Content Blockers

​

Overview

• Ads: Advertising networks and services
• Trackers: Analytics and tracking domains
• Malware: Known malicious domains
• Adult Content: Adult and NSFW websites
• Gambling: Betting and gambling sites
• Social Media: Social networking platforms

​

How DNS-Based Blocking Works

​

Normal DNS Resolution

Browser: "What's the IP of ad-network.com?"
   │
   ▼
DNS Resolver: "It's 192.0.2.1"
   │
   ▼
Browser: [Connects to 192.0.2.1 and loads ads]

​

With Content Blocker Enabled

Browser: "What's the IP of ad-network.com?"
   │
   ▼
DNS Resolver: "Domain blocked - 0.0.0.0"
   │
   ▼
Browser: [Cannot connect - no ads loaded]

• 0.0.0.0 (non-routable address), OR
• NXDOMAIN (domain does not exist)

​

Available Content Blockers

​

Ads

• doubleclick.net
• googlesyndication.com
• advertising.com
• Ad servers and networks

• Cleaner browsing experience
• Faster page loading
• Reduced bandwidth usage
• Privacy improvement (ads track you)

​

Trackers

• google-analytics.com
• facebook.com tracking pixels
• hotjar.com
• Analytics and heat mapping services

• Enhanced privacy
• Prevent behavioral tracking
• Reduce data collection
• Limit cross-site tracking

​

Malware

• Phishing websites
• Malware download sites
• Command & control servers
• Compromised domains

• Security protection
• Phishing prevention
• Malware blocking
• Safe browsing

​

Adult Content

• Parental controls
• Family safety
• Workplace compliance
• Personal accountability

​

Gambling

• Online casinos
• Sports betting sites
• Poker platforms
• Lottery websites

• Responsible gambling support
• Financial protection
• Workplace productivity
• Self-imposed restrictions

​

Social Media

• Facebook/Meta properties
• Twitter/X
• Instagram
• TikTok
• LinkedIn
• Reddit

• Digital wellness
• Productivity improvement
• Reduce screen time
• Focus enhancement

​

Enabling Content Blockers

​

Using the GUI

​

Using the CLI

mullvad dns set default \
  --block-ads \
  --block-trackers \
  --block-malware

mullvad dns set default \
  --block-ads \
  --block-trackers \
  --block-malware \
  --block-adult-content \
  --block-gambling \
  --block-social-media

# Only malware blocking
mullvad dns set default --block-malware

# Malware + adult content
mullvad dns set default \
  --block-malware \
  --block-adult-content

mullvad dns set default

​

Check Current Settings

mullvad dns get

Custom DNS: no
Block ads: true
Block trackers: true
Block malware: true
Block adult content: false
Block gambling: false
Block social media: false

​

What Content Blockers Can and Cannot Do

​

✅ What DNS Blocking CAN Do

• Block entire domains: Prevent connections to blocked domains
• Prevent tracking pixels: Block analytics and tracking scripts
• Stop malware downloads: Block known malicious domains
• Filter ads: Remove ads from most websites and apps
• System-wide blocking: Works for all apps (not just browsers)
• No software installation: Built into Mullvad’s DNS

​

❌ What DNS Blocking CANNOT Do

• Block specific URLs: Cannot block example.com/ads while allowing example.com
• Block first-party ads: Cannot block ads served from the same domain (e.g., YouTube ads from youtube.com)
• Block inline content: Cannot remove ads already embedded in HTML
• Granular control: Cannot block specific elements on a page
• Bypass HTTPS inspection: Cannot see encrypted HTTPS content
• Cosmetic filtering: Cannot hide blocked ad spaces (browser ad blockers do this)

​

How Blocking Affects Different Services

​

Web Browsing

• ✅ Most ads removed
• ✅ Tracking scripts blocked
• ❌ First-party ads still show (e.g., Amazon product ads)
• ❌ Empty spaces where ads were (use browser ad blocker to hide)

• ✅ Phishing sites blocked
• ✅ Malware distribution prevented
• ✅ Protection against drive-by downloads

​

Mobile Apps

• ✅ Most in-app ads blocked
• ✅ Works for all apps, not just browsers
• ❌ Some apps may malfunction without ads
• ❌ Apps that require ad networks may show errors

​

Social Media Blocking

• Cannot access social media websites
• Apps cannot connect
• Embedded social widgets fail

• “Sign in with Facebook” won’t work
• Social sharing buttons disabled
• Comments sections using social logins unavailable

​

Combining Blockers

​

Recommended Combinations

mullvad dns set default \
  --block-ads \
  --block-trackers \
  --block-malware

mullvad dns set default \
  --block-ads \
  --block-trackers \
  --block-malware \
  --block-adult-content \
  --block-gambling

mullvad dns set default \
  --block-malware \
  --block-social-media

mullvad dns set default --block-malware

​

Compatibility

• ✅ WireGuard protocol
• ✅ Quantum-resistant tunnels
• ✅ Multihop
• ✅ DAITA
• ✅ Obfuscation protocols
• ✅ Custom DNS* (see note below)
• ✅ Split tunneling
• ✅ Local network access

​

Performance Impact

​

Benefits

• Faster page loading: No time spent loading ads
• Reduced bandwidth: Less data transferred
• Lower CPU usage: Fewer scripts to execute
• Better battery life: Especially on mobile devices

​

Overhead

• DNS lookup: Negligible (<1ms additional processing)
• Blocklist updates: Automatic, transparent
• Memory usage: Minimal (blocklists on DNS server)

​

Troubleshooting

​

Website or Service Not Working

1. Identify the issue: Check browser console for blocked requests
2. Test by disabling blockers:
   # Disable all blockers temporarily
   mullvad dns set default
   
   # Test if site works
   # Then re-enable blockers
   mullvad dns set default --block-ads --block-trackers --block-malware
   
3. Disable specific blocker:
   # Example: Disable ad blocking but keep others
   mullvad dns set default --block-trackers --block-malware
   
4. Use browser exceptions: Some browser ad blockers allow site-specific whitelisting

​

Ads Still Appearing

1. Clear DNS cache (see below)
2. Check blocker status:
   mullvad dns get
   
3. Verify default DNS is active: Ensure not using custom DNS
4. First-party ads: These cannot be blocked by DNS (use browser ad blocker)
5. Test blocking:
   # Should return 0.0.0.0 or NXDOMAIN
   nslookup doubleclick.net
   nslookup ads.google.com
   

​

Clearing DNS Cache

ipconfig /flushdns

sudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder

# systemd-resolved
sudo systemd-resolve --flush-caches

# dnsmasq
sudo killall -HUP dnsmasq

# nscd
sudo systemctl restart nscd

• Chrome: Settings → Privacy and security → Clear browsing data
• Firefox: Settings → Privacy & Security → Clear Data
• Safari: Preferences → Privacy → Manage Website Data → Remove All

​

Social Media Login Issues

1. Temporarily disable social media blocker:
   # Keep other blockers active
   mullvad dns set default --block-ads --block-trackers --block-malware
   
2. Complete login
3. Re-enable social media blocker (if desired):
   mullvad dns set default \
     --block-ads \
     --block-trackers \
     --block-malware \
     --block-social-media
   

​

Legitimate Sites Blocked

1. False positive: Blocklists occasionally block legitimate domains
2. Disable blocker temporarily:
   # Disable specific blocker
   mullvad dns set default --block-trackers --block-malware
   # (removed --block-ads in this example)
   
3. Report false positive: Contact Mullvad support with domain details
4. Use custom DNS: Switch to unfiltered DNS if needed
   mullvad dns set custom 1.1.1.1
   

​

Comparison with Other Solutions

​

DNS-Based Blocking (Mullvad Content Blockers)

• System-wide (all apps)
• No additional software
• Blocks tracking in all apps
• Low resource usage
• Works on mobile

• Cannot block first-party ads
• No cosmetic filtering
• All-or-nothing per domain

​

Browser Extensions (uBlock Origin, AdBlock Plus)

• Granular URL/element blocking
• Cosmetic filtering (hides ad spaces)
• Can block first-party ads
• Per-site whitelisting

• Browser-only (doesn’t block app ads)
• Resource usage in browser
• Must install in each browser
• Not available on mobile browsers (limited)

​

Network-Wide Blockers (Pi-hole, AdGuard Home)

• Blocks for all devices on network
• Customizable blocklists
• Detailed statistics
• Full control

• Requires separate device/server
• Network configuration needed
• Maintenance required

​

Privacy Considerations

​

What Mullvad Sees

• Mullvad sees: DNS queries (e.g., “user queried doubleclick.net”)
• Mullvad does NOT log: DNS queries are not stored
• Blocklist matching: Happens on DNS server (not logged)
• No personal data: DNS queries are not associated with accounts

​

Custom DNS vs. Mullvad DNS with Blockers

• Content blockers unavailable (custom DNS provider handles resolution)
• Privacy depends on custom DNS provider’s policy
• May have own blocking features (e.g., Cloudflare for Families)

• Mullvad’s no-logs policy
• Integrated blocking
• No third-party DNS provider

​

Best Practices

​

Recommended Configuration

mullvad dns set default \
  --block-ads \
  --block-trackers \
  --block-malware

• Ads and trackers violate privacy
• Malware blocking enhances security
• Minimal disruption to legitimate services

​

Advanced Configuration

mullvad dns set default \
  --block-ads \
  --block-trackers \
  --block-malware \
  --block-adult-content \
  --block-gambling \
  --block-social-media

• May break some website features
• Social logins won’t work
• Test critical services first

​

Testing Strategy

1. Start with minimal blocking: Only malware
2. Add ads and trackers: Evaluate browsing experience
3. Add optional blockers: If needed for specific use cases
4. Document issues: Note which sites require unblocking
5. Adjust as needed: Find balance between blocking and functionality

​

Related Features

• Custom DNS - Configure DNS settings and blockers
• Split Tunneling - DNS behavior with excluded apps
• WireGuard Protocol - Base VPN protocol
• Local Network Access - LAN connectivity settings

​

Technical Details

​

Implementation

pub struct DefaultDnsOptions {
    pub block_ads: bool,
    pub block_trackers: bool,
    pub block_malware: bool,
    pub block_adult_content: bool,
    pub block_gambling: bool,
    pub block_social_media: bool,
}

​

Blocklist Updates

• Automatic: Mullvad updates blocklists server-side
• No client action: Devices automatically get updated blocking
• Frequency: Regular updates (daily/weekly)
• Sources: Reputable threat intelligence and filter lists

​

Further Reading

• Mullvad DNS Documentation
• DNS-Based Content Filtering
• Browser Privacy Tools