and probably a supplier register. Name the entry for whoever resolves your names. Most teams cannot, because resolution is inherited rather than chosen, at four or five layers, by different people, years apart. The host’s /etc/resolv.conf, which the container inherited without asking. The cloud VPC resolver, forwarding to whatever upstream the provider chose. The CI runner image. The browser’s DoH default, which for Mullvad Browser users changes hands in November because of a decision taken at another company. The ad-blocking resolver a client’s ops contractor typed into a router in 2021 and never documented.
If you audit one this month, make it the build agents. Dependency resolution, artefact fetch, container pulls and OIDC token exchange all traverse whichever resolver your CI environment happens to have, which makes it the highest-value name resolution in your organisation and almost always the least examined. We have made this argument at the open source stewardship layer and the model registry layer. Name resolution is the same shape one layer down, with no version number, no lockfile and no changelog.
The law already treats this layer as critical
Under NIS2 Article 3(1), DNS service providers are essential entities regardless of their size, alongside qualified trust service providers and top-level domain registries. That is the directive’s heaviest classification, applied without the usual employee and turnover thresholds, to a service most companies consume for free from an organisation they have never contacted.
The second edge points at the reader. Article 6(20) defines a DNS service provider as an entity providing publicly available recursive resolution for internet end-users, or authoritative resolution for third-party use. If you ship a VPN client, router firmware, a network appliance or a consumer app with a “secure DNS” feature, read that slowly: the size ceiling exempting you from most of NIS2 does not apply to that activity. Mullvad, which most people would describe as a VPN provider, has been operating exactly this service since 2022. Ireland has still not transposed NIS2 and was referred to the Court of Justice in July over the delay, but as we argued when the obligations began arriving through customer contracts, that is timing rather than reprieve.
Sovereignty and resilience are not the same project
Statichost.eu makes the strongest version of the sovereignty argument: servers in Europe is the easy half, and it should be a European company on European infrastructure, from deploy through to CDN. That is a much harder standard than a region selector in a console, and it usually means fewer edge locations and a supplier whose bus factor you can count on one hand. The two goals also conflict, because moving European traffic onto European resolvers improves sovereignty and worsens concentration, while spreading resolution across Quad9, Cloudflare and a self-hosted Unbound does the reverse. Decide which your business needs and write down why. The indefensible default is no decision at all, called pragmatism.
What to do before November
- Inventory resolution, not just DNS hosting. Your authoritative zones are documented; the recursive path is the gap. Capture it per environment: production hosts, container images, CI runners, VPN clients, office network, and every client estate you are contractually on the hook for.
- Grep your infrastructure for hardcoded resolver addresses. Terraform, cloud-init, Dockerfiles, Ansible, router configs, Kubernetes
dnsConfigblocks. Anything pointing at a Mullvad DoH endpoint has a 2 November expiry date on it. - Classify each dependency by funding model. Cross-subsidy, philanthropy or grant. That single label predicts how you will find out it is ending, and it takes ten minutes per supplier.
- Test the failover for real. Not as a config line: block the primary and watch what your build pipeline does. Sixty-two minutes is long enough to fail a deployment window and short enough that nobody prepared for it.
- Fund what you depend on. If a free resolver, certificate authority or package registry is load-bearing in your revenue, a modest annual sponsorship is cheaper than the engineering above and the only measure that addresses the cause.
The signpost at the junction is not owned by anyone. Somebody repaints it because they care, until they stop. REPTILEHAUS designs and audits infrastructure for teams who would rather find these dependencies in a review than in an outage. If you cannot name the resolver your production build pipeline uses, get in touch and we will start there.
📷 Photo by Maël BALLAND on Unsplash
