senn-techQuad9 leaves France: why the resolver walks away instead of blocking
On 22 October 2026 Quad9 announced on its own blog that it will stop serving users in France on 24 November 2026. The address 9.9.9.9, which many operators and home users have set as their default in routers and servers for years, will no longer be available to users there. The trigger is a French ruling from the day before, in a case brought by the sports broadcaster beIN.
Quad9 is a free public DNS resolver at 9.9.9.9, run by a Swiss non-profit foundation, that filters known malicious domains and asks for neither sign-up nor an account. A recursive resolver translates names into IP addresses. A Paris court requires Quad9 not to resolve 58 domains for users in France. The foundation is leaving France rather than implementing the block.
Updated on 5 November 2026: the Quad9 CTO's statement on how the exit will work is new, as are current Hacker News numbers and a re-check of our own blocklist. This post covers the ruling, the history and our own finding; how to harden your own forwarder is covered in the companion post Quad9 leaves France: what it means for your DNS forwarders.
What the court decided
According to Quad9, the court cut the daily penalty to 1,000 euros. TorrentFreak reports that beIN had asked for 10,000 euros per day and domain, which for 58 domains would have been 580,000 euros a day. TorrentFreak also reports that the court upheld the blocking order itself (case number RG 26/11882). It goes back to a May 2026 decision that started with six domains; two later updates raised the number to 58, according to Quad9.
| Item | Value | Unit | As of | Origin |
|---|---|---|---|---|
| beIN demand | 580,000 | euros per day | 5 Oct 2026 | TorrentFreak (the opposing party's figure) |
| Penalty under the ruling | 1,000 | euros per day | 21 Oct 2026 | Quad9, TorrentFreak |
| Penalty until 14 November | 24,000 | euros | 22 Oct 2026 | Quad9's own calculation (party to the case) |
| Domains affected | 58 | domains | 22 Oct 2026 | TorrentFreak, Reclaim The Net |
| Other pending cases against resolvers | about 20 | cases | 22 Oct 2026 | Quad9 (party to the case) |
All figures come from third-party sources and were not re-measured by us. We have not read the ruling itself, only reports about it.
TorrentFreak reports that in the same month the court rejected beIN's penalty requests against Cloudflare and several VPN providers because they had blocked at least some of the domains, which the court saw as a reasonable effort. Canal+ had lost a comparable request against Cloudflare in September. According to TorrentFreak, Quad9 blocks none of the domains. Reclaim The Net says the May order also named Google and the DNS4EU operator Whalebone. We do not know what they implemented.
The pattern is two years old
In May 2024 the Paris court ordered Google, Cloudflare and Cisco to block about 117 domains carrying Champions League and Premier League streams for users in France (TorrentFreak). Cisco withdrew OpenDNS from France and Portugal on 28 June 2024; its notice cites Article L.333-10 of the French Sports Code. TorrentFreak reports that Google had said it would comply. In December 2024 Canal+ orders against Quad9 and Vercara followed. Quad9 blocked those domains globally as a stopgap and announced an appeal (TorrentFreak, 12 December 2024).
Since then the plaintiffs have been Canal+ and beIN, and the defendants Google, Cloudflare, Cisco, Quad9, Vercara and Whalebone. Quad9 itself considers the approach pointless: blocking does not remove the content, and users move to other open resolvers. That is the foundation's assessment.
Why Quad9 does not simply block
The foundation's reasoning follows a chain that operators should be able to follow, because it raises the same question for every blocklist.
First, Quad9 cannot separate users by country. The service requires no sign-up and does not map users to a jurisdiction, the foundation writes: "we have no list of French users". Second, it considers geoIP unfit and points to the Sony Music case in Germany (2021 to 2023). There, Quad9 says, it started with a geoIP block, Sony bypassed it with a VPN, and the court fined Quad9 for contempt. Quad9 won on appeal at the Higher Regional Court of Dresden (case 14 U 503/23, published 6 December 2023, ruling as PDF, German), which set aside the Leipzig Regional Court ruling of 1 March 2023. Quad9 says this took years and six-figure costs. The Gesellschaft für Freiheitsrechte supported the case (German).
Third, the only remaining route would be a global block, which Quad9 rejects as applying French law to every user. Fourth, the foundation frames the step as a matter of principle: recursive resolution is a neutral, passive service, and it will not falsify answers. According to Quad9 an appeal is pending; whether it changes the withdrawal is open.
How Quad9 will exclude France from 24 November
The blog post does not say. Quad9 CTO John Todd put it this way in the Hacker News comments: it is probable that geoIP filters will be used after 24 November to keep French users out, accepting that there may be errors. That does not contradict the claim that geoIP is unfit for the domain block. In Todd's reasoning a coarse country exclusion may have gaps, a court-ordered per-domain block may not. This is the CTO's statement of 22 October 2026, not a confirmed implementation.
At our place the resolver blocks too
On 24 October 2026 we measured our own setup, because the case hits exactly the place that every self-run resolver controls. Our primary Technitium node lists dns.quad9.net:853 and cloudflare-dns.com:853 as forwarders (DNS over TLS). It has 35 downloaded blocklists loaded and nothing blocked by hand (read-only query of the configuration). We did not measure how much traffic each upstream carries. The withdrawal from France changes nothing for us; it hits French users directly.
The second finding was unexpected. Our source crawler tracks ten sources that had failed seven or more runs in a row on 24 October. For five of them the cause was our own blocklist: Ben's Bites, Check Point Research, Docker Blog, Full Disclosure and OSS Security. Our resolver returns 0.0.0.0 for those hostnames, the same method Quad9 refuses to use. The lists decide per hostname: www.docker.com comes back as 0.0.0.0, docker.com resolves normally.
| Source | Failed runs in a row | Cause | As of | Measured on |
|---|---|---|---|---|
| Docker Blog, Check Point Research, Ben's Bites, Full Disclosure, OSS Security | 22 each | sinkhole (0.0.0.0) | 24 Oct 2026 | crawler status state.json |
| Exploit-DB, TLD-DR Sec | 22 each | connection reset / refused | 24 Oct 2026 | crawler status state.json |
| VentureBeat AI, r/Proxmox (weekly) | 22 each | HTTP 429 | 24 Oct 2026 | crawler status state.json |
| HN feed LLM 100+ | 8 | HTTP 502 | 24 Oct 2026 | crawler status state.json |
Own measurement, crawler state 24 Oct 2026, 03:45 UTC. The five sources are not dead: over DNS-over-HTTPS at 1.1.1.1, seclists.org returns 50.116.1.184 on 5 November 2026. Through our company network's resolver, seclists.org, research.checkpoint.com and www.docker.com still answer 0.0.0.0 and :: the same day. So the finding held on 24 October and on 5 November. We had not noticed it before the analysis.
We only saw it because the crawler classifies answers separately and files an entry as sinkhole instead of as an error. A resolver that changes answers quietly decides which third-party services are visible. At Quad9 a court prescribes that; with us it is a list we chose ourselves.
What operators can check now
Switching off blocklists would be the wrong conclusion. Spam domains, phishing infrastructure and malware command servers do not go away by themselves, and the protective value of a list is real. Whoever picks the list, logs it and keeps an allowlist can find false blocks and undo them. A filtering public resolver hands both to a third party whose answers can change by court order.
- List your upstreams. Not only in the resolver but wherever they are hard-coded: routers, firewall profiles, the
resolv.confof base images, managed Kubernetes. Changing a single forwarder is described in our post on DNS forwarders. - Monitor resolution, not just reachability. A port 53 check does not fire when the answer is wrong. A fixed set of hostnames with expected answer classes, queried every few hours, catches
0.0.0.0,::and unexpected NXDOMAIN. Why a green uptime check is not enough is in DNS monitoring: why a green uptime check proves nothing. - Play through the provider exit. If the provider of your resolver announces its withdrawal in 30 days, you need a second path. With your own recursive resolution (Unbound, Technitium, PowerDNS Recursor), your own lists and your own allowlist, answer and reason can be reconstructed. More posts on resolvers and self-run networking are collected in the topic hub Servers, Proxmox and network.
If you want this set up or reviewed for your environment, see IT infrastructure and operations.
Community voices
On Hacker News the story stands at 1,382 points and 479 comments (retrieved 5 November 2026, posted 22 October). One commenter compares a resolver to a phone book: you punish a company for a number it only looks up. The most important information comes from the Quad9 CTO himself (see above). That is a mood, nothing more.
Further sources
This post is based on text sources. We did not evaluate any video.
Primary
- Quad9, Farewell, France, announcement of 22 Oct 2026 with reasoning, penalty and exit date
- Hacker News, Quad9 to exit France, comment by Quad9 CTO John Todd on geoIP, 22 Oct 2026
- Higher Regional Court Dresden, ruling 14 U 503/23, Sony Music v. Quad9, redacted version hosted by Quad9 (German)
Independent
- TorrentFreak, DNS Resolver Quad9 Will Leave France After Court Orders Piracy Blocking Penalty, 22 Oct 2026: ruling, case number, Cloudflare comparison
- TorrentFreak, Quad9 Rejects French Piracy Blocks, Weighs Exit, 5 Oct 2026: six plus 52 domains, beIN demand
- TorrentFreak, French Piracy Blocking Order Goes Global, 12 Dec 2024: Canal+ against Quad9 and Vercara
- TorrentFreak, OpenDNS Suspends Service in France, 29 Jun 2024: Cisco's notice including Article L.333-10 (Cisco's own page blocks automated requests)
- Reclaim The Net, Quad9 Considers Leaving France, 6 Oct 2026: Google and Whalebone
- Mike Kuketz, Frankreich: DNS-Sperren treiben Quad9 zum Rückzug, 23 Oct 2026, in German: view for users in Germany
- Gesellschaft für Freiheitsrechte, Erfolg gegen Netzsperren, 6 Dec 2023, in German
Own measurement
- Crawler status
state.jsonand a read-only configuration query of the primary Technitium node, 24 Oct 2026; hostname re-check on 5 Nov 2026 over DoH and the company resolver
Is 9.9.9.9 shut down?+
No. Quad9 ends service only for users in France, on 24 November 2026. If 9.9.9.9 is configured on a router or server at a site in France, you need another upstream by then. Also check devices with the resolver hard-coded: routers, firewalls, some container images.
What happens to requests from France on 24 November?+
Quad9 says its services will no longer be available to users in France. Its CTO John Todd wrote on Hacker News that geoIP filters will probably be used for that. There is no documented failure mode. Operators in France should switch beforehand and watch SERVFAIL and timeouts afterwards.
How can I tell that a DNS answer comes from a blocklist?+
Typical signs are 0.0.0.0 or :: as the answer, or NXDOMAIN for names that used to resolve. Comparing against a second path, for example DNS-over-HTTPS to another provider, settles it in seconds. A resolver with a query log makes it reconstructable later.