If you have 9.9.9.9 written down somewhere in your setup, Quad9's announcement this week matters to you. The free Swiss non-profit DNS resolver says it will stop serving users located in France on Tuesday, November 24, 2026, after a Paris court put a penalty of 1,000 euros a day on it. This article sets out what the court actually ordered, what Quad9 says about why it cannot comply, what the other side argued, and what to check in your own configs. Everything about the legal facts comes from the judgment itself, which Quad9 published, and from reporting that quotes it. Everything about Quad9's reasons is Quad9's own account, and I label it that way.

What a DNS resolver does, and what Quad9 is

When your laptop opens a website it first needs the site's network address. A recursive DNS resolver does that lookup for you: it asks the internet's name servers in turn, then hands back the answer. Your provider runs one by default, and anyone can point a device at another one. The resolver sees a name and the network address that asked. It does not need an account, and a free public resolver like Quad9's asks for none.

Quad9 is a Swiss public-benefit non-profit foundation. Its protective setting at 9.9.9.9 refuses to look up known malware and phishing domains; a separate unfiltered address, 9.9.9.10, does not. Quad9 publishes four service addresses for its protective service: 9.9.9.9, 149.112.112.112, 2620:fe::fe and 2620:fe::9. That is the list to search for in your configs.

What the Paris court ordered

The case is about women's tennis. beIN Sports France holds the French rights to most of the WTA tour. On May 13, 2026 the president of the Paris judicial court ordered Quad9, at beIN's request, to take all measures to prevent access from France to a list of unauthorised IPTV streaming sites until the last match of the 2026 season, set at November 14. According to TorrentFreak, the same order named Google's public resolver and the European Union's DNS4EU service. The list started with six domain names. Names notified later by the media regulator Arcom brought it to fifty eight, according to beIN's filing recorded in the judgment.

Quad9 appealed, but the May judgment carries provisional execution by law, which means it applies while the appeal is pending. The October judgment says so in plain terms.

beIN went back to court. Its case, as the judgment records it, is short: there is an order, a bailiff's report of June 26 showed two of the listed sites still reachable through Quad9, and Quad9 did not carry the order out. In September beIN asked for a penalty of 10,000 euros a day for each listed domain that stayed reachable. With fifty eight domains that is 580,000 euros a day, the figure in Quad9's statement.

The ruling of October 21

On October 21 the court set a penalty of 1,000 euros a day in total, from the date of the judgment until the measures end on November 14. Quad9 counts that as about 24,000 euros before its legal fees. The court rejected both sides' requests for costs, so each pays its own.

The reasoning matters more than the number. The judge wrote that the appeal and the proportionality objections do not suspend the May judgment, and that Quad9's offers of an agreement under Arcom's supervision cannot replace carrying out a court decision. On the technical argument, the judge wrote that Quad9 says it cannot carry out geolocated blocking but does not demonstrate it. The court also pointed to Quad9's own statement that it applies automated filtering to neutralise malicious domains worldwide, and said Quad9 appears to contradict itself. And then the line that carries the penalty: bound by an obligation of means, Quad9 states that it uses none, and that circumstance alone justifies a penalty.

"Obligation of means" is the legal standard for this kind of order. A resolver has to make reasonable efforts. It does not have to guarantee the outcome.

Why Cloudflare and VPN providers escaped a penalty two weeks earlier

The same Paris court ruled on October 7 on beIN's penalty requests against Cloudflare and several VPN providers. TorrentFreak reports that the court refused them, because each had blocked at least some of the listed sites. Cloudflare blocked three of four, through its content delivery network. NordVPN and Surfshark blocked six of eleven, through DNS on their servers in France. The court's view, as quoted by the press, was that a penalty was neither necessary nor proportionate given those efforts.

Quad9 says it blocked none of the fifty eight domains. beIN's own table counted six of them as unreachable through Quad9 on September 22, and Quad9 disputes that, backing its position with a written statement from its chief technology officer. That is the difference in the two outcomes: partial blocking by others, none by Quad9.

Quad9's argument

Quad9's statement makes four points.

First, it says it cannot know who is in France. A lookup reaches the resolver as a name and a network address, with no account or identity behind it. To block France only, it would have to guess a country from the address using a location database, and Quad9 calls those databases incomplete and inaccurate.

Second, it points to Germany. Between 2021 and 2023 Quad9 faced a case brought by Sony Music. By Quad9's account it tried a location filter early on, Sony used a VPN to reach the blocked content from Germany, and the court found it had not complied and fined it for contempt. Quad9 says it eventually won, after several years and six-figure costs. TorrentFreak reports that Quad9 also blocked globally in Germany in 2023 as a temporary measure.

Third, it says blocking worldwide would apply a French court order to every user on the planet, which it refuses to do.

Fourth, it argues that DNS blocking does not remove content. In its words, it is like holding a piece of newspaper in front of a stadium to block the view of a concert, because users can switch to thousands of other open resolvers. That is an argument by Quad9, not an established fact, and the court did not adopt it.

Why Quad9 leaves anyway, and the dates

The order in this case ends on November 14, when the tennis season does. Quad9 leaves ten days later. Its reason is that about twenty more French cases against resolvers are pending, that it expects many of them to reach the same penalty stage, and that it says it cannot survive the accumulated penalties. An appeal of the May judgment is also pending. France's Supreme Court is considering appeals against earlier DNS blocking rulings, where Google, Cloudflare and Cisco lost in March. Cisco's OpenDNS already suspended service in France in 2024 after a Canal+ order.

Quad9 has not fully decided how it will recognise French users. Its chief technology officer wrote on Hacker News that it will probably use location filters, the same method Quad9 says is unreliable, and accepts that errors are possible. His stated reason is consistency: Quad9 would rather withdraw than alter the answers it gives.

Who is affected

Quad9 published a partial list of French networks it sees, taken from about an hour of typical traffic. It includes the Prime Minister's digital directorate, the national research network Renater, the electricity company EDF, the railway SNCF, the Institut Pasteur and Marseille's public hospitals. Quad9 says the list is a sample of network numbers, that network numbers are not strictly geographic, and that hundreds more French networks use the service.

What to check

If you run anything in or for France, or you are unsure where your traffic is classified, look for Quad9 in the usual hiding places. These are generic places to search; Quad9 did not publish this list.

  • Routers and DHCP settings that hand out 9.9.9.9 or 149.112.112.112.
  • /etc/resolv.conf, and resolvectl status on systemd machines.
  • The dns setting in a Docker daemon configuration.
  • CI runner images and base images that hard-code a resolver.
  • Forwarders in Pi-hole, dnsmasq or a CoreDNS forward line.

A search like grep -rn "9.9.9.9" /etc finds the obvious ones. Add a second resolver you trust before November 24 so a failure of one does not take lookups down. Quad9 says it hopes thirty days is enough time, and admits some users will not see the message in time.

Open questions

The appeal is unresolved. The Supreme Court has not yet ruled on the earlier DNS cases. It is also unclear how Quad9's location filter will classify traffic from data centres and VPNs. I would treat this as a configuration review: a resolver you depend on has announced a date, and checking takes minutes.

Sources

I covered this on The Daily Diff, with a short side story on Google's Finnish data center sites. Which resolver do your servers use, and have you ever checked?

This article expands on an episode of **The Daily Diff, a five-minute daily video on what shipped and what broke in tech.
Watch the episode · Subscribe on YouTube · the written diff lands in your inbox every morning at thedailydiff.dev.

Video transcript and primary sources