Browser Compartmentalization and Mullvad Browser settings

I also answered on the other thread, so let me quote myself:

This is mainly for two reasons:

  • performance: DNS requests sent through DoH are anycasted, so you can’t be sure they will take the shortest path, and using the same server as the VPN tunnel will ensure you get the fastest response
  • potential detection of VPN: some services will look for mismatch between DNS requests and other types of request and might block you from using their services

As a Mullvad VPN user, there’s no advantage to use DoH when connected. DoH is there by default because we can’t assume Mullvad Browser users are using a VPN and DNS requests are encrypted.

In terms of privacy, in most case it shouldn’t matter much, because in both cases requests are encrypted.

To answer your queries, a website will be able to detect that there is a mismatch when you use a VPN connection and a DoH service that is not “matching” (for example Mullvad VPN and a DoH or another VPN and Mullvad DoH).

It’s up to you to decide whether that’s an issue based on your threat model. Usually, if you trust a VPN, you should trust them to also deal with DNS requests correctly. If that’s the case, then there’s no good reason to use DoH on top of it.

3 Likes