Quad9 Leaves France Rather Than Filter DNS for One Broadcaster

Quad9 will stop answering DNS queries for users in France on November 24. A French court ordered it to block recursive resolution for a set of domains for French users; Quad9 is withdrawing instead of complying. Its statement says French users will be left without an alternative that adequately protects cybersecurity and stays compliant with European privacy law. The organization says it cannot comply over the long term while staying faithful to its privacy and security mission. Users elsewhere keep the same service.

The complainant was beIN, a Qatari company with French offices, which argued the domains were carrying unauthorized broadcasts of sports events it holds rights to. Quad9 says it has no association with those domains or their operators. The court cut the daily penalty from €580,000 to €1,000. That reduction reads like leniency and works like a leash: small enough to keep the order alive for years, large enough that ignoring it costs something. The first figure would end a small operator outright. That is the trap.

Recursive DNS is one of the last places where a network answers a question plainly. Once a court can order a resolver to withhold names, every resolver becomes a filter point, and the list that matters is the one nobody outside the courtroom sees. Quad9 calls recursive resolution “a neutral and passive service” and refuses to alter answers. That stance, more than the money, is what the ruling puts on trial. Lose that argument in France, and it gets tested elsewhere. That is the precedent to watch.

What surprised me is that money was never the deciding number. €1,000 a day is a rounding error for a resolver network, and Quad9 still walked, which puts the compliance cost in the answers rather than the invoices. I have recommended Quad9 to people who wanted an independent resolver, and I still would in most countries. The difference now is that the recommendation needs a map, and the map needs a date on it.

Skip it if a recursive resolver already runs inside the network and never forwards queries upstream. Everyone else: the router hands one resolver address to every device over DHCP and then nobody looks at it again for years. The one action still worth taking is to find that address and check whether its operator has published a position on blocking orders. If the answer is yes, that is the whole check.