Quad9 (DNS Resolver) to Exit France

Farewell, France We have some news to share with you. Summary Starting November 24, Quad9 will no longer be able to offer its free cyberprotection service to users located in France. The French courts yesterday handed down an unfavorable ruling against Quad9 in a major case that undermines the transparency and stability of the internet. This decision in favor of beIN forces Quad9 to block the recursive DNS resolution for a number of domain names for users located in France. The good news is the court significantly reduced the financial penalty, from €580,000 to €1,000 per day. However, for Quad9, this has never been just a financial issue: it is a matter of principle. We cannot comply with this ruling over the long term while remaining faithful to our mission to protect your privacy, defend you against cyber threats, and preserve the integrity of the internet. For us, recursive DNS resolution is a neutral and passive service. We categorically refuse to alter or lie to you about the DNS responses you receive in a way that opposes your expectations. This ruling forces an untenable position upon us. Compliance is technically unfeasible, and implementation directly contradicts our mandate to serve the public. As a result, we have made the difficult decision to withdraw Quad9 services from France as of Tuesday, November 24. We deeply regret that French internet users will be left without an alternative that can adequately protect their cybersecurity while remaining compliant with European privacy law. Background beIN, a Qatari company with offices in France, previously sought to force Quad9 to block resolution for a set of domain names they assert are participating in copyright infringement of its audiovisual rights on sports event broadcasts. Quad9 has no association with these domain names, nor with the operators of the websites. The French courts have fundamentally misunderstood the working of the internet and the role of the domain name system and have allowed a financial penalty to apply to Quad9 if we do not block DNS responses to users in France. Quad9 is a Swiss public-benefit, nonprofit foundation established for the explicit purpose of protecting the cybersecurity of internet users. We charge nothing for our service and serve all people and organizations which seek to improve the security and privacy of their internet use. Our core values are to make privacy, security, and integrity available to all internet users, and our mission is to universally apply these guiding principles to recursive DNS resolution services in order to serve end users. We want to be very clear: we do not condone content piracy. Quad9 exists to create a safer, more trustworthy internet experience for end users. We offer global blocking as an option for malicious cyberactivity against users worldwide. We do not block content, and we give users the choice to use our threat blocking services, or not, based on their interests and needs. Content piracy needs to be dealt with at the source: the place where the infringing content is published. Forcing uninvolved third parties to break the fundamental operating principles of the internet to benefit individual parties to the detriment of the global internet-using public is misguided, counter-productive, and distracts from actual solutions addressing the hosting of the content directly, or the market pressures which cause piracy to exist in the first place. Not only are DNS recursive resolvers, like Quad9, the wrong actors to address piracy, but applying legal pressure to Quad9 will also have vast unintended consequences harming the cybersecurity of hundreds of millions of innocent internet users. For Quad9, complying with this ruling is impossible. We have no database of users associating them with jurisdictions. Our service is free to the public and does not require sign-up or proof of identity. Recursive DNS is so fundamental to the underlying operation of the internet that there is no method to map users’ jurisdictions reliably, nor do we think there should be a way to force users to identify themselves before they can connect to the internet. Our core goals – privacy of user data and honesty of responses - are directly opposed to the methods necessary to implement the blocking this court ruling would require us to perform. There is no way we can determine which users this ruling applies to – we have no list of French users, because we do not keep dossiers of our users at all. If we do not comply, we will face a daily penalty of 1.000 euros until the blocking concludes on November 14 (i.e., 24.000 euros) not including our legal defense. Quad9 cannot survive the accumulation of penalties yet to be assessed in 20 other pending cases, nor those of future cases similar to the one brought by beIN. Inaction is, therefore, not an option to challenge this decision. Can Quad9 just comply via global blocking? We could add these names to our global malicious domain blocking database, which is what we use to provide internet users with malware and phishing protection. This is a single, monolithic set of names applied to all users of our protective services (9.9.9.9 & secondaries) globally but not to our nonprotective services (9.9.9.10 & secondaries). Blocking these names for all users globally would satisfy the requirements of the court. However, this would have the “extraterritorial” effect of applying French legal decisions to every internet user worldwide, when they are meant to solely apply to France, for the commercial benefit of a single private, foreign-owned company. We suspect if other nations wished to impose their national legislation within France, there would be a strong reaction from French users and authorities. The converse is equally true: the findings of a French court are not applicable to the rest of the world. Such a system would set a precedent that any nation could impose their laws, morals, economic demands, or social constructs upon any other nation by the means of blocking DNS names, and thus blocking communication and content. Therefore, this global blocking method is entirely unworkable for us as a solution to be compliant with the court order. What is “France” from the perspective of the internet? There are more important reasons geoIP blocking will not work. We already prevailed in a similar legal case in Germany in 2021-2023 in which we learned an important lesson: we tried to use geoIP blocking as a “hack” in a similar circumstance at the start of the legal proceedings, allowing us to continue services in Germany until the case concluded. The plaintiff (Sony Music Entertainment GmbH) then used a VPN to access the blocked content from Germany in circumvention of the geoIP blocking. The court agreed with Sony in their assertions of noncompliance, and we were fined for contempt of court. From this experience, we know that the geoIP-based model is not only unfit from a technical perspective, but we have proven, historical evidence that using geoIP methods results in fines being levied against us by courts. To any technology-aware person, this seems absurd and outrageous – but this is what we face in these lawsuits where there is a disconnect between the courts’ understanding and how (and why) the technical protocols of the internet actually operate. We cannot risk this negative outcome in this or any other future instance, as absurd decisions apparently are de rigueur in these cases. We eventually won that case against Sony, but it took several years, six figures of cost to Quad9, and massive wasted time – all of which set us back in our ability to deliver services and is a resource debt we are still paying for today. This case is just more of the same – the opposition has more lawyers than we have money and time. The decision of Quad9 Given these conditions and as a result of our unwavering mission, our historical experience, our desire to remain within the law, and the outcome of the court decision, we are left with an uncomfortable choice. The demands lead us to an impossible requirement: we must adhere to the court’s decision, or we face growing risks to our existence. However, in implementing the blocking, we must either extend French law to the whole world (blocking globally) or create a vulnerability condition whereby we continue to be at risk because the available technical methods are imprecise, impossible to validate, and do not meet any user privacy and security requirements. This leads us to the only conclusion we can understand to eliminate our legal risk and keep us true to our mission: we must make our cybersecurity protection and general services unavailable to French users. Our departure is scheduled for November 24, 2026. In any event, for Quad9, this is a matter of principle regarding the potential misuse of these types of blocking measures. Allowing private corporations to have the ability to block what is seen on the internet seems to us to be a dangerous and infinitely deep problem. Actions that seem reasonable and infrequent today will tomorrow become an avalanche of petty demands used to suppress political, religious, economic, or social outcomes. We will not be even a small part of that degradation of the freedom of knowledge. Once the tools of censorship are built, they are rarely used sparingly or justly. This case with beIN is not the only litigation we face in France. There are approximately 20 different lawsuits pending against Quad9 (and other recursive resolver operators) that demand we comply with blocking hundreds of different names. We expect many of them to escalate to the same conditions as we have seen with beIN, which puts Quad9 at risk regardless of the outcome of this case. Based on the generalized, high-level traffic statistics we keep, we know we have many users in France. With our departure, those users will be put at risk from the threats we have protected them from for nearly 9 years. We deeply regret that result, but we have no other choice. Below is a partial list of the networks from which we see traffic in France. You will see many infrastructure, national security, finance, education, and other networks of critical importance in addition to ISP users and mobile users. All these users will lose service on November 24 because of the legal risks facing Quad9 in France. What is the purpose of this whole lawsuit, anyway? The most troubling part of this decision is that it is ineffective in practice. Forcing Quad9 to block domain names does not take the content out of circulation and has no effect on the servers that house the data. We offer a free service, and there are thousands of other open DNS systems that do what Quad9 does but with lower trust, safety, and reliability. Users seeking blocked content will simply shift their DNS to use one of those other free services, possibly using systems in other nations that have less-than-honorable intentions from a privacy and security perspective. This is like holding a piece of newspaper in front of a stadium full of people to block the view of a concert. It is an unsolvable problem via recursive DNS, and the effect of legal rulings like this is not measurable outside of the amounts paid to lawyers and the number of words in press releases declaring hollow victory. Even beIN will not see any changes. Perhaps that is understood and the cruelty may be the point - we cannot say with certainty why such expenditures have been made against a small nonprofit like Quad9, which tries only to bring safer, trusted service to users. But of this we are certain: these actions are a tragic waste of time and resources and create a real, negative outcome for the internet community of France, whether or not they are our users. What we are doing on November 24 Quad9 will not block the domains in question - we wish to remain committed to our integrity of providing a complete view of the DNS for users who wish that service. However, starting on November 24, we will no longer serve French users, thus keeping Quad9 out of danger from similar, perhaps even larger risks in the future. Our hope is that 30 days will be sufficient time for conversion, though we regret that this message will undoubtedly not reach some users in time. An appeal is pending, and we will continue to legally defend our position in court in this case and as many other cases as we are able. We will continue to oppose court-ordered DNS blocking of this nature everywhere. Our resources are limited, but we are determined to keep the internet open and free. You can donate here to help us continue to deliver on our mission and assist us in the legal costs we incur in this and other fights. What you can do next We think this problem is reversible. French citizens: tell your legislators that looking up names is not a criminal offense. The internet needs to remain open and freely available to anyone, and neutral intermediaries like Quad9 (or any DNS resolver) should not be implicated in legal proceedings because we map names to IP addresses. Further, we know there are potential plans in consideration in France (and other European nations) to give private corporations and others automated and unvalidated abilities to filter DNS content that they alone determine to be unwanted, making it possible for a wide range of badly-managed or anti-democratic activities to be implemented. We believe you disagree with this as much as we do. Make yourself heard, or you will lose your rights silently. ARCOM is your regulatory authority, and you should tell them this precedent places France at risk both from a practical and strategic perspective. Let them know that under their mandate, they have to balance your digital rights as citizens as well as the audiovisual rights on sports event broadcasts of rights holders. Balance cannot be claimed when the privacy and security of digital users are the collateral damage. In conclusion Fighting piracy via DNS resolvers blocking is ineffective. It is disproportionate and misguided, ill-fitted and futile to fight piracy, as the source content remains completely available to resurge under another name. Forcing Quad9 to depart harms French digital strategy and sovereignty in the long run relating to security, privacy, and integrity - contradicting France’s supreme national interests in exchange for a short-term, imaginary commercial victory. We deeply regret that we must leave our French users without cybersecurity protection, but we hope the future will see a more reasonable interpretation of the law which allows us to return. Sincerely, The Quad9 Team * This post was authored and translated into French by humans on the Quad9 Team Partial List of French Networks Using Quad9 This list is extracted from network metrics of an hour or so of typical usage. Quad9 tracks network autonomous systems number origins as per our privacy policy, but we do not identify individual IP addresses or users within those networks. There are hundreds of additional French networks using Quad9; we picked only these at random to show the breadth of usage. Autonomous systems are not exclusively geographically-mapped and cannot be used as a jurisdictional identifier; though it is safe to say that most of these networks have a significant portion of their user base in France. National government & public agencies 60855 — Direction interministérielle du numérique (DINUM) — Prime Minister’s digital directorate; sets state digital strategy and runs the interministerial state network (RIE). 43717 — Business France (EPIC) — National agency that helps French firms export and attracts foreign investment. 205461 — France Travail (EPA; formerly Pôle emploi) — National public employment service: job placement, jobseeker support, unemployment benefit payment. 777 — CEA Paris-Saclay (EPIC) — Saclay centre of the Commissariat à l’énergie atomique et aux énergies alternatives; public research in nuclear and alternative energy, defence and health technology. 44850 — Institut de recherche pour le développement (IRD; EPST) — Public research institute working with Global South partners on health, environment and social sciences. 29110 — Institut Pasteur (private foundation, recognised as public utility) — Non-profit biomedical research foundation in Paris (infectious diseases, vaccines, microbiology); hosts national reference centres. Research & education network 1307, 1712, 1715, 1942, 1945, 2060, 2094, 2198, 2200, 2202, 2259, 2269, 2457, 2470, 2472 — RENATER (GIP) — National research and education network; its members are the State and public research bodies. Student-run campus networks 204515 — Crans (association) — ENS Paris-Saclay student network association providing connectivity, hosting and email to members. 212424 — ViaRézo (Association des réseaux de CentraleSupélec) — Student association providing internet and IT services on the CentraleSupélec campus. 207849 — ESIEESPACE — ESIEE Paris student club that runs OpenGate, a student non-profit ISP. Private education 56339 — IONIS Education Group (SAS) — Private for-profit higher-education group (EPITA, Epitech, ESME, IPSA, ISG, Sup’Biotech). Regional & local government 208458 — Région Nouvelle-Aquitaine — Regional authority covering 12 départements; seat in Bordeaux; created 2016. 208820 — Département de la Seine-Saint-Denis — Île-de-France département; council seated in Bobigny. 50036 — Département des Pyrénées-Atlantiques — Nouvelle-Aquitaine département; council seated in Pau. 34000 — Département des Bouches-du-Rhône — Departmental council. 48799 — Ville et Eurométropole de Strasbourg — Shared administration of the City of Strasbourg and the 33-commune Eurométropole. 204897 — Grand Besançon Métropole — Communauté urbaine of 67 communes around Besançon. 208574 — Communauté de communes du Pays de Bitche — Intercommunal body of 46 communes in Moselle; owns the Tubéo public fibre-to-the-home network. 202834 — Commune d’Échirolles — Commune south of Grenoble; member of Grenoble-Alpes Métropole. 211127 — SITPI (Syndicat intercommunal pour les télécommunications et les prestations informatiques) — Ten Grenoble-area communes pooling telecom, IT and GIS services. Public digital infrastructure (local-authority networks & IT) 200245 — Manche Numérique (syndicat mixte) — Builds the Manche fibre network; provides IT, e-administration and telecom services to local authorities. 44842 — Somme Numérique (syndicat mixte) — Owns the Somme fibre network; provides digital services to local authorities and schools. 214589 — Essonne Numérique (syndicat mixte ouvert) — Essonne public fibre network, plus interconnection, hosting and data-centre services for public sites. 47608 — Gigalis (GIP) — Pays de la Loire regional fibre network for local authorities, health, emergency services and schools. 41114, 62038 — Orne THD (SPL) — Company owned by Rombas and neighbouring communes in Moselle; sells fibre internet and TV over their networks. 39271 — C’Chartres Innovations Numériques (SEM) — Chartres Métropole company running fibre, a private 5G network, a data centre and IT services. 207430 — SITEC, Société informatique et télématique corse (SEM; Collectivité de Corse 56%) — Hosting, cloud, cybersecurity and IT services for Corsican public bodies. 50547 — Régie du réseau câblé du Haut Sundgau (local-authority régie) — Public wired telecom network in southern Alsace. 49011 — MACS THD (SASU, SFR group) — Private company running the Maremne-Adour-Côte-Sud (Landes) high-speed network under a public-service concession. Energy & utilities 1301 — Électricité de France (EDF; 100% state-owned) — National electricity producer and supplier; operates France’s nuclear fleet. 62141 — Compagnie nationale du Rhône (CNR; majority public shareholding, Engie reference shareholder) — Holds the Rhône concession: hydroelectric dams, navigation and irrigation, plus wind and solar. 39830 — Teréga (private SA; formerly TIGF) — Gas transmission and underground storage operator for south-west France. 43734 — UEM (local SEM; formerly Usine d’électricité de Metz) — Metz utility: electricity, gas, district heating, public lighting. 12727, 42487, 208719 — Vialis (SEM; Colmar largest shareholder) — Colmar utility: electricity and gas plus cable TV, internet and fibre. 204645 — Régie ENES (Régie municipale d’électricité de Creutzwald) — Municipal régie: electricity, fibre internet, local TV, district heating. Transport 203885 — SNCF (Société nationale SNCF SA; state-owned) — Parent holding company of the national railway group. 34809 — Sanef (SA; Abertis subsidiary) — Motorway concession operator for northern and eastern France. Health 201659 — AP-HM (Assistance Publique – Hôpitaux de Marseille) — Marseille’s public university hospital group. 51588 — SESAN (GIP) — Île-de-France regional body providing shared digital-health services to care providers. 49692 — Compagnie Générale de Santé (SAS; private) — Name of the hospital group now called Ramsay Santé. Broadcast & media 24843, 43930 — France Télévisions (state-owned SA) — National public-service television broadcaster. 43646 — TDF (SASU; owned by infrastructure funds) — Broadcast transmission and tower infrastructure operator. Private industry & technology 29104 — Thales Services Numériques (SAS; Thales group) — IT services, cloud, security operations and integration for defence, space and public-sector clients. 49068 — Stormshield (SAS; Airbus Defence and Space) — Cybersecurity vendor (firewalls, endpoint protection, encryption); ANSSI-qualified products. 57226 — IDEMIA Identity & Security France (SAS) — Identity documents, biometric identification and border/access systems; formerly Safran Morpho. 41935 — Dassault Systèmes (SE; listed) — 3D design and simulation software (CATIA, SOLIDWORKS); not Dassault Aviation. 42924 — VINCI Construction SI (SNC) — In-house IT unit of VINCI Construction. 201647 — SI-nerGIE (GIE of Orano and Framatome) — Shared IT operations for both companies: data centres and local support. 49920 — Flowbird (SAS) — Maker of parking meters and transit ticketing systems. 20493 — Viparis Le Palais des Congrès de Paris (SA; 50/50 CCI Paris Île-de-France and Unibail-Rodamco-Westfield) — Operates the Palais des Congrès convention centre.