www.it-connect.fr
Quad9 to Exit France: 9.9.9.9 DNS Will Be Cut Off on November 24, 2026
Do you use the 9.9.9.9 DNS? On November 24, 2026, Quad9 will stop serving France rather than apply a block on certain websites following a court ruling. Here's what we know.
On October 22, 2026, the Swiss foundation Quad9 published an article with a very explicit title: Ce n'est qu'un au revoir, la France. It announces the withdrawal of all its resolvers, with or without filtering malicious sites, for users located in France starting Tuesday, November 24, 2026.
This decision follows a ruling issued on October 21, 2026 by the Paris Judicial Court, at the request of beIN Sports France. For the record, on May 13, 2026, this same court had ordered Quad9, as well as Google and Whalebone, the operator of DNS4EU, to block from France websites illegally streaming matches from the WTA tennis tournament. At first, six domain names, but that number was later increased, with a total of 58 domain names today following additions notified by Arcom.
For its part, Quad9 blocked none of them. beIN therefore demanded a daily penalty of 10,000 euros per day and per domain, or 580,000 euros per day. The court instead set the penalty at 1,000 euros per day in total, until November 14, the date of the last WTA match of the season. For Quad9, the bill is still steep: 24,000 euros, excluding legal fees. Financially manageable... but problematic going forward.
Why Quad9 prefers to leave rather than block
According to Quad9, around 20 other proceedings are currently underway in France against it (and other DNS resolver operators), which could result in the blocking of hundreds of domain names. The Swiss foundation believes it would not survive the accumulation of penalties, because the costs would keep rising over the long term.
"Our core values are based on providing privacy, security, and integrity to all internet users. Our mission is to apply these guiding principles universally to our recursive DNS resolution services, solely in the interests of end users.", Quad9 reminds us.
Above all, it considers the order impossible to implement properly:
- No list of French users: the service is free, with no registration and no proof of identity. According to Quad9, it is impossible to reliably know who is in France.
- IP geolocation has already cost it dearly: in the Sony Music case in Germany (2021 to 2023), a block limited by geoIP was bypassed with a VPN, and Quad9 was sanctioned. It eventually won, but only after spending hundreds of thousands of euros in costs.
- Global blocking is off the table: adding the domains to its malicious domain list would satisfy the court, but would amount to applying a French decision worldwide.
Blocking DNS resolution removes no content from the servers, and changing resolvers is enough to bypass the measure. "It's the equivalent of holding up a newspaper in front of a packed stadium.", Quad9 quips.
The court, however, does not share that view. It notes that Quad9 is bound by an obligation of means and acknowledges that it has implemented none. It also points out that the Swiss foundation already applies global filtering of malicious domains, so it "appears to contradict itself to the detriment of its opponent", the judge believes.
France is thus losing a second public resolver, after OpenDNS (Cisco), which suspended its service in June 2024 following an order obtained by Canal+. For its part, Quad9 is probably one of the most widely used public resolvers in France.
What you should check before November 24
To support my point in the previous sentence, Quad9 also cites a few organizations relying on this DNS resolver: DINUM, France Travail, the Nouvelle-Aquitaine Region, RENATER, EDF, SNCF, Dassault Systèmes, and Stormshield. So it is entirely possible that 9.9.9.9 is also present somewhere in your infrastructure.
Here are a few places worth checking, beyond your personal machine:
- Internal DNS servers: the forwarders on a Windows Server DNS server, Bind9, or Unbound may point to 9.9.9.9 or 149.112.112.112.
- Firewalls, routers, and ISP boxes: the DNS servers used by the device and those handed out via DHCP.
- DNS blockers: the servers configured on your Pi-hole, AdGuard Home, or Blocky.
- Workstations and browsers: DNS-over-HTTPS and DNS-over-TLS settings, as well as DoH profiles installed on iOS and macOS.
- Mullvad Browser: as I explained in my article on Mullvad's shutdown of its encrypted DNS servers in favor of Quad9, the default settings will switch to Quad9 after November 2. In France, this new configuration will be valid for three weeks.
To replace it, choose another public resolver (NextDNS, for example), your ISP's resolver, or deploy your own recursive resolver, as in my tutorial for installing Technitium DNS Server with native recursion.
Another out-of-step decision from France... Blocking a few domain names at the level of a handful of DNS resolvers is not going to stop illegal streaming... What do you think?
