Quad9

Several independent evaluations have found Quad9 to be the most effective (97%) at blocking malware and phishing domains.[3][4][5][6] As of June, 2021, Quad9 was blocking more than 100 million malware infections and phishing attacks per day.[7] Quad9's malware filtering is a user-selectable option. The domains which are filtered are not determined by Quad9, but instead supplied to Quad9 by a variety of independent threat-intelligence analysts, using different methodologies. Quad9 uses a reputation-scoring system to aggregate these sources, and removes "false positive" domains from the filter list, but does not itself add domains to the filter list.[3][8][9][10]

Quad9 was the first to use standards-based strong cryptography to protect the privacy of its users' DNS queries, and the first to use DNSSEC cryptographic validation to protect users from domain name hijacking.[11][12][13][14][9] Quad9 protects users' privacy by not retaining or processing the IP address of its users, and is consequently GDPR-compliant.[15][16][17]

Map of Quad9 recursive resolver locations as of 2021-05-27

As of August 2021, the Quad9 recursive resolver was operating from server clusters in 224 locations on six continents and 106 countries.[18]

On June 18, 2021, Quad9 was notified of a first-of-its-kind injunction by the District Court of Hamburg, in which Sony Music demanded that Quad9 block DNS resolution of a domain name used by a web site which did not contain copyright-infringing material, but contained links to other sites which did.[19] This is the first instance in which the copyright-holder industry has sought to compel a recursive DNS operator to block access to Internet domain names, so this is a novel interpretation of German law and is thought to be a precedent-setting case with far-reaching consequences. Quad9's General Manager John Todd was quoted in the press as saying "Our donors support us to protect the public from cyber-threats, not to further enrich Sony" and "If this precedent holds, it will appear again in similar injunctions against other uninvolved third parties, such as anti-virus software, web browsers, operating systems and firewalls." Legal expert Thomas Rickert of eco, the German Internet association, commented: "I cannot imagine a provider who is further removed from responsibility for any illegal domains than a public resolver operator." Quad9 immediately announced that it would contest the injunction and, as of June 24, announced that it had retained German counsel and would be filing an objection to the injunction.[20][21][10][22][23][24][25][26][27] Clemens Rasch, the attorney leading Sony's team, has not clearly stated whether any attempts were made to contact canna.to, the site widely suspected by the press to be behind the redactions in the court documents, saying only that Sony would have done so "if they could have been identified", while confirming that the site has been operating continuously for the past twenty two years. A court spokesperson said that "only the statements presented by the applicant side were used as a basis for the injunction" and that the court "took it on faith that the notifications which the applicant claimed to have sent were not only sent but also arrived at their recipient". At the close of the first week of the conflict, the press noted that donations to Quad9 were up by 900% relative to the prior week, and as of June 27, canna.to was still resolvable through Quad9's servers.[28]

On August 31, 2021, Quad9 filed an objection to the injunction, citing a number of flaws in the legal arguments made by Sony, but principally hinging on the fact that ISPs (which actually have a business relationship with infringing parties) are exempted from third-party liability, despite the fact that they also operate DNS recursive resolvers, and that it's a misinterpretation of the law to exclude independent recursive resolvers from that exemption.[29][3][30]

Quad9 operates recursive name servers for public use at the twelve IP addresses listed below. These addresses are routed to the nearest operational server using anycast routing. Quad9 supports DNS over TLS over port 853,[31] DNS over HTTPS over port 443,[32] and DNSCrypt over port 8443.[33]

• Response policy zone

• Official website
• Quad9 Connect now available on Google Play
• Zurich Cantonal organization registration