Jeff Bruchado
Back to blog

Quad9 Leaves France in 2026: What DNS Blocking Teaches Us About the Internet

Hello HaWkers, on October 22, 2026 Quad9 published a short post with a title that says it all: "Au revoir, France". The Swiss foundation that runs the 9.9.9.9 public DNS resolver will stop serving users in France starting November 24, 2026. The reason is a ruling from the Paris Judicial Court, obtained by broadcaster beIN, that forces the service to block domains accused of streaming pirated sports.

The announcement passed 1,200 points on Hacker News in less than a day, and not by accident. It is the second time a major public resolver has chosen to leave the country rather than comply with a blocking order: Cisco's OpenDNS did the same in June 2024. Do you know what happens between typing an address and the page loading, and why a court wants to tamper with exactly that step? In this article you will understand the case, what it reveals about how the internet is governed today and, in practice, how to check, switch and test the DNS you use.

What Happened, in Order

The timeline helps separate fact from opinion, because this topic generates plenty of both.

  • November 2017: Quad9 goes live as a non-profit public resolver, focused on blocking malware and phishing domains. It has protected French users for almost 9 years, according to the foundation itself.
  • 2021 to 2023: Sony Music sues Quad9 in Germany to force it to block a site. The foundation tries geolocation-based blocking, Sony reaches the content through a VPN, and the court fines Quad9 for non-compliance. Years later, on appeal, the Dresden court rules that a DNS resolver is not the author of the infringement and Quad9 wins. The case cost "six figures", in the foundation's words.
  • May and June 2024: Canal+ obtains orders in Paris requiring Google, Cloudflare and Cisco to block football piracy domains on their public resolvers. Google and Cloudflare comply. Cisco pulls OpenDNS out of France and Portugal on June 28, 2024.
  • October 21, 2026: the 3rd Chamber of the Paris Judicial Court (case RG 26/11882) rules in favor of beIN against Quad9. The non-compliance penalty drops from 580,000 euros to 1,000 euros per day, but the obligation to block stands.
  • October 22, 2026: Quad9 announces it will appeal and that it leaves France on November 24.

The foundation also says it has around 20 other pending cases in the country, each one requesting blocks on more domains. That number weighs more in the decision than the fine itself.

What a DNS Resolver Is and Why It Became a Target

When you visit jeffbruchado.com.br, your computer does not know which IP to send the request to. It asks a recursive resolver, which walks the chain of authoritative servers (root, then .br, then the domain's server) and returns the final address. By default, that resolver belongs to your ISP. But anyone can switch to a public one, such as 8.8.8.8 (Google), 1.1.1.1 (Cloudflare) or 9.9.9.9 (Quad9).

This is where the conflict starts. In France, the sports law allows rights holders to request blocking measures from any entity able to help stop piracy. ISPs were already required to block the sites. But to get around the block, all you had to do was swap your ISP's DNS for a public one. So the rights holders went after the public resolvers.

Cloudflare and Cisco argued in 2024 that a resolver plays a passive role, similar to a phone book. The court did not accept it: if the block keeps at least some users from reaching the site, it is considered proportionate.

The best way to understand the problem is to watch DNS at work. The example below uses Node.js's native module to ask different resolvers for the same name:

// compara-resolvedores.mjs
// Asks several public resolvers for the same domain and compares the answers.
import { Resolver } from 'node:dns/promises';

const resolvedores = {
  operadora: null, // null = use the DNS configured on the system
  google: '8.8.8.8',
  cloudflare: '1.1.1.1',
  quad9: '9.9.9.9',
};

async function consultar(nome, dominio, ip) {
  const resolver = new Resolver({ timeout: 3000, tries: 1 });
  if (ip) resolver.setServers([ip]);

  const inicio = performance.now();
  try {
    const enderecos = await resolver.resolve4(dominio);
    const ms = Math.round(performance.now() - inicio);
    return { nome, enderecos: enderecos.join(', '), ms };
  } catch (erro) {
    // NXDOMAIN, REFUSED or a timeout may indicate blocking, but don't prove it on their own
    return { nome, enderecos: `erro: ${erro.code}`, ms: null };
  }
}

const dominio = process.argv[2] ?? 'example.com';
const resultados = await Promise.all(
  Object.entries(resolvedores).map(([nome, ip]) => consultar(nome, dominio, ip))
);

console.table(resultados);

Run it with node compara-resolvedores.mjs example.com. If one resolver returns an IP and another returns an error or a different address for the same domain, someone along the path is altering the answer. That is exactly what a blocking order demands.

Why Quad9 Would Rather Leave Than Block

The core sentence of the announcement is this: Quad9 "categorically" refuses to "alter or lie" about the DNS answers it delivers. It sounds like rhetoric, but there are three technical arguments behind it.

1. It does not know who is French. Quad9 requires no sign-up and says it keeps no records linking a user to a jurisdiction. To block only in France, it would need to identify the origin of each query through IP geolocation, which is imprecise and, as Sony showed in Germany, can be bypassed with a VPN in seconds.

2. Blocking for everyone would export French law. The simplest way to comply would be to add the domains to the global blocklist. Then a user in Brazil, Japan or Canada would end up obeying a ruling from a Paris court. Quad9 rejects that option.

3. The block does not work. The foundation's comparison is a good one: it is like holding a piece of newspaper in front of a stadium to block the view of a concert. Anyone who wants to watch switches resolvers, uses DNS over HTTPS, uses a VPN or goes straight to the IP.

There is also the economic argument. A thousand euros a day is little for a big company, but Quad9 is a foundation funded by donations. Twenty simultaneous cases, each requiring lawyers in France, is what makes the country unviable. And beIN was asking for 580,000 euros a day.

Who Feels the Impact

The effect goes far beyond people who changed the DNS at home. Quad9 lists among affected users government agencies, research and education networks, universities, hospitals, energy and transportation companies, ISPs and mobile carriers. Many of these networks chose Quad9 precisely for its protection layer against malicious domains.

And here is the irony the announcement itself points out: a ruling made to protect sports broadcasting rights takes away a free malware and phishing filter from thousands of French networks. Quad9 offers three versions of the service, and two of them block addresses known to be dangerous. Anyone who relies on that protection will have to replace it, pay for an alternative or go without.

For network admins, the lesson is practical: a public resolver is an external dependency like any other, and it can disappear because of third-party decisions. If your company has an office in France, or customers there, the checklist below sums up what to do before November 24.

Situation What to do
Workstations using 9.9.9.9 via DHCP Change the DNS handed out by DHCP and renew the leases
Servers with fixed DNS in /etc/resolv.conf or systemd-resolved Update the configuration and test resolution
Forwarders in Unbound, BIND or dnsmasq pointing to Quad9 Switch the upstream and keep at least two providers
Browsers with DNS over HTTPS on Quad9 Review the browser or MDM policy
Reliance on malware protection Pick another filter before turning off the current one

In Practice: Find Out Which DNS You Use

Before changing anything, find out what is configured today. The commands vary by system:

# macOS: lists the DNS servers in use per interface
scutil --dns | grep 'nameserver\[[0-9]*\]' | sort -u

# Linux with systemd-resolved: shows the DNS for each interface
resolvectl status | grep -E 'Link|DNS Servers'

# Linux without systemd-resolved
cat /etc/resolv.conf

# Windows (PowerShell)
Get-DnsClientServerAddress -AddressFamily IPv4

# Any system with dig: asks Quad9 directly and shows who answered
dig @9.9.9.9 example.com +short
dig example.com | grep SERVER

If you see 9.9.9.9, 149.112.112.112, 2620:fe::fe or 2620:fe::9, you are using Quad9. Those are the service's official addresses.

In Practice: Switch and Keep a Plan B

The rule is to never depend on a single provider. On Linux with systemd-resolved, you can configure a primary and a backup from different companies:

# /etc/systemd/resolved.conf
# Primary and backup from different providers: if one goes down
# (or leaves the country), the other keeps answering.
[Resolve]
DNS=1.1.1.1#cloudflare-dns.com 8.8.8.8#dns.google
FallbackDNS=1.0.0.1#cloudflare-dns.com 8.8.4.4#dns.google
# Encrypts queries with DNS over TLS when the server supports it
DNSOverTLS=opportunistic
DNSSEC=allow-downgrade

Then run sudo systemctl restart systemd-resolved and check with resolvectl status. On macOS, the command-line equivalent is:

# Sets primary and backup DNS on the macOS Wi-Fi interface
networksetup -setdnsservers Wi-Fi 1.1.1.1 8.8.8.8

# Goes back to the DNS provided by the network (DHCP)
networksetup -setdnsservers Wi-Fi empty

# Flushes the local cache so the change takes effect right away
sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponder

Note that the switch is not neutral. Google and Cloudflare have complied with French orders since 2024, so in France they return filtered answers for the listed domains. Choosing a resolver also means choosing the blocking policy you accept.

In Practice: Monitor Whether Your DNS Is Answering

If you run production systems, it is worth having an automated test that alerts you when a resolver stops answering or starts answering differently. The script below uses DNS over HTTPS in JSON format, which runs in any environment with fetch:

// monitora-doh.mjs
// Queries the same name on several DoH endpoints and alerts on mismatches.
const endpoints = {
  cloudflare: 'https://cloudflare-dns.com/dns-query',
  google: 'https://dns.google/resolve',
};

async function resolverDoh(nome, url, dominio) {
  const resposta = await fetch(`${url}?name=${dominio}&type=A`, {
    headers: { accept: 'application/dns-json' },
    signal: AbortSignal.timeout(4000),
  });
  const dados = await resposta.json();
  // Status 0 = NOERROR, 3 = NXDOMAIN, 5 = REFUSED
  const ips = (dados.Answer ?? [])
    .filter((r) => r.type === 1)
    .map((r) => r.data)
    .sort();
  return { nome, status: dados.Status, ips };
}

const dominio = process.argv[2] ?? 'example.com';
const resultados = await Promise.allSettled(
  Object.entries(endpoints).map(([nome, url]) => resolverDoh(nome, url, dominio))
);

const ok = resultados.filter((r) => r.status === 'fulfilled').map((r) => r.value);
const falhas = resultados.filter((r) => r.status === 'rejected');

if (falhas.length) console.warn(`⚠️ ${falhas.length} resolvedor(es) sem resposta`);

const conjuntos = new Set(ok.map((r) => `${r.status}:${r.ips.join(',')}`));
if (conjuntos.size > 1) {
  // Different answers may be a regional CDN, but NXDOMAIN on just one is suspicious
  console.warn('⚠️ Respostas divergentes:', ok);
} else {
  console.log('✅ Resolvedores concordam:', ok[0]);
}

An honest caveat: sites behind a CDN return different IPs depending on the region, so an IP mismatch is not always a block. The strong signal is one resolver answering NXDOMAIN or REFUSED while the others answer normally.

The Bigger Pattern: The Internet Fragmenting Layer by Layer

The Quad9 case is not isolated. It is part of a trend in which governments and courts reach further and further down the network stack to enforce decisions. First it was websites, then ISPs, now resolvers. Canal+ has already said the next step includes IP blocking.

Brazil knows this movement well. In August 2024, Brazil's Supreme Court ordered X suspended in the country and set a fine of R$ 50,000 per day for anyone using a VPN to access the network. Anatel, the telecom regulator, frequently takes down pirate IPTV servers. The logic is the same as in France: when blocking at one layer is not enough, the pressure moves to the next one.

And France is in a curious moment. The same country debating replacing American apps in the name of digital sovereignty has just lost a European, non-profit resolver headquartered in Zurich. The ones that remain are precisely the big American providers that agreed to filter.

For developers, there are three concrete consequences:

  1. Infrastructure has geography. The same configuration can work in Brazil and fail in Paris. Availability tests need to run from more than one region.
  2. DNS is a critical dependency. Having two providers from different companies, as you would with a database or a queue, is no longer overkill.
  3. Technical neutrality has a cost. Quad9 paid "six figures" to win in Germany and now would rather lose an entire country than maintain a blocking system it considers unworkable.

Outlook: What Could Change Before November 24

Quad9 will appeal, and the appeals court may reverse the ruling, as happened in Germany. The foundation has also asked French citizens to contact their members of parliament and Arcom, the country's audiovisual and digital regulator. If nothing changes, starting November 24 the service will simply stop answering anyone in France.

Keep an eye on three things over the coming weeks: the outcome of the appeal, the progress of the other 20 cases, and whether any other independent resolver follows the same path. If two of the largest neutral resolvers leave a European country within two years, the debate over who controls the internet's naming layer stops being theoretical.

In the meantime, the practical task is simple: check which DNS you use, keep a backup from another provider and automate the test. DNS is invisible until the day it disappears.

Let's go! 🦅

📚 Want to Keep Up With What Is Coming?

This article covered Quad9 leaving France and what DNS blocking changes for people who run networks, but the ecosystem changes every week and not everything becomes an article here.

On X I share what I am testing, behind the scenes of my projects, and the news that shows up before it turns into a post.

Follow Me There

👉 Follow @jeffbruchado on X

💡 Daily content about development, career, and the tools I actually use

Comments (0)

This article has no comments yet 😢. Be the first! 🚀🦅

Add comments