A single Hacker News thread titled “Tailscale with Mullvad leaks your DNS” does not prove that any specific VPN or setup always leaks DNS.
What the HN signal actually says
A Hacker News mention observed on 2026-07-30 had:
- Title: “Tailscale with Mullvad leaks your DNS”
- A matched term of “Mullvad”
- Zero comments at the time of observation
- A link to a GitHub issue
From this, we can safely say:
- There was a discussion prompt about a possible DNS-leak scenario when using Tailscale with Mullvad.
- The content of the GitHub issue itself is not part of the available sources here, so we cannot describe its technical details or conclusions.
- We cannot generalize from this single mention to claim that “VPNs leak DNS” in general.
How Casper's Cloak approaches network protection
Casper's Cloak is positioned as an AI-enhanced privacy and network-security platform for iPhone, Android, and Mac users. It is not positioned as only a VPN; a VPN is one of the tools it uses.
Casper combines:
- Encrypted transport: a WireGuard VPN encryption tunnel, including public-Wi-Fi protection and kill-switch-style tunnel hardening.
- DNS/network filtering: DNS-level filtering and blocking, running server-side on Casper's managed VPN exit servers.
- AI threat detection: an AI security layer that performs real-time analysis of network connections, with machine-learning threat detection, zero-day phishing detection, malware detection and blocking, domain-reputation analysis, and real-time threat classification using connection and domain features.
- Anti-tracking and privacy: system-wide ad and tracker blocking across apps, traffic camouflage and decoy traffic (Phantom Barriers), and protection against browsing-pattern analysis.
Casper is a hybrid design: it combines on-device threat detection with server-side DNS and network filtering and routes traffic through an encrypted WireGuard tunnel.
User control: Smart Bypass and split tunneling
Casper's design emphasizes user control over routing:
- Smart Bypass is a user-configured exclusion list.
- You can enable service presets and/or add custom domains and IP ranges.
- Those destinations are then excluded from the tunnel.
- It is not automatic and does not classify individual flows.
- Split Tunneling in Casper supports domain-based and IP-based exclusion using the same live path as Smart Bypass.
The honest framing is user control: you choose what leaves the tunnel.
Sensitive destinations and decoy cover
Casper includes Sensitive Site Detection for certain categories:
- When a banking, healthcare, government, or cryptocurrency destination is observed by DNS inside the tunnel, Casper:
- Raises an in-app advisory, and
- Automatically triggers Phantom Barriers decoy traffic to cover the visit.
- The tunnel itself is never altered, re-keyed, re-routed, or otherwise changed for these sites.
- For banking, the in-app advisory currently recommends disconnecting from the VPN before accessing banking.
If a user chooses to place a banking domain into Smart Bypass:
- That destination will leave the encrypted tunnel.
- It will also lose decoy cover, because Sensitive Site Detection only observes DNS for destinations still inside the tunnel.
Why this matters for VPN and DNS discussions
The HN thread about “Tailscale with Mullvad leaks your DNS” is a discussion prompt about a possible DNS-leak scenario when using Tailscale with Mullvad.
Casper's Cloak focuses on:
- Combining encrypted transport with DNS-level filtering and an AI threat-detection layer
- Giving users explicit control over what stays inside or outside the tunnel via Smart Bypass and split tunneling
- Providing anti-tracking and decoy-traffic features to protect against tracking and browsing-pattern analysis
For more details on Casper's capabilities and plans, visit casperscloak.com.