Vergelijk DNS.SB en Mullvad op mogelijkheden, rechtsgebied, waarborgen en geschiktheid voor Europese kopers.
Germany· Web Hosting and Cloud Computing
Needs review
Shortlist when you want an unfiltered, German-operated public resolver with DoT/DoH and optional city-pinned endpoints. Skip when you need malware blocking, a signed DPA or SLA on the free pool, or a guarantee that queries never leave the EU. Consider Quad9 for threat blocking or run your own recursive resolver when residency must be yours.
Sweden· VPN Services
Gemarkeerde rijen verschillen tussen de twee producten.
| Kenmerk | DNS.SB | Mullvad |
|---|---|---|
| Land van herkomst | Germany | Sweden |
| Categorie | Web Hosting and Cloud Computing | VPN Services |
| Open source | Nee | Ja |
| Self-hosted | Nee | Nee |
| Hoofdkantoor | Germany | Niet vermeld |
| Juridische entiteit | xTom GmbH, Kreuzstraße 60, 40210 Düsseldorf (Amtsgericht Düsseldorf HRB 86779) | Niet vermeld |
| VS-moeder / zeggenschap | Geen bekende VS-moeder | Niet vermeld |
| CLOUD Act-blootstelling (indicatief) | Middel | Niet vermeld |
| Hosting / residentie | Primary: xTom global anycast (operator xTom GmbH, DE) with published unicast DoH cities. Named non-xTom PoP hosts: HostVenom (Chicago), DigitalOcean (Bengaluru), Amazon AWS (Seoul), Servers.com (Moscow), Vultr (Toronto), Misaka (Berlin). Website analytics: self-hosted Plausible. Backup/DR and support SaaS not published. DoH also advertised as a global CDN endpoint. | Niet vermeld |
| Samenvatting | Free public recursive DNS from Düsseldorf-based xTom GmbH, with DoT/DoH, claimed no logs, and optional city-pinned unicast endpoints. | Swedish privacy VPN with numbered accounts (no email), GPL-3 clients, RAM-only relays, and repeated third-party security audits—built for anonymity over enterprise packaging. |
| Tags |
| In één oogopslag | DNS.SB | Mullvad |
|---|---|---|
| HQ | Düsseldorf, Germany | Niet vermeld |
| Legal entity | xTom GmbH (HRB 86779) | Niet vermeld |
| Commercial model | Free for personal and non-commercial use; commercial use needs authorization | Niet vermeld |
| Protocols | DNS 53, DoT 853 (dot.sb), DoH 443 (HTTP/3); no native DoQ; no DNS64 | Niet vermeld |
| Anycast | Claimed 30+ locations on six continents, including US cities | Niet vermeld |
| Open source | Resolver stack not disclosed; docs site is on GitHub | Niet vermeld |
Memorable dual-stack public resolvers
Classic DNS on UDP/TCP 53 at 185.222.222.222 and 45.11.45.11, plus IPv6 2a09:: and 2a11:: (full form published for older stacks). Dual-stack is first-class. There is no account and no client app. Benefit: routers and homelabs can be pointed at addresses people can actually remember. Limit: this is a shared public pool, not a dedicated recursive server.
DoT, DoH, and DoH over HTTP/3
Encrypted DNS over TLS on hostname dot.sb port 853, and DoH at https://doh.dns.sb/dns-query (aliases doh.sb and dns.sb, plus raw IP URLs). The FAQ states DoH supports HTTP/3 (QUIC) and that native DNS-over-QUIC (RFC 9250) is not offered yet. Benefit: OS Private DNS, browsers, and Unbound can encrypt the stub-to-resolver hop. Limit: plaintext port 53 remains available and is still visible to the local network.
City-pinned unicast DoH endpoints
Besides global anycast, the DoH page lists per-city URLs such as de-dus, de-fra, nl-ams, uk-lon, ee-tll, and several non-EU cities. Hosting providers are named per row (mostly xTom, plus HostVenom, DigitalOcean, Amazon AWS, Servers.com, Vultr, Misaka). Benefit: an admin can pin the resolver hop to a chosen metro. Limit: anycast IPs still land on the nearest global node, including US cities, unless you pin unicast.
Claimed no-logs resolver with DNSSEC and no ECS
Privacy policy and FAQ say query names, client IPs, and timestamps are not stored, EDNS Client Subnet is off, query name minimisation (RFC 7816) is on, and the resolver validates DNSSEC. Benefit: less data handed to authoritative servers and, if the claim holds, nothing to disclose. Limit: the software stack is undisclosed and no independent no-logs audit was found.
Unfiltered recursion (legal caveats reserved)
FAQ: no content filtering or blocking; users keep control. A separate FAQ bullet reserves blocking for legal requirements. Benefit: usable as a neutral upstream under a local filter like Pi-hole. Limit: no malware or ad blocklist on the resolver, and legal orders could still force a block.
Anonieme accountnummers
Geen e-mail of persoonlijke gegevens nodig. Genereer direct een 16-cijferig nummer. Combineer met anonieme betalingen zoals contant per post of Monero — zonder identiteitskoppeling. Elimineert honeypot-risico's van accountgebaseerde diensten.
Geauditeerd no-logs-beleid
Bewezen bij de politierazzia in 2023: geen gebruikersgegevens beschikbaar. Onafhankelijke audits bevestigen: geen IP-logging, tijdstempels of bandbreedtelogs. Servers gebruiken RAM-disks die bij herstart worden gewist.
Open-source clients en protocollen
Apps voor alle grote platformen onder GPLv3. Native WireGuard voor lage overhead; OpenVPN als fallback; Shadowsocks tegen censuur. Multi-hop, bridge-modus en DAITA beschermen tegen geavanceerde analyse.
Geavanceerde beveiligingstools
Post-quantumversleuteling, volledige IPv6-lekbescherming, aanpasbare kill switch. Mullvad Browser bemoeilijkt fingerprinting in samenwerking met het Tor Project. Publieke DNS blokkeert trackers standaard.
| Assurance & compliance | DNS.SB | Mullvad |
|---|---|---|
| Independent security / no-logs audit | Not found Vendor claims logging is disabled. Annual transparency reports exist (2019-2025) but are not an independent security or no-logs audit. Resolver software is undisclosed. | Niet vermeld |
| ISO 27001 | Not found No ISO 27001 claim found on dns.sb privacy, FAQ, or xTom imprint pages reviewed. | Niet vermeld |
| SOC 2 / SOC 3 | Not found No SOC 2 or SOC 3 claim found on the official pages reviewed. | Niet vermeld |
| GDPR / EU data protection | Vendor claimed German controller (xTom GmbH). Privacy policy includes a GDPR rights section and states DNS query data is not collected. Website analytics described as self-hosted Plausible on legitimate interests. | Niet vermeld |
| US CLOUD Act exposure (indicative) | Partial EU entity and no known US parent, but public unicast list includes US cities and US-group providers (Amazon AWS Seoul, DigitalOcean Bengaluru, Vultr Toronto) plus HostVenom Chicago. Anycast includes the United States. Not legal advice. | Niet vermeld |
| Data processing agreement (B2B) | Not found No public DPA. Free service is personal/non-commercial; commercial terms are by contact only. | Niet vermeld |
| EU AI Act | Not applicable Public DNS resolver, not an AI system. | Niet vermeld |
| Considerations & known limitations | DNS.SB | Mullvad |
|---|---|---|
| No-logs policy is unaudited | Medium Privacy policy and FAQ say query logging is off. There is no independent audit, and the resolver software is not disclosed. Practical impact: you cannot show a third-party report to a security reviewer. | Niet vermeld |
| Global anycast and US-group PoP hosts | Medium Default anycast can land on US and other non-EU nodes. Published unicast DoH uses Amazon AWS, DigitalOcean, Vultr, HostVenom, Servers.com, and Misaka in addition to xTom. Practical impact: EU-only query residency is not the default and is not contractual. | Niet vermeld |
| Free pool is not a commercial DNS contract | Medium Terms restrict free use to personal and non-commercial cases. No SLA, no public DPA, services provided as-is. Practical impact: embedding DNS.SB in a product or relying on it for production without a license is out of policy. | Niet vermeld |
| No resolver-side threat blocking | Low Unfiltered by design, with a legal-requirements caveat. Practical impact: malware and phishing names resolve unless you filter locally or pick a protective resolver. | Niet vermeld |
| No DNS64 and no native DoQ | Low FAQ: DNS64 is not offered; native DoQ is under evaluation; DoH over HTTP/3 is available. Practical impact: NAT64-only clients and DoQ-only stubs need another resolver. | Niet vermeld |
When: You want threat blocking at the resolver, not a neutral recursive cache
Consider: Quad9 (Swiss foundation, not yet in this catalog) or a protective DNS4EU profile
DNS.SB documents an unfiltered policy aside from legal requirements.
When: You need a signed DPA, SLA, or EU-only query path under contract
Consider: Self-hosted Unbound or Knot Resolver, or a commercial recursive DNS with a written DPA
Free DNS.SB is personal/non-commercial; city pins are operational, not a contract.
When: You need a full-tunnel VPN plus resolver under one European vendor
Consider: Mullvad
Different product class. Mullvad is a VPN, not a standalone public DNS.
Niet vermeld
Niet vermeld
Niet vermeld