DNS privacy and filtering services translate domain names into addresses and, depending on the product, add encryption, blocking of malware, trackers and advertising, and policy controls for households or organisations. They are used to protect home and office networks, enforce acceptable-use rules, reduce tracking and gain visibility of suspicious lookups. Google Public DNS and Cloudflare 1.1.1.1 are common reference points.
A resolver is a single point that sees the names of the services every device on a network uses, even when the content itself is encrypted. Where it runs, who operates it and what it retains therefore determine who could reconstruct usage patterns. Filtering adds a second concern: whoever maintains the blocklists decides what is reachable. Logging policies are hard to verify from outside, and encrypted-DNS settings built into browsers or devices can quietly send queries to a resolver outside the EU.
When choosing a European option, look for a published and specific retention policy, ideally checked by an independent audit, servers and an operating entity inside the EU, and support for encrypted protocols such as DNS over HTTPS and DNS over TLS. Check how blocklists are sourced, whether you can add your own rules, and whether the service can run inside your own network.