Compare DNS.SB and Mullvad on capabilities, jurisdiction, assurance, and fit for European buyers.
Germany· Web Hosting and Cloud Computing
Needs review
Shortlist when you want an unfiltered, German-operated public resolver with DoT/DoH and optional city-pinned endpoints. Skip when you need malware blocking, a signed DPA or SLA on the free pool, or a guarantee that queries never leave the EU. Consider Quad9 for threat blocking or run your own recursive resolver when residency must be yours.
Sweden· VPN Services
Needs review
Shortlist when you need a Swedish founder-owned privacy VPN with numbered accounts, GPL clients, RAM-only relays, and a dense public audit trail. Skip when you need dedicated IPs, remote port forwarding, or productized enterprise SSO/ISO packaging—consider Proton VPN for suite/free-tier onboarding or AirVPN for inbound ports.
Highlighted rows differ between the two products.
| Feature | DNS.SB | Mullvad |
|---|---|---|
| Country of origin | Germany | Sweden |
| Category | Web Hosting and Cloud Computing | VPN Services |
| Open source | No | Yes |
| Self-hosted | No | No |
| Headquarters | Germany | Sweden |
| Legal entity | xTom GmbH, Kreuzstraße 60, 40210 Düsseldorf (Amtsgericht Düsseldorf HRB 86779) | Mullvad VPN AB (reg. no. 559238-4001); parent Amagicom AB |
| Governing law | Not listed | Swedish / EU law (GDPR); see Swedish legislation help page |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Medium | Medium |
| Hosting / residency | Primary: xTom global anycast (operator xTom GmbH, DE) with published unicast DoH cities. Named non-xTom PoP hosts: HostVenom (Chicago), DigitalOcean (Bengaluru), Amazon AWS (Seoul), Servers.com (Moscow), Vultr (Toronto), Misaka (Berlin). Website analytics: self-hosted Plausible. Backup/DR and support SaaS not published. DoH also advertised as a global CDN endpoint. | Multi-region VPN exits (EU and outside EU, including USA) on owned and rented colo (public provider list: e.g. M247, DataPacket, xtom, Zenlayer, Blix). RAM-only VPN OS. Account/payment personal data claimed stored only in EU/EEA. Payment subprocessors include Stripe and PayPal (US-group) plus SEB for bank/Swish when those methods are used; support email self-hosted by Mullvad since 2024. |
| Summary | Free public recursive DNS from Düsseldorf-based xTom GmbH, with DoT/DoH, claimed no logs, and optional city-pinned unicast endpoints. | Swedish privacy VPN with numbered accounts (no email), GPL-3 clients, RAM-only relays, and repeated third-party security audits—built for anonymity over enterprise packaging. |
| Tags |
| At a glance | DNS.SB | Mullvad |
|---|---|---|
| HQ | Düsseldorf, Germany | Not listed |
| Legal entity | xTom GmbH (HRB 86779) | Not listed |
| Commercial model | Free for personal and non-commercial use; commercial use needs authorization | Prepaid access; no free tier; cash/crypto/card/PayPal (see site) |
| Protocols | DNS 53, DoT 853 (dot.sb), DoH 443 (HTTP/3); no native DoQ; no DNS64 | WireGuard (primary), OpenVPN; bridges/obfuscation |
| Anycast | Claimed 30+ locations on six continents, including US cities | Not listed |
| Open source | Resolver stack not disclosed; docs site is on GitHub | Not listed |
| HQ / entity | Not listed | Gothenburg, Sweden — Mullvad VPN AB (parent Amagicom AB) |
| Ownership | Not listed | 100% founders Fredrik Stromberg and Daniel Berntsson |
| Clients | Not listed | GPL-3 apps (Win/macOS/Linux/Android/iOS); WireGuard configs + CLI |
| Sessions | Not listed | Five simultaneous connections; shared exits only |
| Infrastructure | Not listed | RAM-only VPN relays; multi-region colo (owned + rented) |
| Independent audits | Not listed | Multiple public app/infra audits (Cure53, ROS, Assured, X41, …) |
| B2B packaging | Not listed | Self-serve consumer ToS; no productized enterprise pack found |
| Key capabilities | DNS.SB | Mullvad |
|---|---|---|
| EU-operated | Yes | Yes |
| No-logs (claimed) | Yes | Not listed |
| DoT + DoH | Yes | Not listed |
| Unfiltered | Yes | Not listed |
| Anycast + unicast pin | Yes | Not listed |
| Numbered accounts | Not listed | Yes |
| GPL-3 clients | Not listed | Yes |
| WireGuard + multihop | Not listed | Yes |
| Public security audits | Not listed | Yes |
| RAM-only relays | Not listed | Yes |
Memorable dual-stack public resolvers
Classic DNS on UDP/TCP 53 at 185.222.222.222 and 45.11.45.11, plus IPv6 2a09:: and 2a11:: (full form published for older stacks). Dual-stack is first-class. There is no account and no client app. Benefit: routers and homelabs can be pointed at addresses people can actually remember. Limit: this is a shared public pool, not a dedicated recursive server.
DoT, DoH, and DoH over HTTP/3
Encrypted DNS over TLS on hostname dot.sb port 853, and DoH at https://doh.dns.sb/dns-query (aliases doh.sb and dns.sb, plus raw IP URLs). The FAQ states DoH supports HTTP/3 (QUIC) and that native DNS-over-QUIC (RFC 9250) is not offered yet. Benefit: OS Private DNS, browsers, and Unbound can encrypt the stub-to-resolver hop. Limit: plaintext port 53 remains available and is still visible to the local network.
City-pinned unicast DoH endpoints
Besides global anycast, the DoH page lists per-city URLs such as de-dus, de-fra, nl-ams, uk-lon, ee-tll, and several non-EU cities. Hosting providers are named per row (mostly xTom, plus HostVenom, DigitalOcean, Amazon AWS, Servers.com, Vultr, Misaka). Benefit: an admin can pin the resolver hop to a chosen metro. Limit: anycast IPs still land on the nearest global node, including US cities, unless you pin unicast.
Claimed no-logs resolver with DNSSEC and no ECS
Privacy policy and FAQ say query names, client IPs, and timestamps are not stored, EDNS Client Subnet is off, query name minimisation (RFC 7816) is on, and the resolver validates DNSSEC. Benefit: less data handed to authoritative servers and, if the claim holds, nothing to disclose. Limit: the software stack is undisclosed and no independent no-logs audit was found.
Unfiltered recursion (legal caveats reserved)
FAQ: no content filtering or blocking; users keep control. A separate FAQ bullet reserves blocking for legal requirements. Benefit: usable as a neutral upstream under a local filter like Pi-hole. Limit: no malware or ad blocklist on the resolver, and legal orders could still force a block.
Numbered accounts (no email required)
Signup generates a random account number with prepaid time remaining—no username, password, or email by default. Multiple people can share a number; recovery without the number is intentionally hard. Best when identity linkage is a risk; use cash or self-hosted crypto payments if you also want to avoid card/PayPal trails.
WireGuard-first apps with multihop and obfuscation
Official clients for Windows, macOS, Linux, Android, and iOS use WireGuard with multihop, quantum-resistant tunnel options, DAITA traffic-analysis resistance, and bridge/obfuscation modes (Shadowsocks, UDP-over-TCP, QUIC, LWO on selected servers) for censored networks. Kill switch and tunnel DNS are on by default. Up to five simultaneous connections per account.
GPL-3 open-source clients
Desktop and mobile client code is published under GPL-3 (github.com/mullvad/mullvadvpn-app) with public audit reports in-repo. WireGuard config export and a CLI support non-GUI deployments. iOS App Store distribution uses Apple's EULA rather than GPL for the shipped binary.
RAM-only relays and public audit trail
VPN infrastructure completed migration to diskless/RAM-only operation so reboots discard volatile state. Multiple independent infrastructure and app assessments (Cure53, Radically Open Security, Assured, X41, and others) publish findings; Cure53's work explicitly looked for privacy-impacting flaws on sample relays.
DAITA and quantum-resistant tunnels
DAITA (Defense Against AI-guided Traffic Analysis) adds padding/cover traffic patterns against modern traffic-analysis models. Quantum-resistant WireGuard tunnel modes are available across platforms and were rolled out as defaults on supported clients—useful for long-lived confidentiality threat models, at some performance cost.
| Assurance & compliance | DNS.SB | Mullvad |
|---|---|---|
| Independent security / no-logs audit | Not found Vendor claims logging is disabled. Annual transparency reports exist (2019-2025) but are not an independent security or no-logs audit. Resolver software is undisclosed. | Verified Public Cure53 infrastructure reports (e.g. 2021, 2024) and other third-party app/infra audits; Cure53 stated no PII on assessed systems and no anonymity compromise found in 2024 sample. April 2023 Swedish police search reported no customer data seized. |
| ISO 27001 | Not found No ISO 27001 claim found on dns.sb privacy, FAQ, or xTom imprint pages reviewed. | Not found |
| SOC 2 / SOC 3 | Not found No SOC 2 or SOC 3 claim found on the official pages reviewed. | Not found |
| GDPR / EU data protection | Vendor claimed German controller (xTom GmbH). Privacy policy includes a GDPR rights section and states DNS query data is not collected. Website analytics described as self-hosted Plausible on legitimate interests. | Vendor claimed Swedish EU entity; privacy policy addresses GDPR rights and states personal data stored/processed only in EU/EEA. |
| US CLOUD Act exposure (indicative) | Partial EU entity and no known US parent, but public unicast list includes US cities and US-group providers (Amazon AWS Seoul, DigitalOcean Bengaluru, Vultr Toronto) plus HostVenom Chicago. Anycast includes the United States. Not legal advice. | Partial EU entity, founder-owned, no known US parent. Partial residual exposure: Stripe and PayPal as payment processors (US-group) when those methods are chosen; multi-region exits include US colo. Not legal advice. |
| Data processing agreement (B2B) | Not found No public DPA. Free service is personal/non-commercial; commercial terms are by contact only. | Not found Consumer privacy policy and ToS published; no productized enterprise DPA flow found on primary pages. |
| EU AI Act | Not applicable Public DNS resolver, not an AI system. | Not applicable VPN connectivity product; not an AI system under typical procurement framing (DAITA is a traffic-defense feature, not a general-purpose AI product). |
| Considerations & known limitations | DNS.SB | Mullvad |
|---|---|---|
| No-logs policy is unaudited | Medium Privacy policy and FAQ say query logging is off. There is no independent audit, and the resolver software is not disclosed. Practical impact: you cannot show a third-party report to a security reviewer. | Not listed |
| Global anycast and US-group PoP hosts | Medium Default anycast can land on US and other non-EU nodes. Published unicast DoH uses Amazon AWS, DigitalOcean, Vultr, HostVenom, Servers.com, and Misaka in addition to xTom. Practical impact: EU-only query residency is not the default and is not contractual. | Not listed |
| Free pool is not a commercial DNS contract | Medium Terms restrict free use to personal and non-commercial cases. No SLA, no public DPA, services provided as-is. Practical impact: embedding DNS.SB in a product or relying on it for production without a license is out of policy. | Not listed |
| No resolver-side threat blocking | Low Unfiltered by design, with a legal-requirements caveat. Practical impact: malware and phishing names resolve unless you filter locally or pick a protective resolver. | Not listed |
| No DNS64 and no native DoQ | Low FAQ: DNS64 is not offered; native DoQ is under evaluation; DoH over HTTP/3 is available. Practical impact: NAT64-only clients and DoQ-only stubs need another resolver. | Not listed |
| Consumer packaging, not enterprise control plane | Not listed | Medium Self-serve numbered accounts without productized SSO/MDM org admin, ISO/SOC claims, or click-through DPA. Procurement that requires those artifacts needs offline negotiation or another vendor. |
| US payment processors when card/PayPal used | Not listed | Medium Stripe and PayPal process identity-bearing payment data outside the pure numbered-account model. Cash or self-hosted crypto reduces that trail; card/PayPal does not. |
| Multi-region exit nodes including non-EU | Not listed | Medium Traffic can leave the tunnel outside the EU depending on server choice. Strict residency policies need operational EU-only exit controls, not HQ branding alone. |
| No new port forwarding; no dedicated IP | Not listed | Low Remote port forwarding was disabled for new ports in 2023; dedicated IPs are not offered by design. Choose AirVPN or self-hosted WireGuard if inbound reachability is required. |
| Weak recovery without the account number | Not listed | Low No email-based reset by default. Losing the number can mean losing access; treat it as a secret in team runbooks. |
| US CLOUD Act residual path (indicative) | Not listed | Low No known US parent. Residual exposure mainly via US payment SaaS and optional US exits—not ownership. Not a guarantee against other LE cooperation. |
When: You want threat blocking at the resolver, not a neutral recursive cache
Consider: Quad9 (Swiss foundation, not yet in this catalog) or a protective DNS4EU profile
DNS.SB documents an unfiltered policy aside from legal requirements.
When: You need a signed DPA, SLA, or EU-only query path under contract
Consider: Self-hosted Unbound or Knot Resolver, or a commercial recursive DNS with a written DPA
Free DNS.SB is personal/non-commercial; city pins are operational, not a contract.
When: You need a full-tunnel VPN plus resolver under one European vendor
Consider: Mullvad
Different product class. Mullvad is a VPN, not a standalone public DNS.
When: You need inbound remote port forwarding or Dynamic DNS
Consider: AirVPN
Mullvad disabled new port forwards in 2023; AirVPN remains port-forward oriented.
When: You want a free tier plus mail/drive in one European privacy suite
Consider: Proton VPN
Proton is account-based with a broader product suite; Mullvad optimizes for minimal identity.
When: You need maximum consumer server footprint and streaming-oriented features
Consider: NordVPN or Surfshark
Trade a denser feature catalog for weaker accountless/audit differentiation vs Mullvad.
When: You need enterprise zero-trust mesh or org-wide device VPN with SSO
Consider: Self-hosted WireGuard, Tailscale, or NetBird
Different product class than consumer privacy VPN.