johnhtodd

(context: I am the CTO of Quad9) Using those threat intelligence feeds is optional, as the blog post indicates. 9.9.9.10 & secondaries have no filtering.

The threat feeds we offer are in alignment with what the user expects and intends. Mandatory restriction of DNS resolution by a third party (not the user, not Quad9) is expressly what users do NOT want, regardless of the outcome. Once such restrictions are enacted and treated as normal, the channel for making demands will fill with a flood of "objectionable" names from every corner for every reason. Quad9 has already received demands from the French regulator to block sites which deliver adult content found to be objectionable to minors. We see an extremely slippery slope which has already moved out of piracy as the scoped intent which is this case in particular.

More to the point: prohibiting content via the DNS is a useless exercise when it is done out of alignment with the end users' goals - they will simply use some other recursive resolver (or their own) probably without the benefits of being oriented towards security and privacy. We have no monopoly on DNS resolution - there are thousands of others open to public use, and anyone can set up their own, for free, with no mandatory requirements by governments or regulators. This case (and any others like it) only drives out law-abiding organizations who are trying to promote better cyber hygiene and who want to keep the DNS as a single, un-splintered high-integrity pointer system.

French law does not care if the servers are in France or anywhere else - just that the users are in France. This sounds unexpected, but that is the law. There is a treaty called the "Lugano Convention" that allows civil lawsuits to be extended across borders of the member nations in events like this - France and Switzerland (where Quad9 is based) are signatories on that convention, so effectively French law can apply in Switzerland on matters involving internet activity. It is much more nuanced than that, so forgive this short summary, but removing servers from France is not sufficient.

(context: I'm the CTO of Quad9 and am one of the people dealing with the lawyers)

There is an understandable focus on "how are you going to block French users" when we have also claimed that geoIP blocking is insufficient for selectively denying resolution for certain names - we understand this conflict, but we think it is energy spent in the wrong place.

It is probable that we will use geoIP filters to block French users from our services after November 24. We could apply this same geoIP filter list now to selectively block French users from reaching the sites that we've been told to make unavailable. But this would corrupt our core premise, which is that the DNS is not the right place for this to happen, and if we comply within France to meet the requirement then we accept the worst eventual outcome for users and we still do not have legally perfect coverage. We wish to first remain consistent with our core mission, and secondarily we must remain as close to compliance as we can to the legal constraints put upon us. By accepting the demands for blocking, we would admit that such demands are permissible within our mission - that we will act on behalf of companies (or others) to create ineffective and mis-directed regimes of content constraint.

We would be admitting that we think this solves the problem - it does not. We would be admitting that we will do this for an ever-increasing number of names - we will not. We would be permitting these methods to be applied for more areas of filtering such as moral, religious, social, or political reasons - we must not.

So we accept that there is the possibility that we will have errors in our blockade, but in this case (blocking French users) we maintain consistency with our stated mission of integrity of the DNS. We would rather there be a clear distinction made for users of our services: you get the DNS as you (the user) expects, or if Quad9 is forced to pollute the service with unexpected and arbitrary number of fragmentation demands, then we will not offer the services at all.

The underlying issue is not ONLY that geoIP blocking is ineffective, but that the entire premise of any of these demands is inappropriately applied to DNS recursive resolution providers. We would hope that this discussion continues to be on the most fundamental of the disagreement we have with the outcome in this court case, not on the details of the technical implementation which have yet to be entirely decided and which can be tuned over time.

Interesting to see this on HN - it's a few miles from my house, and was very happy to see the sale to the state.

Note that there are TWO possible paths down to Abiqua creek that are quite close to one another at the top of the (quite deep) ravine in which the falls are located. One is hard, but not impossible. The other one is the "death trail" which isn't really a trail - it's a series of broken shale rock slides covered with fallen trees and steep "waterfalls of rock" but helpfully someone has put some ropes down it to make it seem like yes, this leads somewhere. It does not. One summer evening we thought it would be a nice after-dinner hike to take the "other trail" to the falls. Yeah... my thighs were sore for two days after the up/down/sideways, and the water was too deep to even go upstream to the falls. But it was an adventure.

I will say that Vidmar, Lista, and Rousseau make thin drawer cabinets that work well for cables if you have graduated from "big box of cables" to "cabinets full of cables". Also, old map or blueprint drawers work well. Still requires obsessive coiling, but being able to see (semi-random access) all of them in a drawer all at once is a big speed improvement for searches.

No, canaries in our opinion are not a particularly good idea for a variety of reasons. We have not received any requests/demands for information in 2026 - we'll try to update the page to reflect that this is no longer a quarterly update.

This is an area that is fraught with challenges. Serving a truly global audience means standards are difficult to measure as to what is "adult content" - it varies widely (Wikipedia in some areas is "adult content", as an example.)

In the near term, there is no filter set that we offer that mimics that functionality.

However, we recognize some variation of "best effort" adult content segmentation is a useful filter to have. We're considering it in the near term, as we have some specific educational institutional pressure to try to meet as well, since students are often easy targets for phishing, classroom computers are rife with malware, and there is also the problem of inappropriate DNS-based profiling of students and schools - problems that Quad9 can help solve.

We actually quite like DOQ and DOH3, both of which use QUIC.

All modern Apple systems use QUIC. For instance if given 9.9.9.9 via DHCP they will automatically upgrade to encryption via DDR, then then upgrade to DOH3 with no intervention by the end user. We find that encryption load is lower with QUIC-based transports, but we need to really get a formal research paper together on that "in our spare time."

Faster? Probably, but is it measurably "better" remains a question for others to answer. Due to parallelism in most query sets, minor wins with DNS latency matter less than you might think.

Our goal is not "insulation" as much as it is "transparency." Governments that do not adhere to legal frameworks like the ones you reference above are also governments that have inconsistent or easily-changed legal structures - we are not hiding in some obscure and possibly unstable nation that ignores international standards. Our jurisdictional choice of Switzerland is the opposite of that. Switzerland has a strong history of making legal enforcement events transparent, with processes that follow expected process. We cannot avoid following the law, nor is that our goal.

Swiss data privacy law is also much more strict on us, which "puts our money where out mouth is" as the saying goes. Violating privacy laws in Switzerland may result in criminal penalties, not simply civil penalties - jail time, rather than just fines.

Cost and staff time to pursue were not significantly higher than the return. We just want to help people with security and privacy and do DNS stuff - this legal fighting is absurd and misplaced and a spectacular waste of time, but here we are.

What's even worse: the court fined us because they claimed this use case was in some way in contempt of their ruling. Then, when we won the overall case, that money was never returned because it wasn't specifically referenced by the final court. The response from the lower court was effectively: "Well, you will need to sue the court to get that money back." <table flip>

Edit: I'm with Quad9 (CTO)