Merge branch 'yank-domain-fronting-2026.3' into prepare-2026.3test-2026.3-beta1-rc2

14 files changed, 72 insertions, 362 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 384bee34ed..6ffa474a9c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -27,7 +27,6 @@ Line wrap the file at 100 chars.                                              Th
 - Add list of recent server selections in the select location view.
 - GotaTun is now used as the userspace WireGuard implementation on all desktop platforms, not just
   macOS. It replaces wireguard-go.
-- Add support for API access method based on domain fronting.
 
 ### Changed
 - Optimize LWO performance. This gives a 1.5 to 3 times speedup in our benchmarks.
diff --git a/desktop/packages/management-interface/dist/management_interface_pb.d.ts b/desktop/packages/management-interface/dist/management_interface_pb.d.ts
index c5f1091b70..5879581506 100644
--- a/desktop/packages/management-interface/dist/management_interface_pb.d.ts
+++ b/desktop/packages/management-interface/dist/management_interface_pb.d.ts
@@ -1509,11 +1509,6 @@ export class AccessMethod extends jspb.Message {
     getCustom(): CustomProxy | undefined;
     setCustom(value?: CustomProxy): AccessMethod;
 
-    hasDomainFronting(): boolean;
-    clearDomainFronting(): void;
-    getDomainFronting(): AccessMethod.DomainFronting | undefined;
-    setDomainFronting(value?: AccessMethod.DomainFronting): AccessMethod;
-
     getAccessMethodCase(): AccessMethod.AccessMethodCase;
 
     serializeBinary(): Uint8Array;
@@ -1532,7 +1527,6 @@ export namespace AccessMethod {
         bridges?: AccessMethod.Bridges.AsObject,
         encryptedDnsProxy?: AccessMethod.EncryptedDnsProxy.AsObject,
         custom?: CustomProxy.AsObject,
-        domainFronting?: AccessMethod.DomainFronting.AsObject,
     }
 
 
@@ -1587,23 +1581,6 @@ export namespace AccessMethod {
         }
     }
 
-    export class DomainFronting extends jspb.Message { 
-
-        serializeBinary(): Uint8Array;
-        toObject(includeInstance?: boolean): DomainFronting.AsObject;
-        static toObject(includeInstance: boolean, msg: DomainFronting): DomainFronting.AsObject;
-        static extensions: {[key: number]: jspb.ExtensionFieldInfo<jspb.Message>};
-        static extensionsBinary: {[key: number]: jspb.ExtensionFieldBinaryInfo<jspb.Message>};
-        static serializeBinaryToWriter(message: DomainFronting, writer: jspb.BinaryWriter): void;
-        static deserializeBinary(bytes: Uint8Array): DomainFronting;
-        static deserializeBinaryFromReader(message: DomainFronting, reader: jspb.BinaryReader): DomainFronting;
-    }
-
-    export namespace DomainFronting {
-        export type AsObject = {
-        }
-    }
-
 
     export enum AccessMethodCase {
         ACCESS_METHOD_NOT_SET = 0,
@@ -1611,7 +1588,6 @@ export namespace AccessMethod {
         BRIDGES = 2,
         ENCRYPTED_DNS_PROXY = 3,
         CUSTOM = 4,
-        DOMAIN_FRONTING = 5,
     }
 
 }
@@ -1701,11 +1677,6 @@ export class ApiAccessMethodSettings extends jspb.Message {
     setCustomList(value: Array<AccessMethodSetting>): ApiAccessMethodSettings;
     addCustom(value?: AccessMethodSetting, index?: number): AccessMethodSetting;
 
-    hasDomainFronting(): boolean;
-    clearDomainFronting(): void;
-    getDomainFronting(): AccessMethodSetting | undefined;
-    setDomainFronting(value?: AccessMethodSetting): ApiAccessMethodSettings;
-
     serializeBinary(): Uint8Array;
     toObject(includeInstance?: boolean): ApiAccessMethodSettings.AsObject;
     static toObject(includeInstance: boolean, msg: ApiAccessMethodSettings): ApiAccessMethodSettings.AsObject;
@@ -1722,7 +1693,6 @@ export namespace ApiAccessMethodSettings {
         mullvadBridges?: AccessMethodSetting.AsObject,
         encryptedDnsProxy?: AccessMethodSetting.AsObject,
         customList: Array<AccessMethodSetting.AsObject>,
-        domainFronting?: AccessMethodSetting.AsObject,
     }
 }
 
diff --git a/desktop/packages/management-interface/dist/management_interface_pb.js b/desktop/packages/management-interface/dist/management_interface_pb.js
index 482ea0dff7..d97b049cc4 100644
--- a/desktop/packages/management-interface/dist/management_interface_pb.js
+++ b/desktop/packages/management-interface/dist/management_interface_pb.js
@@ -33,7 +33,6 @@ goog.exportSymbol('proto.mullvad_daemon.management_interface.AccessMethod', null
 goog.exportSymbol('proto.mullvad_daemon.management_interface.AccessMethod.AccessMethodCase', null, global);
 goog.exportSymbol('proto.mullvad_daemon.management_interface.AccessMethod.Bridges', null, global);
 goog.exportSymbol('proto.mullvad_daemon.management_interface.AccessMethod.Direct', null, global);
-goog.exportSymbol('proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting', null, global);
 goog.exportSymbol('proto.mullvad_daemon.management_interface.AccessMethod.EncryptedDnsProxy', null, global);
 goog.exportSymbol('proto.mullvad_daemon.management_interface.AccessMethodSetting', null, global);
 goog.exportSymbol('proto.mullvad_daemon.management_interface.AccountAndDevice', null, global);
@@ -1267,27 +1266,6 @@ if (goog.DEBUG && !COMPILED) {
  * @extends {jspb.Message}
  * @constructor
  */
-proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting = function(opt_data) {
-  jspb.Message.initialize(this, opt_data, 0, -1, null, null);
-};
-goog.inherits(proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting, jspb.Message);
-if (goog.DEBUG && !COMPILED) {
-  /**
-   * @public
-   * @override
-   */
-  proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting.displayName = 'proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting';
-}
-/**
- * Generated by JsPbCodeGenerator.
- * @param {Array=} opt_data Optional initial data array, typically from a
- * server response, or constructed directly in Javascript. The array is used
- * in place and becomes part of the constructed object. It is not cloned.
- * If no data is provided, the constructed object will be empty, but still
- * valid.
- * @extends {jspb.Message}
- * @constructor
- */
 proto.mullvad_daemon.management_interface.AccessMethodSetting = function(opt_data) {
   jspb.Message.initialize(this, opt_data, 0, -1, null, null);
 };
@@ -12332,7 +12310,7 @@ proto.mullvad_daemon.management_interface.CustomProxy.prototype.hasShadowsocks =
  * @private {!Array<!Array<number>>}
  * @const
  */
-proto.mullvad_daemon.management_interface.AccessMethod.oneofGroups_ = [[1,2,3,4,5]];
+proto.mullvad_daemon.management_interface.AccessMethod.oneofGroups_ = [[1,2,3,4]];
 
 /**
  * @enum {number}
@@ -12342,8 +12320,7 @@ proto.mullvad_daemon.management_interface.AccessMethod.AccessMethodCase = {
   DIRECT: 1,
   BRIDGES: 2,
   ENCRYPTED_DNS_PROXY: 3,
-  CUSTOM: 4,
-  DOMAIN_FRONTING: 5
+  CUSTOM: 4
 };
 
 /**
@@ -12387,8 +12364,7 @@ proto.mullvad_daemon.management_interface.AccessMethod.toObject = function(inclu
     direct: (f = msg.getDirect()) && proto.mullvad_daemon.management_interface.AccessMethod.Direct.toObject(includeInstance, f),
     bridges: (f = msg.getBridges()) && proto.mullvad_daemon.management_interface.AccessMethod.Bridges.toObject(includeInstance, f),
     encryptedDnsProxy: (f = msg.getEncryptedDnsProxy()) && proto.mullvad_daemon.management_interface.AccessMethod.EncryptedDnsProxy.toObject(includeInstance, f),
-    custom: (f = msg.getCustom()) && proto.mullvad_daemon.management_interface.CustomProxy.toObject(includeInstance, f),
-    domainFronting: (f = msg.getDomainFronting()) && proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting.toObject(includeInstance, f)
+    custom: (f = msg.getCustom()) && proto.mullvad_daemon.management_interface.CustomProxy.toObject(includeInstance, f)
   };
 
   if (includeInstance) {
@@ -12445,11 +12421,6 @@ proto.mullvad_daemon.management_interface.AccessMethod.deserializeBinaryFromRead
       reader.readMessage(value,proto.mullvad_daemon.management_interface.CustomProxy.deserializeBinaryFromReader);
       msg.setCustom(value);
       break;
-    case 5:
-      var value = new proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting;
-      reader.readMessage(value,proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting.deserializeBinaryFromReader);
-      msg.setDomainFronting(value);
-      break;
     default:
       reader.skipField();
       break;
@@ -12511,14 +12482,6 @@ proto.mullvad_daemon.management_interface.AccessMethod.serializeBinaryToWriter =
       proto.mullvad_daemon.management_interface.CustomProxy.serializeBinaryToWriter
     );
   }
-  f = message.getDomainFronting();
-  if (f != null) {
-    writer.writeMessage(
-      5,
-      f,
-      proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting.serializeBinaryToWriter
-    );
-  }
 };
 
 
@@ -12825,107 +12788,6 @@ proto.mullvad_daemon.management_interface.AccessMethod.EncryptedDnsProxy.seriali
 };
 
 
-
-
-
-if (jspb.Message.GENERATE_TO_OBJECT) {
-/**
- * Creates an object representation of this proto.
- * Field names that are reserved in JavaScript and will be renamed to pb_name.
- * Optional fields that are not set will be set to undefined.
- * To access a reserved field use, foo.pb_<name>, eg, foo.pb_default.
- * For the list of reserved names please see:
- *     net/proto2/compiler/js/internal/generator.cc#kKeyword.
- * @param {boolean=} opt_includeInstance Deprecated. whether to include the
- *     JSPB instance for transitional soy proto support:
- *     http://goto/soy-param-migration
- * @return {!Object}
- */
-proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting.prototype.toObject = function(opt_includeInstance) {
-  return proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting.toObject(opt_includeInstance, this);
-};
-
-
-/**
- * Static version of the {@see toObject} method.
- * @param {boolean|undefined} includeInstance Deprecated. Whether to include
- *     the JSPB instance for transitional soy proto support:
- *     http://goto/soy-param-migration
- * @param {!proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting} msg The msg instance to transform.
- * @return {!Object}
- * @suppress {unusedLocalVariables} f is only used for nested messages
- */
-proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting.toObject = function(includeInstance, msg) {
-  var f, obj = {
-
-  };
-
-  if (includeInstance) {
-    obj.$jspbMessageInstance = msg;
-  }
-  return obj;
-};
-}
-
-
-/**
- * Deserializes binary data (in protobuf wire format).
- * @param {jspb.ByteSource} bytes The bytes to deserialize.
- * @return {!proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting}
- */
-proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting.deserializeBinary = function(bytes) {
-  var reader = new jspb.BinaryReader(bytes);
-  var msg = new proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting;
-  return proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting.deserializeBinaryFromReader(msg, reader);
-};
-
-
-/**
- * Deserializes binary data (in protobuf wire format) from the
- * given reader into the given message object.
- * @param {!proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting} msg The message object to deserialize into.
- * @param {!jspb.BinaryReader} reader The BinaryReader to use.
- * @return {!proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting}
- */
-proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting.deserializeBinaryFromReader = function(msg, reader) {
-  while (reader.nextField()) {
-    if (reader.isEndGroup()) {
-      break;
-    }
-    var field = reader.getFieldNumber();
-    switch (field) {
-    default:
-      reader.skipField();
-      break;
-    }
-  }
-  return msg;
-};
-
-
-/**
- * Serializes the message to binary data (in protobuf wire format).
- * @return {!Uint8Array}
- */
-proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting.prototype.serializeBinary = function() {
-  var writer = new jspb.BinaryWriter();
-  proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting.serializeBinaryToWriter(this, writer);
-  return writer.getResultBuffer();
-};
-
-
-/**
- * Serializes the given message to binary data (in protobuf wire
- * format), writing to the given BinaryWriter.
- * @param {!proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting} message
- * @param {!jspb.BinaryWriter} writer
- * @suppress {unusedLocalVariables} f is only used for nested messages
- */
-proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting.serializeBinaryToWriter = function(message, writer) {
-  var f = undefined;
-};
-
-
 /**
  * optional Direct direct = 1;
  * @return {?proto.mullvad_daemon.management_interface.AccessMethod.Direct}
@@ -13074,43 +12936,6 @@ proto.mullvad_daemon.management_interface.AccessMethod.prototype.hasCustom = fun
 };
 
 
-/**
- * optional DomainFronting domain_fronting = 5;
- * @return {?proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting}
- */
-proto.mullvad_daemon.management_interface.AccessMethod.prototype.getDomainFronting = function() {
-  return /** @type{?proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting} */ (
-    jspb.Message.getWrapperField(this, proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting, 5));
-};
-
-
-/**
- * @param {?proto.mullvad_daemon.management_interface.AccessMethod.DomainFronting|undefined} value
- * @return {!proto.mullvad_daemon.management_interface.AccessMethod} returns this
-*/
-proto.mullvad_daemon.management_interface.AccessMethod.prototype.setDomainFronting = function(value) {
-  return jspb.Message.setOneofWrapperField(this, 5, proto.mullvad_daemon.management_interface.AccessMethod.oneofGroups_[0], value);
-};
-
-
-/**
- * Clears the message field making it undefined.
- * @return {!proto.mullvad_daemon.management_interface.AccessMethod} returns this
- */
-proto.mullvad_daemon.management_interface.AccessMethod.prototype.clearDomainFronting = function() {
-  return this.setDomainFronting(undefined);
-};
-
-
-/**
- * Returns whether this field is set.
- * @return {boolean}
- */
-proto.mullvad_daemon.management_interface.AccessMethod.prototype.hasDomainFronting = function() {
-  return jspb.Message.getField(this, 5) != null;
-};
-
-
 
 
 
@@ -13627,8 +13452,7 @@ proto.mullvad_daemon.management_interface.ApiAccessMethodSettings.toObject = fun
     mullvadBridges: (f = msg.getMullvadBridges()) && proto.mullvad_daemon.management_interface.AccessMethodSetting.toObject(includeInstance, f),
     encryptedDnsProxy: (f = msg.getEncryptedDnsProxy()) && proto.mullvad_daemon.management_interface.AccessMethodSetting.toObject(includeInstance, f),
     customList: jspb.Message.toObjectList(msg.getCustomList(),
-    proto.mullvad_daemon.management_interface.AccessMethodSetting.toObject, includeInstance),
-    domainFronting: (f = msg.getDomainFronting()) && proto.mullvad_daemon.management_interface.AccessMethodSetting.toObject(includeInstance, f)
+    proto.mullvad_daemon.management_interface.AccessMethodSetting.toObject, includeInstance)
   };
 
   if (includeInstance) {
@@ -13685,11 +13509,6 @@ proto.mullvad_daemon.management_interface.ApiAccessMethodSettings.deserializeBin
       reader.readMessage(value,proto.mullvad_daemon.management_interface.AccessMethodSetting.deserializeBinaryFromReader);
       msg.addCustom(value);
       break;
-    case 5:
-      var value = new proto.mullvad_daemon.management_interface.AccessMethodSetting;
-      reader.readMessage(value,proto.mullvad_daemon.management_interface.AccessMethodSetting.deserializeBinaryFromReader);
-      msg.setDomainFronting(value);
-      break;
     default:
       reader.skipField();
       break;
@@ -13751,14 +13570,6 @@ proto.mullvad_daemon.management_interface.ApiAccessMethodSettings.serializeBinar
       proto.mullvad_daemon.management_interface.AccessMethodSetting.serializeBinaryToWriter
     );
   }
-  f = message.getDomainFronting();
-  if (f != null) {
-    writer.writeMessage(
-      5,
-      f,
-      proto.mullvad_daemon.management_interface.AccessMethodSetting.serializeBinaryToWriter
-    );
-  }
 };
 
 
@@ -13911,43 +13722,6 @@ proto.mullvad_daemon.management_interface.ApiAccessMethodSettings.prototype.clea
 };
 
 
-/**
- * optional AccessMethodSetting domain_fronting = 5;
- * @return {?proto.mullvad_daemon.management_interface.AccessMethodSetting}
- */
-proto.mullvad_daemon.management_interface.ApiAccessMethodSettings.prototype.getDomainFronting = function() {
-  return /** @type{?proto.mullvad_daemon.management_interface.AccessMethodSetting} */ (
-    jspb.Message.getWrapperField(this, proto.mullvad_daemon.management_interface.AccessMethodSetting, 5));
-};
-
-
-/**
- * @param {?proto.mullvad_daemon.management_interface.AccessMethodSetting|undefined} value
- * @return {!proto.mullvad_daemon.management_interface.ApiAccessMethodSettings} returns this
-*/
-proto.mullvad_daemon.management_interface.ApiAccessMethodSettings.prototype.setDomainFronting = function(value) {
-  return jspb.Message.setWrapperField(this, 5, value);
-};
-
-
-/**
- * Clears the message field making it undefined.
- * @return {!proto.mullvad_daemon.management_interface.ApiAccessMethodSettings} returns this
- */
-proto.mullvad_daemon.management_interface.ApiAccessMethodSettings.prototype.clearDomainFronting = function() {
-  return this.setDomainFronting(undefined);
-};
-
-
-/**
- * Returns whether this field is set.
- * @return {boolean}
- */
-proto.mullvad_daemon.management_interface.ApiAccessMethodSettings.prototype.hasDomainFronting = function() {
-  return jspb.Message.getField(this, 5) != null;
-};
-
-
 
 /**
  * List of repeated fields within this message type.
diff --git a/desktop/packages/mullvad-vpn/changes.txt b/desktop/packages/mullvad-vpn/changes.txt
index 739a1782a9..218942cc46 100644
--- a/desktop/packages/mullvad-vpn/changes.txt
+++ b/desktop/packages/mullvad-vpn/changes.txt
@@ -1,5 +1,4 @@
 [macOS] The Desktop app GUI is automatically restarted after an update, if it was running.
 Add list of recent server selections in the "Select location" view.
-Add new API access method based on domain fronting.
 GotaTun is now used as the userspace WireGuard implementation on all desktop platforms.
 Add port setting for the LWO Anti-censorship method.
diff --git a/desktop/packages/mullvad-vpn/locales/messages.pot b/desktop/packages/mullvad-vpn/locales/messages.pot
index ca8e8b5382..b9197ba0b1 100644
--- a/desktop/packages/mullvad-vpn/locales/messages.pot
+++ b/desktop/packages/mullvad-vpn/locales/messages.pot
@@ -728,14 +728,6 @@ msgctxt "api-access-methods-view"
 msgid "The API could not be reached using the %(name)s method."
 msgstr ""
 
-#. Part of a description of the 'Domain fronting' API access method
-#. which the app uses to reach Mullvad's API servers
-#. Available placeholders:
-#. %(domainFronting)s - Will be replaced with: 'Domain fronting'
-msgctxt "api-access-methods-view"
-msgid "The app communicates with a Mullvad API server via %(domainFronting)s."
-msgstr ""
-
 msgctxt "api-access-methods-view"
 msgid "The app needs the remote server details, where your local SOCKS5 server will forward your traffic."
 msgstr ""
@@ -744,12 +736,6 @@ msgctxt "api-access-methods-view"
 msgid "The app needs to communicate with a Mullvad API server to log you in, fetch server lists, and other critical operations."
 msgstr ""
 
-#. Part of a description of the 'Domain fronting' API access method
-#. which the app uses to reach Mullvad's API servers
-msgctxt "api-access-methods-view"
-msgid "The CDN used is Datapacket’s CDN77. The CDN can only observe the proxied TLS traffic, not the contents."
-msgstr ""
-
 msgctxt "api-access-methods-view"
 msgid "The in use API access method will change."
 msgstr ""
@@ -762,12 +748,6 @@ msgctxt "api-access-methods-view"
 msgid "This can be useful if the API is censored but Mullvad’s bridge servers are not."
 msgstr ""
 
-#. Part of a description of the 'Domain fronting' API access method
-#. which the app uses to reach Mullvad's API servers
-msgctxt "api-access-methods-view"
-msgid "This can be useful when direct access and other methods are blocked by censorship."
-msgstr ""
-
 msgctxt "api-access-methods-view"
 msgid "This can be useful when you are not affected by censorship."
 msgstr ""
@@ -796,14 +776,6 @@ msgctxt "api-access-methods-view"
 msgid "With the “Mullvad bridges” method, the app communicates with a Mullvad API server via a Mullvad bridge server. It does this by sending the traffic obfuscated by Shadowsocks."
 msgstr ""
 
-#. Part of a description of the 'Domain fronting' API access method
-#. which the app uses to reach Mullvad's API servers
-#. Available placeholders:
-#. %(domainFronting)s - Will be replaced with: 'Domain fronting'
-msgctxt "api-access-methods-view"
-msgid "With the %(domainFronting)s access method, the app reaches the Mullvad API via a CDN, mixing the traffic with a lot of other internet traffic, making it more difficult to censor."
-msgstr ""
-
 #. Title of the app info view.
 msgctxt "app-info-view"
 msgid "App info"
diff --git a/desktop/packages/mullvad-vpn/src/main/default-settings.ts b/desktop/packages/mullvad-vpn/src/main/default-settings.ts
index 7ba6fec984..548d850d19 100644
--- a/desktop/packages/mullvad-vpn/src/main/default-settings.ts
+++ b/desktop/packages/mullvad-vpn/src/main/default-settings.ts
@@ -99,12 +99,12 @@ export function getDefaultApiAccessMethods(): ApiAccessMethodSettings {
       enabled: false,
       type: 'encrypted-dns-proxy',
     },
-    domainFronting: {
-      id: '',
-      enabled: false,
-      name: 'Domain fronting',
-      type: 'domain-fronting',
-    },
+    // domainFronting: {
+    //   id: '',
+    //   enabled: false,
+    //   name: 'Domain fronting',
+    //   type: 'domain-fronting',
+    // },
     custom: [],
   };
 }
diff --git a/desktop/packages/mullvad-vpn/src/main/grpc-type-convertions.ts b/desktop/packages/mullvad-vpn/src/main/grpc-type-convertions.ts
index bc67051a94..d763cfed9a 100644
--- a/desktop/packages/mullvad-vpn/src/main/grpc-type-convertions.ts
+++ b/desktop/packages/mullvad-vpn/src/main/grpc-type-convertions.ts
@@ -17,7 +17,6 @@ import {
   DeviceEvent,
   DeviceState,
   DirectMethod,
-  DomainFronting,
   EncryptedDnsProxy,
   EndpointObfuscationType,
   ErrorStateCause,
@@ -1042,11 +1041,11 @@ function fillApiAccessMethodSetting<T extends grpcTypes.NewAccessMethodSetting>(
       accessMethod.setEncryptedDnsProxy(encryptedDnsProxy);
       break;
     }
-    case 'domain-fronting': {
-      const domainFronting = new grpcTypes.AccessMethod.DomainFronting();
-      accessMethod.setDomainFronting(domainFronting);
-      break;
-    }
+    // case 'domain-fronting': {
+    //   const domainFronting = new grpcTypes.AccessMethod.DomainFronting();
+    //   accessMethod.setDomainFronting(domainFronting);
+    //   break;
+    // }
     default:
       accessMethod.setCustom(convertToCustomProxy(method));
   }
@@ -1116,9 +1115,9 @@ function convertFromApiAccessMethodSettings(
       "no 'Encrypted DNS proxy' access method was found",
     ),
   ) as AccessMethodSetting<EncryptedDnsProxy>;
-  const domainFronting = convertFromApiAccessMethodSetting(
-    ensureExists(accessMethods.getDomainFronting(), "no 'Domain fronting' access method was found"),
-  ) as AccessMethodSetting<DomainFronting>;
+  // const domainFronting = convertFromApiAccessMethodSetting(
+  //   ensureExists(accessMethods.getDomainFronting(), "no 'Domain fronting' access method was found"),
+  // ) as AccessMethodSetting<DomainFronting>;
   const custom = accessMethods
     .getCustomList()
     .filter((setting) => setting.hasId() && setting.hasAccessMethod())
@@ -1130,7 +1129,7 @@ function convertFromApiAccessMethodSettings(
     direct,
     mullvadBridges: bridges,
     encryptedDnsProxy,
-    domainFronting,
+    // domainFronting,
     custom,
   };
 }
@@ -1167,8 +1166,8 @@ function convertFromAccessMethod(method: grpcTypes.AccessMethod): AccessMethod {
       return { type: 'bridges' };
     case grpcTypes.AccessMethod.AccessMethodCase.ENCRYPTED_DNS_PROXY:
       return { type: 'encrypted-dns-proxy' };
-    case grpcTypes.AccessMethod.AccessMethodCase.DOMAIN_FRONTING:
-      return { type: 'domain-fronting' };
+    // case grpcTypes.AccessMethod.AccessMethodCase.DOMAIN_FRONTING:
+    //   return { type: 'domain-fronting' };
     case grpcTypes.AccessMethod.AccessMethodCase.CUSTOM: {
       return convertFromCustomProxy(method.getCustom()!);
     }
diff --git a/desktop/packages/mullvad-vpn/src/renderer/components/views/api-access/ApiAccessView.tsx b/desktop/packages/mullvad-vpn/src/renderer/components/views/api-access/ApiAccessView.tsx
index 074fb8726e..b16cb53758 100644
--- a/desktop/packages/mullvad-vpn/src/renderer/components/views/api-access/ApiAccessView.tsx
+++ b/desktop/packages/mullvad-vpn/src/renderer/components/views/api-access/ApiAccessView.tsx
@@ -2,7 +2,6 @@ import { useCallback, useMemo } from 'react';
 import { sprintf } from 'sprintf-js';
 import styled from 'styled-components';
 
-import { strings } from '../../../../shared/constants';
 import { AccessMethodSetting } from '../../../../shared/daemon-rpc-types';
 import { messages } from '../../../../shared/gettext';
 import { RoutePath } from '../../../../shared/routes';
@@ -116,10 +115,12 @@ export function ApiAccessView() {
                     method={methods.encryptedDnsProxy}
                     inUse={methods.encryptedDnsProxy.id === currentMethod?.id}
                   />
+                  {/*
                   <ApiAccessMethod
                     method={methods.domainFronting}
                     inUse={methods.domainFronting.id === currentMethod?.id}
                   />
+                  */}
                   {methods.custom.map((method) => (
                     <ApiAccessMethod
                       key={method.id}
@@ -280,7 +281,6 @@ function ApiAccessMethod(props: ApiAccessMethodProps) {
             ]}
           />
         )}
-
         {props.method.type === 'encrypted-dns-proxy' && (
           <InfoButton
             message={[
@@ -295,6 +295,7 @@ function ApiAccessMethod(props: ApiAccessMethodProps) {
             ]}
           />
         )}
+        {/*
         {props.method.type === 'domain-fronting' && (
           <InfoButton
             message={[
@@ -339,6 +340,7 @@ function ApiAccessMethod(props: ApiAccessMethodProps) {
             ]}
           />
         )}
+        */}
         <ContextMenuContainer>
           <ContextMenuTrigger />
           <ContextMenu items={menuItems} align="right" />
diff --git a/desktop/packages/mullvad-vpn/src/shared/daemon-rpc-types.ts b/desktop/packages/mullvad-vpn/src/shared/daemon-rpc-types.ts
index 07e32ac75b..8526521df3 100644
--- a/desktop/packages/mullvad-vpn/src/shared/daemon-rpc-types.ts
+++ b/desktop/packages/mullvad-vpn/src/shared/daemon-rpc-types.ts
@@ -567,12 +567,8 @@ export type BridgesMethod = { type: 'bridges' };
 export type EncryptedDnsProxy = { type: 'encrypted-dns-proxy' };
 export type DomainFronting = { type: 'domain-fronting' };
 
-export type AccessMethod =
-  | DirectMethod
-  | BridgesMethod
-  | EncryptedDnsProxy
-  | CustomProxy
-  | DomainFronting;
+export type AccessMethod = DirectMethod | BridgesMethod | EncryptedDnsProxy | CustomProxy;
+// | DomainFronting;
 
 export type NamedAccessMethod<T extends AccessMethod> = T & { name: string };
 
@@ -589,7 +585,7 @@ export type ApiAccessMethodSettings = {
   direct: AccessMethodSetting<DirectMethod>;
   mullvadBridges: AccessMethodSetting<BridgesMethod>;
   encryptedDnsProxy: AccessMethodSetting<EncryptedDnsProxy>;
-  domainFronting: AccessMethodSetting<DomainFronting>;
+  // domainFronting: AccessMethodSetting<DomainFronting>;
   custom: Array<AccessMethodSetting<CustomProxy>>;
 };
 
diff --git a/desktop/packages/mullvad-vpn/test/e2e/installed/state-dependent/api-access-methods.spec.ts b/desktop/packages/mullvad-vpn/test/e2e/installed/state-dependent/api-access-methods.spec.ts
index d89dc57089..5598344404 100644
--- a/desktop/packages/mullvad-vpn/test/e2e/installed/state-dependent/api-access-methods.spec.ts
+++ b/desktop/packages/mullvad-vpn/test/e2e/installed/state-dependent/api-access-methods.spec.ts
@@ -16,7 +16,7 @@ import { startInstalledApp } from '../installed-utils';
 const DIRECT_NAME = 'Direct';
 const BRIDGES_NAME = 'Mullvad Bridges';
 const ENCRYPTED_DNS_PROXY_NAME = 'Encrypted DNS proxy';
-const DOMAIN_FRONTING_NAME = 'Domain fronting';
+// const DOMAIN_FRONTING_NAME = 'Domain fronting';
 const IN_USE_LABEL = 'In use';
 const FUNCTIONING_METHOD_NAME = 'Test method';
 const NON_FUNCTIONING_METHOD_NAME = 'Non functioning test method';
@@ -52,11 +52,11 @@ test('App should display access methods', async () => {
   const direct = accessMethods.first();
   const bridges = accessMethods.nth(1);
   const encryptedDnsProxy = accessMethods.nth(2);
-  const domainFronting = accessMethods.nth(3);
+  // const domainFronting = accessMethods.nth(3);
   await expect(direct).toContainText(DIRECT_NAME);
   await expect(bridges).toContainText(BRIDGES_NAME);
   await expect(encryptedDnsProxy).toContainText(ENCRYPTED_DNS_PROXY_NAME);
-  await expect(domainFronting).toContainText(DOMAIN_FRONTING_NAME);
+  // await expect(domainFronting).toContainText(DOMAIN_FRONTING_NAME);
   await expect(page.getByText(IN_USE_LABEL)).toHaveCount(1);
 });
 
diff --git a/mullvad-daemon/src/api.rs b/mullvad-daemon/src/api.rs
index 856f1ae1cd..c300218e28 100644
--- a/mullvad-daemon/src/api.rs
+++ b/mullvad-daemon/src/api.rs
@@ -76,9 +76,9 @@ impl AccessMethodResolver for DaemonAccessMethodResolver {
                     };
                     ApiConnectionMode::Proxied(ProxyConfig::from(edp))
                 }
-                AccessMethod::BuiltIn(BuiltInAccessMethod::DomainFronting) => {
-                    mullvad_api::domain_fronting::resolve().await?
-                }
+                // AccessMethod::BuiltIn(BuiltInAccessMethod::DomainFronting) => {
+                //     mullvad_api::domain_fronting::resolve().await?
+                // }
                 AccessMethod::Custom(config) => {
                     ApiConnectionMode::Proxied(ProxyConfig::from(config.clone()))
                 }
diff --git a/mullvad-management-interface/proto/management_interface.proto b/mullvad-management-interface/proto/management_interface.proto
index ceac319a34..f09ae66785 100644
--- a/mullvad-management-interface/proto/management_interface.proto
+++ b/mullvad-management-interface/proto/management_interface.proto
@@ -497,13 +497,13 @@ message AccessMethod {
   message Direct {}
   message Bridges {}
   message EncryptedDnsProxy {}
-  message DomainFronting {}
+  // message DomainFronting {}
   oneof access_method {
     Direct direct = 1;
     Bridges bridges = 2;
     EncryptedDnsProxy encrypted_dns_proxy = 3;
     CustomProxy custom = 4;
-    DomainFronting domain_fronting = 5;
+    // DomainFronting domain_fronting = 5;
   }
 }
 
@@ -525,7 +525,7 @@ message ApiAccessMethodSettings {
   AccessMethodSetting mullvad_bridges = 2;
   AccessMethodSetting encrypted_dns_proxy = 3;
   repeated AccessMethodSetting custom = 4;
-  AccessMethodSetting domain_fronting = 5;
+  // AccessMethodSetting domain_fronting = 5;
 }
 
 message Settings {
diff --git a/mullvad-management-interface/src/types/conversions/access_method.rs b/mullvad-management-interface/src/types/conversions/access_method.rs
index a88efb8b22..e2bf9c1fb4 100644
--- a/mullvad-management-interface/src/types/conversions/access_method.rs
+++ b/mullvad-management-interface/src/types/conversions/access_method.rs
@@ -11,7 +11,7 @@ mod settings {
                 direct: Some(settings.direct().clone().into()),
                 mullvad_bridges: Some(settings.mullvad_bridges().clone().into()),
                 encrypted_dns_proxy: Some(settings.encrypted_dns_proxy().clone().into()),
-                domain_fronting: Some(settings.domain_fronting().clone().into()),
+                // domain_fronting: Some(settings.domain_fronting().clone().into()),
                 custom: settings
                     .iter_custom()
                     .cloned()
@@ -46,12 +46,12 @@ mod settings {
                 ))
                 .and_then(access_method::AccessMethodSetting::try_from)?;
 
-            let domain_fronting = settings
-                .domain_fronting
-                .ok_or(FromProtobufTypeError::invalid_argument(
-                    "Could not deserialize Domain fronting Access Method from protobuf",
-                ))
-                .and_then(access_method::AccessMethodSetting::try_from)?;
+            // let domain_fronting = settings
+            //     .domain_fronting
+            //     .ok_or(FromProtobufTypeError::invalid_argument(
+            //         "Could not deserialize Domain fronting Access Method from protobuf",
+            //     ))
+            //     .and_then(access_method::AccessMethodSetting::try_from)?;
 
             let custom = settings
                 .custom
@@ -63,7 +63,7 @@ mod settings {
                 direct,
                 mullvad_bridges,
                 encrypted_dns_proxy,
-                domain_fronting,
+                // domain_fronting,
                 custom,
             ))
         }
@@ -139,7 +139,7 @@ mod data {
                 proto::access_method::AccessMethod::EncryptedDnsProxy(proxy) => {
                     AccessMethod::from(proxy)
                 }
-                proto::access_method::AccessMethod::DomainFronting(df) => AccessMethod::from(df),
+                // proto::access_method::AccessMethod::DomainFronting(df) => AccessMethod::from(df),
                 proto::access_method::AccessMethod::Custom(custom) => {
                     CustomProxy::try_from(custom).map(AccessMethod::from)?
                 }
@@ -174,11 +174,11 @@ mod data {
         }
     }
 
-    impl From<proto::access_method::DomainFronting> for AccessMethod {
-        fn from(_value: proto::access_method::DomainFronting) -> Self {
-            AccessMethod::from(BuiltInAccessMethod::DomainFronting)
-        }
-    }
+    // impl From<proto::access_method::DomainFronting> for AccessMethod {
+    //     fn from(_value: proto::access_method::DomainFronting) -> Self {
+    //         AccessMethod::from(BuiltInAccessMethod::DomainFronting)
+    //     }
+    // }
 
     impl TryFrom<proto::Socks5Local> for AccessMethod {
         type Error = FromProtobufTypeError;
@@ -225,12 +225,11 @@ mod data {
                     proto::access_method::AccessMethod::EncryptedDnsProxy(
                         proto::access_method::EncryptedDnsProxy {},
                     )
-                }
-                mullvad_types::access_method::BuiltInAccessMethod::DomainFronting => {
-                    proto::access_method::AccessMethod::DomainFronting(
-                        proto::access_method::DomainFronting {},
-                    )
-                }
+                } // mullvad_types::access_method::BuiltInAccessMethod::DomainFronting => {
+                  //     proto::access_method::AccessMethod::DomainFronting(
+                  //         proto::access_method::DomainFronting {},
+                  //     )
+                  // }
             }
         }
     }
diff --git a/mullvad-types/src/access_method.rs b/mullvad-types/src/access_method.rs
index e5b01180d8..a9d71f9915 100644
--- a/mullvad-types/src/access_method.rs
+++ b/mullvad-types/src/access_method.rs
@@ -10,8 +10,8 @@ pub struct Settings {
     mullvad_bridges: AccessMethodSetting,
     #[serde(default = "Settings::create_encrypted_dns_proxy")]
     encrypted_dns_proxy: AccessMethodSetting,
-    #[serde(default = "Settings::create_domain_fronting")]
-    domain_fronting: AccessMethodSetting,
+    // #[serde(default = "Settings::create_domain_fronting")]
+    // domain_fronting: AccessMethodSetting,
     /// Custom API access methods.
     custom: Vec<AccessMethodSetting>,
 }
@@ -21,14 +21,14 @@ impl Settings {
         direct: AccessMethodSetting,
         mullvad_bridges: AccessMethodSetting,
         encrypted_dns_proxy: AccessMethodSetting,
-        domain_fronting: AccessMethodSetting,
+        // domain_fronting: AccessMethodSetting,
         custom: Vec<AccessMethodSetting>,
     ) -> Settings {
         Settings {
             direct,
             mullvad_bridges,
             encrypted_dns_proxy,
-            domain_fronting,
+            // domain_fronting,
             custom,
         }
     }
@@ -156,7 +156,7 @@ impl Settings {
         once(&self.direct)
             .chain(once(&self.mullvad_bridges))
             .chain(once(&self.encrypted_dns_proxy))
-            .chain(once(&self.domain_fronting))
+            // .chain(once(&self.domain_fronting))
             .chain(&self.custom)
     }
 
@@ -166,7 +166,7 @@ impl Settings {
         once(&mut self.direct)
             .chain(once(&mut self.mullvad_bridges))
             .chain(once(&mut self.encrypted_dns_proxy))
-            .chain(once(&mut self.domain_fronting))
+            // .chain(once(&mut self.domain_fronting))
             .chain(&mut self.custom)
     }
 
@@ -193,9 +193,9 @@ impl Settings {
         &self.encrypted_dns_proxy
     }
 
-    pub fn domain_fronting(&self) -> &AccessMethodSetting {
-        &self.domain_fronting
-    }
+    // pub fn domain_fronting(&self) -> &AccessMethodSetting {
+    //     &self.domain_fronting
+    // }
 
     fn create_direct() -> AccessMethodSetting {
         let method = BuiltInAccessMethod::Direct;
@@ -212,10 +212,10 @@ impl Settings {
         AccessMethodSetting::new(method.canonical_name(), true, AccessMethod::from(method))
     }
 
-    fn create_domain_fronting() -> AccessMethodSetting {
-        let method = BuiltInAccessMethod::DomainFronting;
-        AccessMethodSetting::new(method.canonical_name(), true, AccessMethod::from(method))
-    }
+    // fn create_domain_fronting() -> AccessMethodSetting {
+    //     let method = BuiltInAccessMethod::DomainFronting;
+    //     AccessMethodSetting::new(method.canonical_name(), true, AccessMethod::from(method))
+    // }
 }
 
 impl Default for Settings {
@@ -224,7 +224,7 @@ impl Default for Settings {
             direct: Settings::create_direct(),
             mullvad_bridges: Settings::create_mullvad_bridges(),
             encrypted_dns_proxy: Settings::create_encrypted_dns_proxy(),
-            domain_fronting: Settings::create_domain_fronting(),
+            // domain_fronting: Settings::create_domain_fronting(),
             custom: vec![],
         }
     }
@@ -362,7 +362,7 @@ pub enum BuiltInAccessMethod {
     Direct,
     Bridge,
     EncryptedDnsProxy,
-    DomainFronting,
+    // DomainFronting,
 }
 
 impl AccessMethod {
@@ -380,7 +380,7 @@ impl BuiltInAccessMethod {
             BuiltInAccessMethod::Direct => "Direct".to_string(),
             BuiltInAccessMethod::Bridge => "Mullvad Bridges".to_string(),
             BuiltInAccessMethod::EncryptedDnsProxy => "Encrypted DNS proxy".to_string(),
-            BuiltInAccessMethod::DomainFronting => "Domain fronting".to_string(),
+            // BuiltInAccessMethod::DomainFronting => "Domain fronting".to_string(),
         }
     }
 }