Vergleichen Sie DNS.SB und Mullvad nach Funktionen, Rechtsraum, Nachweisen und Einsatzpassung.
Germany· Web Hosting and Cloud Computing
Needs review
Shortlist when you want an unfiltered, German-operated public resolver with DoT/DoH and optional city-pinned endpoints. Skip when you need malware blocking, a signed DPA or SLA on the free pool, or a guarantee that queries never leave the EU. Consider Quad9 for threat blocking or run your own recursive resolver when residency must be yours.
Sweden· VPN Services
Hervorgehobene Zeilen unterscheiden sich zwischen den Produkten.
| Merkmal | DNS.SB | Mullvad |
|---|---|---|
| Herkunftsland | Germany | Sweden |
| Kategorie | Web Hosting and Cloud Computing | VPN Services |
| Open Source | Nein | Ja |
| Self-Hosted | Nein | Nein |
| Hauptsitz | Germany | Nicht angegeben |
| Rechtsträger | xTom GmbH, Kreuzstraße 60, 40210 Düsseldorf (Amtsgericht Düsseldorf HRB 86779) | Nicht angegeben |
| US-Mutter / Kontrolle | Keine bekannte US-Mutter | Nicht angegeben |
| CLOUD-Act-Exposition (indikativ) | Mittel | Nicht angegeben |
| Hosting / Residenz | Primary: xTom global anycast (operator xTom GmbH, DE) with published unicast DoH cities. Named non-xTom PoP hosts: HostVenom (Chicago), DigitalOcean (Bengaluru), Amazon AWS (Seoul), Servers.com (Moscow), Vultr (Toronto), Misaka (Berlin). Website analytics: self-hosted Plausible. Backup/DR and support SaaS not published. DoH also advertised as a global CDN endpoint. | Nicht angegeben |
| Zusammenfassung | Free public recursive DNS from Düsseldorf-based xTom GmbH, with DoT/DoH, claimed no logs, and optional city-pinned unicast endpoints. | Swedish privacy VPN with numbered accounts (no email), GPL-3 clients, RAM-only relays, and repeated third-party security audits—built for anonymity over enterprise packaging. |
| Tags |
| Auf einen Blick | DNS.SB | Mullvad |
|---|---|---|
| HQ | Düsseldorf, Germany | Nicht angegeben |
| Legal entity | xTom GmbH (HRB 86779) | Nicht angegeben |
| Commercial model | Free for personal and non-commercial use; commercial use needs authorization | Nicht angegeben |
| Protocols | DNS 53, DoT 853 (dot.sb), DoH 443 (HTTP/3); no native DoQ; no DNS64 | Nicht angegeben |
| Anycast | Claimed 30+ locations on six continents, including US cities | Nicht angegeben |
| Open source | Resolver stack not disclosed; docs site is on GitHub | Nicht angegeben |
Memorable dual-stack public resolvers
Classic DNS on UDP/TCP 53 at 185.222.222.222 and 45.11.45.11, plus IPv6 2a09:: and 2a11:: (full form published for older stacks). Dual-stack is first-class. There is no account and no client app. Benefit: routers and homelabs can be pointed at addresses people can actually remember. Limit: this is a shared public pool, not a dedicated recursive server.
DoT, DoH, and DoH over HTTP/3
Encrypted DNS over TLS on hostname dot.sb port 853, and DoH at https://doh.dns.sb/dns-query (aliases doh.sb and dns.sb, plus raw IP URLs). The FAQ states DoH supports HTTP/3 (QUIC) and that native DNS-over-QUIC (RFC 9250) is not offered yet. Benefit: OS Private DNS, browsers, and Unbound can encrypt the stub-to-resolver hop. Limit: plaintext port 53 remains available and is still visible to the local network.
City-pinned unicast DoH endpoints
Besides global anycast, the DoH page lists per-city URLs such as de-dus, de-fra, nl-ams, uk-lon, ee-tll, and several non-EU cities. Hosting providers are named per row (mostly xTom, plus HostVenom, DigitalOcean, Amazon AWS, Servers.com, Vultr, Misaka). Benefit: an admin can pin the resolver hop to a chosen metro. Limit: anycast IPs still land on the nearest global node, including US cities, unless you pin unicast.
Claimed no-logs resolver with DNSSEC and no ECS
Privacy policy and FAQ say query names, client IPs, and timestamps are not stored, EDNS Client Subnet is off, query name minimisation (RFC 7816) is on, and the resolver validates DNSSEC. Benefit: less data handed to authoritative servers and, if the claim holds, nothing to disclose. Limit: the software stack is undisclosed and no independent no-logs audit was found.
Unfiltered recursion (legal caveats reserved)
FAQ: no content filtering or blocking; users keep control. A separate FAQ bullet reserves blocking for legal requirements. Benefit: usable as a neutral upstream under a local filter like Pi-hole. Limit: no malware or ad blocklist on the resolver, and legal orders could still force a block.
Anonyme Kontonummern
Keine E-Mail oder persönlichen Daten nötig. Sofort eine 16-stellige Nummer generieren. Kombinierbar mit anonymen Zahlungen wie Bargeld per Post oder Monero – ohne Identitätsbindung. Beseitigt Honeypot-Risiken accountbasierter Dienste.
Geprüfte No-Logs-Richtlinie
Bewiesen bei der Polizeirazzia 2023: keine Nutzerdaten verfügbar. Unabhängige Audits bestätigen: kein IP-Logging, keine Zeitstempel, keine Bandbreitenprotokolle. Server nutzen RAM-Disks, die beim Neustart gelöscht werden.
Open-Source-Clients und Protokolle
Apps für alle großen Plattformen unter GPLv3. Native WireGuard-Implementierung für niedrigen Overhead; OpenVPN als Fallback; Shadowsocks gegen Zensur. Multi-Hop, Bridge-Modus und DAITA schützen vor fortgeschrittener Analyse.
Erweiterte Sicherheitswerkzeuge
Post-Quantum-Verschlüsselung, vollständiger IPv6-Leak-Schutz, anpassbarer Kill-Switch. Mullvad Browser erschwert Fingerprinting in Zusammenarbeit mit dem Tor Project. Öffentlicher DNS blockiert Tracker standardmäßig.
| Assurance & compliance | DNS.SB | Mullvad |
|---|---|---|
| Independent security / no-logs audit | Not found Vendor claims logging is disabled. Annual transparency reports exist (2019-2025) but are not an independent security or no-logs audit. Resolver software is undisclosed. | Nicht angegeben |
| ISO 27001 | Not found No ISO 27001 claim found on dns.sb privacy, FAQ, or xTom imprint pages reviewed. | Nicht angegeben |
| SOC 2 / SOC 3 | Not found No SOC 2 or SOC 3 claim found on the official pages reviewed. | Nicht angegeben |
| GDPR / EU data protection | Vendor claimed German controller (xTom GmbH). Privacy policy includes a GDPR rights section and states DNS query data is not collected. Website analytics described as self-hosted Plausible on legitimate interests. | Nicht angegeben |
| US CLOUD Act exposure (indicative) | Partial EU entity and no known US parent, but public unicast list includes US cities and US-group providers (Amazon AWS Seoul, DigitalOcean Bengaluru, Vultr Toronto) plus HostVenom Chicago. Anycast includes the United States. Not legal advice. | Nicht angegeben |
| Data processing agreement (B2B) | Not found No public DPA. Free service is personal/non-commercial; commercial terms are by contact only. | Nicht angegeben |
| EU AI Act | Not applicable Public DNS resolver, not an AI system. | Nicht angegeben |
| Considerations & known limitations | DNS.SB | Mullvad |
|---|---|---|
| No-logs policy is unaudited | Medium Privacy policy and FAQ say query logging is off. There is no independent audit, and the resolver software is not disclosed. Practical impact: you cannot show a third-party report to a security reviewer. | Nicht angegeben |
| Global anycast and US-group PoP hosts | Medium Default anycast can land on US and other non-EU nodes. Published unicast DoH uses Amazon AWS, DigitalOcean, Vultr, HostVenom, Servers.com, and Misaka in addition to xTom. Practical impact: EU-only query residency is not the default and is not contractual. | Nicht angegeben |
| Free pool is not a commercial DNS contract | Medium Terms restrict free use to personal and non-commercial cases. No SLA, no public DPA, services provided as-is. Practical impact: embedding DNS.SB in a product or relying on it for production without a license is out of policy. | Nicht angegeben |
| No resolver-side threat blocking | Low Unfiltered by design, with a legal-requirements caveat. Practical impact: malware and phishing names resolve unless you filter locally or pick a protective resolver. | Nicht angegeben |
| No DNS64 and no native DoQ | Low FAQ: DNS64 is not offered; native DoQ is under evaluation; DoH over HTTP/3 is available. Practical impact: NAT64-only clients and DoQ-only stubs need another resolver. | Nicht angegeben |
When: You want threat blocking at the resolver, not a neutral recursive cache
Consider: Quad9 (Swiss foundation, not yet in this catalog) or a protective DNS4EU profile
DNS.SB documents an unfiltered policy aside from legal requirements.
When: You need a signed DPA, SLA, or EU-only query path under contract
Consider: Self-hosted Unbound or Knot Resolver, or a commercial recursive DNS with a written DPA
Free DNS.SB is personal/non-commercial; city pins are operational, not a contract.
When: You need a full-tunnel VPN plus resolver under one European vendor
Consider: Mullvad
Different product class. Mullvad is a VPN, not a standalone public DNS.
Nicht angegeben
Nicht angegeben
Nicht angegeben