Resolver upgrade, October 2026 October 24, 2026 2 min read

Your VPN's DNS just got a serious upgrade

Every name your device looks up over the VPN now goes through a resolver that checks answers are authentic, encrypts the trip to the internet, and blocks about 1.5 million ad, tracking and malware domains before they ever load. You did not have to change a thing.

Domains blocked at the resolver

1.54M

Two curated feeds, refreshed every 8 hours, held in memory for instant answers.

Ads, trackers, telemetry: 417K
Malware, phishing, scams: 1.13M

What you'll notice

Fewer ads and trackers on every device connected to the VPN, with no browser extension.
Malicious domains stop at the resolver. Phishing kits, malware hosts and scam sites return “no such name.”
Nothing to configure. Same VPN profile, same two DNS addresses, same experience.

Five upgrades in one cutover

Encrypted upstream

Lookups leave the resolver over DNS-over-TLS. Nobody between us and the internet sees them in plaintext anymore.

Authenticated answers

DNSSEC validation is on. A forged or tampered answer fails instead of being handed to your device.

Threat intelligence added

A security feed of 1.13 million malware, botnet and phishing domains now sits alongside the ad blocking.

Smaller attack surface

The web server, admin UI and certificate client are gone. The resolver is one daemon with no web pages to exploit.

Zero-downtime cutover

Replaced one host at a time. A working resolver answered at every step and client settings never changed.

Before and after

Capability	Before	Now
Ad and tracker blocking	Yes	Yes, larger curated feed
Malware and phishing blocking	Partial	Dedicated threat feed
Answers verified with DNSSEC	No	Yes
Encrypted to upstream resolvers	Plaintext	DNS-over-TLS
Minimises what upstreams learn about a query	No	Query name minimisation
Web admin pages exposed on the host	Yes, ports 80 and 443	None
Security patches applied automatically	Manual	Unattended upgrades
Change needed on your device		None

If something you need gets blocked

Curated feeds occasionally catch a legitimate name, most often a vendor’s telemetry endpoint that an app insists on. Tell us the domain. Allowing it is a two-line change that takes effect without a restart and survives every feed refresh.

What stays the same

The two DNS addresses in your VPN profile.
Private names for internal hosts resolve exactly as before.
Two resolvers in two availability zones, so one can be rebuilt without anyone noticing.

Figures measured on the live resolvers on 2026-10-24. Blocklists are Hagezi Multi PRO and Hagezi Threat Intelligence Feeds (medium). Blocking is a DNS NXDOMAIN response, not a block page. Query logs are not kept; only blocked-name events are retained, for one week, for troubleshooting.