senn-techsenn-tech
Linux
Linux2026-10-24· By Franz Senn

Quad9 leaves France: what it means for your DNS forwarders

On 24 November 2026 Quad9 stops serving users in France. The operator announced it on 22 October in a blog post titled "Au revoir, France", and heise and ComputerBase (24 October 2026) report the same. Private users of Quad9 in Germany or Austria will not notice. With a single public resolver as the only upstream, this is a good moment to look at your forwarder list.

Quad9 logo
Quad9 is the resolver this post is about. The logo is public domain, the trademark remains protected. (Quelle: Wikimedia Commons, file Quad9 logo.svg, public domain (design by Erik Spiekermann for the Quad9 Foundation))
Cloudflare logo
Cloudflare is the second upstream on our Technitium node (see below). (Quelle: Simple Icons, file cloudflare.svg (CC0))

What the Paris court decided

The trigger is a ruling of the Tribunal Judiciaire de Paris dated 21 October 2026 (3rd chamber, RG 26/11882). Heise says it came in a case brought by the sports broadcaster beIN over tennis streams. The court sets a penalty of 1,000 euros per day. ComputerBase reports that beIN had asked for 580,000 euros per day: 10,000 euros per domain across 58 domains. Quad9 calculates on its blog that by 14 November the penalty would add up to 24,000 euros (Quad9's figure).

Penalty per day: demand and rulingbeIN demand580000 · 580,000 eurosRuling of 21 October1000 · 1,000 euros0600000
The court sets about 0.2 percent of the amount demanded (our calculation: 1,000 divided by 580,000). The demand equals 10,000 euros per domain across 58 domains. (Quelle: heise online, ComputerBase)

The background goes back further. On 13 May 2026 a Paris court ordered Google, Whalebone and Quad9 to block certain streams of the women's tennis tour WTA. It started with 6 domains, 52 were added later, 58 in total (TorrentFreak, 5 October 2026). Quad9, ComputerBase and Kuketz all say about 20 further proceedings are pending against Quad9 and other resolver operators. An appeal against the ruling has been filed. Kuketz considers it unclear whether it would change the withdrawal.

From blocking order to withdrawal13 May 2026Paris orders 58 domainsblocked (6 at first)5 Oct 2026beIN demands up to 580,000euros per day21 Oct 2026Ruling: 1,000 euros penaltyper day22 Oct 2026Quad9 announces thewithdrawal14 Nov 2026Penalty reaches 24,000 euros(Quad9 calculation)24 Nov 2026Service for France ends
Dates from Quad9, heise online, ComputerBase and TorrentFreak. The 24,000 euros is Quad9's own calculation and appears in no court document we read. (Quelle: Quad9, heise online, ComputerBase)

Why Quad9 does not simply block by GeoIP

Quad9 gives two reasons, and both come from a party to the case, so they are vendor-claimed. First, the operator says it keeps no user records: "We have no list of French users, because we do not keep dossiers of our users at all." Quad9 told TorrentFreak there is no legally workable way to define a French user. Second, Quad9 refuses to falsify DNS answers.

Interview with John Todd, Quad9's CTO, published 18 September 2026, about 80 minutes. It predates the ruling and explains DNS and DNS privacy in general; the Paris case does not come up, according to the video description.

As evidence Quad9 points to a German case from 2023 (Sony). A GeoIP block there was bypassed via VPN, and Quad9 was fined for contempt; in December 2023 (per Kuketz) the service won at the Higher Regional Court of Dresden. The VPN bypass, the fine and Sony appear in Quad9's blog and at Kuketz; TorrentFreak and heise mention only the win in Dresden. The account originates with Quad9. No source says how Quad9 will exclude French users from 24 November. Locating them by client IP is likely (our assumption). Heise writes "as far as possible", which means gaps.

There is a precedent: Cisco OpenDNS ended its service for users in France on 28 June 2024 (Kuketz, citing a Cisco notice). In July 2026, according to TorrentFreak (5 October 2026), a French law followed that automatically adds new domains to the blocklist during live broadcasts, with review by the authority ARCOM only afterwards. Quad9 calls the power of commercial parties to block in real time "recklessly dangerous", which is its own assessment. Quad9 hopes 30 days are enough to switch and names no replacement services.

What our own setup shows

On 24 October 2026 we queried the settings of one of our three Technitium nodes read-only through the admin API (Technitium 15.4). The forwarders are dns.quad9.net:853 and cloudflare-dns.com:853, protocol TLS (DNS over TLS). Concurrent forwarding is on, with concurrency 2, a timeout of 2,000 ms and 3 retries. On this node Quad9 is therefore not the only upstream, and both providers are asked in parallel. We did not read the other two nodes in this pass, so we make no claim that they are configured the same way. The node we read is located in Austria; we have seen no French clients there (assumption, unmeasured).

How a query travels through the node we readClientasks the Technitium nodeTechnitium nodeconcurrency 2, timeout 2,000ms, 3 retriesQuad9 and Cloudflarein parallel, DNS over TLS onport 853Answerback to the client
Setup as read from the admin API on 24 October 2026, one node out of three. (Quelle: Own measurement, 24 Oct 2026)

Checking your forwarders in three steps

  1. Open the upstream setting: in Technitium under Settings, Proxy & Forwarders; in Pi-hole under Upstream DNS; in AdGuard Home under Upstream DNS servers. Check whether Quad9 is the only entry and which protocol it uses (UDP, DoT or DoH). Technitium supports UDP, TCP, TLS and HTTPS as forwarder protocol (Technitium help).
  2. Add a second, independent upstream, ideally from a different operator in a different jurisdiction, and turn on parallel mode if your resolver supports it. Keep the transport encrypted.
  3. Anyone with users or sites in France switches before 24 November and then watches SERVFAIL and timeouts in the resolver statistics. Everyone else can leave things as they are, but gains resilience from a second upstream.

With a single upstream you have a single point of failure even without a Paris court. If the provider goes down or leaves a country, your own resolver either stops answering or answers only after a timeout.

Further sources

Questions?
When does Quad9 stop serving France?+

On Tuesday 24 November 2026. Quad9 says so in its announcement of 22 October, and heise, ComputerBase and the Kuketz blog report the same. It covers France including the overseas departments and Saint-Pierre and Miquelon. Heise says it does not cover French Polynesia, New Caledonia, or Wallis and Futuna.

Do I have to change anything in Germany or Austria?+

Not according to the sources we read. The Kuketz blog says Quad9 stays available in Germany and German users do not need to act. No source mentions Austria; that it stays unaffected is our inference and Quad9 has said nothing on it. With users or sites in France, switch the resolver before 24 November.

Which DNS forwarder should I use instead?+

Quad9 names no replacement. A sensible setup adds a second upstream from a different operator in a different jurisdiction, uses encrypted transport (DoT or DoH) and queries both in parallel where possible. Which provider you pick depends on your privacy requirements.