Three DNS postures, one tunnel

Every VPN sold as “three tiers” is quietly selling a bandwidth ladder: bronze is slow, silver is fine, gold is fast. Ours is not that. The tunnel is identical at every tier — same gateway, same shaping, up to 1 Gbit/s per connection on all three — and the price is the same $10/mo whichever you pick.

The only thing that changes is your DNS posture. That turns out to be the interesting part, because DNS names are the most revealing thing a network carries: they are unencrypted in the common case, they are written down by default, and they say what you were about to do before you did it.

pipe — the tunnel, and nothing else

The pipe configuration carries no DNS setting at all. Your device keeps the resolver it already runs, so lookups leave the tunnel and go to your ISP, your router, your browser’s built-in resolver — whoever was already answering.

• What changes: your traffic is tunnelled; your DNS is not.
• Who sees your lookups: exactly who saw them before you subscribed.
• Who does not: us. We are not in the path, and we do not learn the names.

That is the shape of it: pipe is the tier where you hand us the least. It is also the tier where a browser doing its own DNS-over-HTTPS can silently bypass your expectations of the tunnel, because the device still owns the decision.

privacy — our resolver, inside the tunnel

privacy puts a resolver at 172.16.40.1 — an address reachable only from inside the tunnel — and hands you that as your DNS server. Lookups go up the tunnel to it, and it forwards upstream over DNS-over-TLS, so the last leg is encrypted too.

• What changes: your lookups stop being visible to the network you are on.
• Who sees your lookups: us, in the sense that our resolver answers them — and this is the part that matters, so read the next paragraph rather than the bullet.
• What we do with them: the resolver runs with its query log disabled and its statistics disabled. No name in a log, no counts to aggregate. That is stated with the rest of the retention list on what we log and re-asserted by the daily signed audit rather than by prose.

This is the tier where “we keep no logs” stops being a claim about our good intentions and becomes something with machinery behind it: a check re-applies the setting, sends a real query through the resolver, injects a canary name that cannot occur by accident, and then requires that nothing was written. If a log appears, the check fails and a failing report is still signed and published at its URL before the unit fails — a violation is a published violation, not a quietly deleted one. The full mechanism, and how to fetch and verify it yourself, is on the audit page.

security — the same resolver, with a filter in front

security is privacy plus AdGuard Home at 172.16.41.1, with filter lists that block ads, trackers and known-malware domains before your device ever connects to them.

• What changes: a large part of the web’s background noise never resolves.
• Who sees your lookups: the same answer as privacy — the resolver inside the tunnel, without query logs or statistics.
• What it costs you: a filter is an opinion. A name on a list is a site that does not open, and the list is not always right. If a page fails to load and you cannot explain why, this tier is the first thing to rule out — switch that one device to privacy and try again.

Where the tier is chosen

Per device. One subscription runs a laptop on privacy, a phone on security and a work machine on pipe, three devices per account, each with its own assignment in the portal. You are not choosing a plan; you are choosing how much of your DNS to hand us, one device at a time.

Checking that it is actually in force

Do not take the tier name on a portal page as evidence.

The portal includes a DNS leak test that mints a unique probe name, has your browser look it up, and then checks whether that lookup reached our resolver inside the tunnel. A name invented for that one test cannot be in any cache and cannot be in any list, so where it shows up is a real answer — including when the answer is “it did not arrive here”.

If you want to check by hand instead: pipe leaves your configured resolver alone, privacy and security point it at a 172.16.x.x address that is only reachable while the tunnel is up. The technical dossier documents the resolver mechanics in full.

What no tier does

Being straight about the edges:

• It is not a geo-unblocking service. One gateway, one exit, no rotating addresses, no residential proxies. Your traffic exits in Canada, which is a feature if that is where you want it to exit, and not one if you were hoping to look like you are elsewhere.
• DNS is not the whole story. A site you log in to still knows who you are. A browser can still be fingerprinted. security blocks names, not malware that is already on your disk. The list of things a tunnel cannot fix is on what we log, and it is a real list.
• pipe is a legitimate choice. If you already run your own resolver and you trust it more than a provider you have never met, that is the tier built for you, and it is not a downgrade.