It annoys me so much that only Android gives me the flexibility and power of ProtonVPN and NextDNS together without any compromises done through native settings. Proton with superior VPN service and NextDNS straight in Android with superior filtering service. Which I can't use easily on Windows without running multiple programs together like ProtonVPN+YogaDNS which I don't like.
Why can we only input unencrypted IP4 and/or IP6 DNS address into ProtonVPN, but we can't simply input encrypted DoT/DoQ/DoH DNS address and retain filtering capability through customizable profiles offered by the DNS service?
Sure, there is NetShield that works, but I have absolutely no idea how effective really is and I have no monitoring capability of actually seeing what my connection is doing. Beecause of this I'm forced to use HaGeZi DNS server that only runs Pro block list which is weaker than the Ultimate that I otherwise use and I have no monitoring oversight over my connection with it.
All this could be entirely solved if we could just input DoT/DoQ/DoH of the DNS directly into ProtonVPN. Come on Proton, please add this already to your VPN.
DoT/DoQ/DoH can cause trouble in a VPN connection and slow it down. AdguardVPN offers the option and they wrote their own protocol called TrustTunnel (it is open source since beginning of this year). I used AdguardVPN for a while and it regularly slows down the connection a lot. I activate DoH in my browser when I think I need it. Also, using a different DNS Server can be a way to help fingerprinting you. I also were keen to find a VPN with DoT/DoQ/DoH but now I'm glad Proton puts security and speed over one feature that can cause a lot of problems. And yes, they could try to put TrustTunnel in their service. But as many people always come back to the Russian connection of Adguard this will also give a backslash. There as to be a good reason why Mullvad and IVPN also don't offer to change the DNS Server to DoT/DoQ/DoH.
If you use MacOS or iOS you can try Passepartout from the App Store. You can set up a wireguard connection and also set a DNS Server with encryption. But often you manually have to change the wireguard profile to make it work. And this also with some downsides. Check the reddit forum for support.
Also, if you use a VPN it should be quite difficult to identify you if you use a non encrypted DNS server. You have to trust Proton already that they don't protocol your connection. And the DNS server only sees the Proton IP address. If you are based in Europe you can try https://dnsforge.de/ with the hard option. This includes HaGeZi Ultimate.
( I don't work for Proton and have no connection to them other than using their products. )
save