Comparez DNS.SB et Mullvad sur les capacités, la juridiction, les garanties et l'adéquation pour les acheteurs européens.
Germany· Web Hosting and Cloud Computing
Needs review
Shortlist when you want an unfiltered, German-operated public resolver with DoT/DoH and optional city-pinned endpoints. Skip when you need malware blocking, a signed DPA or SLA on the free pool, or a guarantee that queries never leave the EU. Consider Quad9 for threat blocking or run your own recursive resolver when residency must be yours.
Sweden· VPN Services
Les lignes surlignées diffèrent entre les deux produits.
| Caractéristique | DNS.SB | Mullvad |
|---|---|---|
| Pays d'origine | Germany | Sweden |
| Catégorie | Web Hosting and Cloud Computing | VPN Services |
| Open source | Non | Oui |
| Auto-hébergé | Non | Non |
| Siège | Germany | Non indiqué |
| Entité légale | xTom GmbH, Kreuzstraße 60, 40210 Düsseldorf (Amtsgericht Düsseldorf HRB 86779) | Non indiqué |
| Maison mère / contrôle US | Aucune maison mère US connue | Non indiqué |
| Exposition CLOUD Act (indicative) | Moyen | Non indiqué |
| Hébergement / résidence | Primary: xTom global anycast (operator xTom GmbH, DE) with published unicast DoH cities. Named non-xTom PoP hosts: HostVenom (Chicago), DigitalOcean (Bengaluru), Amazon AWS (Seoul), Servers.com (Moscow), Vultr (Toronto), Misaka (Berlin). Website analytics: self-hosted Plausible. Backup/DR and support SaaS not published. DoH also advertised as a global CDN endpoint. | Non indiqué |
| Résumé | Free public recursive DNS from Düsseldorf-based xTom GmbH, with DoT/DoH, claimed no logs, and optional city-pinned unicast endpoints. | Swedish privacy VPN with numbered accounts (no email), GPL-3 clients, RAM-only relays, and repeated third-party security audits—built for anonymity over enterprise packaging. |
| Tags |
| En un coup d'œil | DNS.SB | Mullvad |
|---|---|---|
| HQ | Düsseldorf, Germany | Non indiqué |
| Legal entity | xTom GmbH (HRB 86779) | Non indiqué |
| Commercial model | Free for personal and non-commercial use; commercial use needs authorization | Non indiqué |
| Protocols | DNS 53, DoT 853 (dot.sb), DoH 443 (HTTP/3); no native DoQ; no DNS64 | Non indiqué |
| Anycast | Claimed 30+ locations on six continents, including US cities | Non indiqué |
| Open source | Resolver stack not disclosed; docs site is on GitHub | Non indiqué |
Memorable dual-stack public resolvers
Classic DNS on UDP/TCP 53 at 185.222.222.222 and 45.11.45.11, plus IPv6 2a09:: and 2a11:: (full form published for older stacks). Dual-stack is first-class. There is no account and no client app. Benefit: routers and homelabs can be pointed at addresses people can actually remember. Limit: this is a shared public pool, not a dedicated recursive server.
DoT, DoH, and DoH over HTTP/3
Encrypted DNS over TLS on hostname dot.sb port 853, and DoH at https://doh.dns.sb/dns-query (aliases doh.sb and dns.sb, plus raw IP URLs). The FAQ states DoH supports HTTP/3 (QUIC) and that native DNS-over-QUIC (RFC 9250) is not offered yet. Benefit: OS Private DNS, browsers, and Unbound can encrypt the stub-to-resolver hop. Limit: plaintext port 53 remains available and is still visible to the local network.
City-pinned unicast DoH endpoints
Besides global anycast, the DoH page lists per-city URLs such as de-dus, de-fra, nl-ams, uk-lon, ee-tll, and several non-EU cities. Hosting providers are named per row (mostly xTom, plus HostVenom, DigitalOcean, Amazon AWS, Servers.com, Vultr, Misaka). Benefit: an admin can pin the resolver hop to a chosen metro. Limit: anycast IPs still land on the nearest global node, including US cities, unless you pin unicast.
Claimed no-logs resolver with DNSSEC and no ECS
Privacy policy and FAQ say query names, client IPs, and timestamps are not stored, EDNS Client Subnet is off, query name minimisation (RFC 7816) is on, and the resolver validates DNSSEC. Benefit: less data handed to authoritative servers and, if the claim holds, nothing to disclose. Limit: the software stack is undisclosed and no independent no-logs audit was found.
Unfiltered recursion (legal caveats reserved)
FAQ: no content filtering or blocking; users keep control. A separate FAQ bullet reserves blocking for legal requirements. Benefit: usable as a neutral upstream under a local filter like Pi-hole. Limit: no malware or ad blocklist on the resolver, and legal orders could still force a block.
Numéros de compte anonymes
Aucune adresse e-mail ni donnée personnelle requise. Générez instantanément un code à 16 chiffres. Associez des paiements anonymes comme l'espèces par courrier ou Monero — sans lien d'identité. Élimine les risques de piège des services basés sur un compte.
Politique no-logs auditée
Prouvée lors de la perquisition de 2023 : aucune donnée utilisateur disponible. Les audits indépendants confirment l'absence de journalisation IP, d'horodatages et de volumes de bande passante. Les serveurs utilisent des disques RAM effacés au redémarrage.
Clients et protocoles open source
Applications pour toutes les plateformes majeures sous GPLv3. WireGuard natif pour un faible overhead ; OpenVPN en secours ; Shadowsocks contre la censure. Multi-saut, mode pont et DAITA protègent contre l'analyse avancée.
Outils de sécurité avancés
Chiffrement post-quantique, protection complète contre les fuites IPv6, kill switch personnalisable. Le Mullvad Browser limite l'empreinte digitale grâce au Tor Project. Le DNS public bloque les traqueurs par défaut.
| Assurance & compliance | DNS.SB | Mullvad |
|---|---|---|
| Independent security / no-logs audit | Not found Vendor claims logging is disabled. Annual transparency reports exist (2019-2025) but are not an independent security or no-logs audit. Resolver software is undisclosed. | Non indiqué |
| ISO 27001 | Not found No ISO 27001 claim found on dns.sb privacy, FAQ, or xTom imprint pages reviewed. | Non indiqué |
| SOC 2 / SOC 3 | Not found No SOC 2 or SOC 3 claim found on the official pages reviewed. | Non indiqué |
| GDPR / EU data protection | Vendor claimed German controller (xTom GmbH). Privacy policy includes a GDPR rights section and states DNS query data is not collected. Website analytics described as self-hosted Plausible on legitimate interests. | Non indiqué |
| US CLOUD Act exposure (indicative) | Partial EU entity and no known US parent, but public unicast list includes US cities and US-group providers (Amazon AWS Seoul, DigitalOcean Bengaluru, Vultr Toronto) plus HostVenom Chicago. Anycast includes the United States. Not legal advice. | Non indiqué |
| Data processing agreement (B2B) | Not found No public DPA. Free service is personal/non-commercial; commercial terms are by contact only. | Non indiqué |
| EU AI Act | Not applicable Public DNS resolver, not an AI system. | Non indiqué |
| Considerations & known limitations | DNS.SB | Mullvad |
|---|---|---|
| No-logs policy is unaudited | Medium Privacy policy and FAQ say query logging is off. There is no independent audit, and the resolver software is not disclosed. Practical impact: you cannot show a third-party report to a security reviewer. | Non indiqué |
| Global anycast and US-group PoP hosts | Medium Default anycast can land on US and other non-EU nodes. Published unicast DoH uses Amazon AWS, DigitalOcean, Vultr, HostVenom, Servers.com, and Misaka in addition to xTom. Practical impact: EU-only query residency is not the default and is not contractual. | Non indiqué |
| Free pool is not a commercial DNS contract | Medium Terms restrict free use to personal and non-commercial cases. No SLA, no public DPA, services provided as-is. Practical impact: embedding DNS.SB in a product or relying on it for production without a license is out of policy. | Non indiqué |
| No resolver-side threat blocking | Low Unfiltered by design, with a legal-requirements caveat. Practical impact: malware and phishing names resolve unless you filter locally or pick a protective resolver. | Non indiqué |
| No DNS64 and no native DoQ | Low FAQ: DNS64 is not offered; native DoQ is under evaluation; DoH over HTTP/3 is available. Practical impact: NAT64-only clients and DoQ-only stubs need another resolver. | Non indiqué |
When: You want threat blocking at the resolver, not a neutral recursive cache
Consider: Quad9 (Swiss foundation, not yet in this catalog) or a protective DNS4EU profile
DNS.SB documents an unfiltered policy aside from legal requirements.
When: You need a signed DPA, SLA, or EU-only query path under contract
Consider: Self-hosted Unbound or Knot Resolver, or a commercial recursive DNS with a written DPA
Free DNS.SB is personal/non-commercial; city pins are operational, not a contract.
When: You need a full-tunnel VPN plus resolver under one European vendor
Consider: Mullvad
Different product class. Mullvad is a VPN, not a standalone public DNS.
Non indiqué
Non indiqué
Non indiqué