Quad9 alternatives after it leaves France on November 24

If anything on a French network resolves through 9.9.9.9, you have until November 24, 2026 to point it somewhere else. Quad9 is withdrawing from France rather than block domains a Paris court ordered it to block. The useful part of shopping for Quad9 alternatives is that it forces a question almost nobody asks when they type in a resolver address: whose rules does this resolver follow, and how would you know if it started refusing to answer?

We read every document named here on October 25, 2026. Court orders, vendor policies and resolver addresses all change, so check the current pages before you move anything.

Quad9 is leaving France on November 24, in its own words

Quad9, the Swiss non-profit resolver that reaches Upfynd's directory as Quad9, published its notice on October 22, 2026. It says it has "made the difficult decision to withdraw Quad9 services from France as of Tuesday, November 24," and that "starting November 24, Quad9 will no longer be able to offer its free cyberprotection service to users located in France." Its farewell post names French government, education, health, energy and ISP networks among the users who lose service.

The case behind it was brought by the broadcaster beIN Sports. According to TorrentFreak's reporting on October 5, 2026, a Paris Judicial Court order of May 13, 2026 required Google, Whalebone (which operates the EU-funded DNS4EU resolver) and Quad9 to block pirate streams of WTA tennis matches for users in France; the list grew from six domains to 58. beIN then asked for penalties of €10,000 per domain per day - €580,000 a day across the full list.

Quad9 says the court "significantly reduced the financial penalty, from €580,000 to €1,000 per day," leaving it facing "a daily penalty of 1.000 euros until the blocking concludes on November 14" - about €24,000, plus its own legal costs. Its objection is structural rather than financial: "We have no database of users associating them with jurisdictions," so "there is no way we can determine which users this ruling applies to." An appeal is pending.

Two things in that post are worth noticing before you plan around it. The blocking obligation it describes ends on November 14, ten days before the withdrawal, and the post does not explain the gap. And it never says what a French query will actually do after November 24 - whether it times out, is refused, or is answered from somewhere else. Plan for no answer at all: for a router or container with one hardcoded resolver, that would mean no name resolution rather than a slow one.

Who has to act before November 24, and who does not

You have to act if a device that sits in France sends queries to 9.9.9.9, 149.112.112.112, 9.9.9.10, 9.9.9.11 or Quad9's IPv6 addresses. In our view the copies most likely to be forgotten are not the laptop:

• the router or firewall handing out DNS over DHCP, and the second entry nobody checks
• the upstream in a Pi-hole or AdGuard Home install, which keeps resolving right up to the day it stops
• encrypted DNS profiles - DNS over HTTPS or DNS over TLS - set per browser or per phone, which override whatever the router says
• cameras, thermostats and other appliances with a resolver compiled in; our Connected Devices category is full of hardware that behaves this way, and firmware is where a hardcoded 9.9.9.9 is hardest to reach
• container images, CI runners and VPN clients that push their own resolver

You do not have to act if your queries leave from outside France: Quad9's post describes a withdrawal from one country, not a shutdown. The precedent still matters to you, because the same orders have reached resolvers in several countries, which is the next section.

Quad9 alternatives: what each big resolver does with a blocking order

Choosing a public resolver is usually framed as speed and malware filtering. It is also a question of which courts can reach the operator, and the operators below answer that very differently.

Google is the clearest, because it documents the behavior. Its Public DNS blocking page, last updated December 2, 2025, says Google "will comply with enforceable court and governmental orders to block DNS resolution of all names under specified domains," and lists five places where it does: Belgium, France, India, Italy and Portugal. A blocked query gets RCODE REFUSED, possibly with extended DNS error 16. If you are in India and you assumed 8.8.8.8 gave you an unfiltered view of the DNS, that page is the correction.

Cloudflare went the other way in the same French proceedings. Per TorrentFreak's October 8, 2026 report, Cloudflare told the Paris court that "to date, Cloudflare has not blocked content through the 1.1.1.1 Public DNS Resolver" and implements the ordered measures through its CDN instead; on September 17, 2026 the court rejected Canal+'s request for €50,000 per site per day. That is a court filing and a vendor statement, not something we can verify from outside, and it describes the position as of that date only.

To be plain about what we are not saying: none of this is a route around a lawful order, and we are not suggesting you look for one. It is an argument for knowing which rules apply to the service your whole network depends on, because that service can stop answering with 30 days' notice.

How to tell whether your resolver is blocking a domain

This is the durable skill, and it takes one command. A resolver that has been ordered to block a name does not usually lie about it - the response code and the extended error say who decided.

1. Query the resolver directly for the name, by address rather than through your system settings: dig @9.9.9.9 example.com, or nslookup example.com 9.9.9.9 on Windows.
2. Read the status line. NOERROR with an address is a normal answer. NXDOMAIN means the name does not exist. REFUSED is the one to look at - the resolver chose not to answer.
3. Ask for the extended error with dig +ednsopt and read the EDE code in the response. RFC 8914, published in 2020, defines 15 as Blocked ("on a blocklist due to an internal security policy"), 16 as Censored ("on a blocklist due to an external requirement") and 17 as Filtered ("on a blocklist as requested by the client").
4. Repeat from a second network. A name that resolves on mobile data and is refused on office Wi-Fi is being handled by something between you and the resolver, not by the resolver.

The three codes are worth memorizing because they separate the three cases people constantly confuse: the operator's own malware list, an order the operator did not write, and the filter you asked for. Quad9's own service addresses are an example of the first - 9.9.9.9 blocks known malicious domains by design, and 9.9.9.10 is the unsecured address that does not.

How we would choose a resolver now

Three questions, in this order.

Whose rules apply. Pick an operator whose jurisdiction and court exposure you are willing to live with, and accept that the answer can change. Quad9 is in Switzerland and still had to decide what to do about a Paris order; Cisco answered a French order by leaving the country.

What it filters by default, and what you can turn off. Malware blocking is a feature you probably want and should still know about. Control D is run from Toronto and offers free preset resolvers - its free DNS page lists presets from Unfiltered through Malware Protection to Family Friendly - and its paid self-serve tier is listed at $2 per endpoint per month with a 14-day trial. NextDNS gives you 300,000 queries a month on its free tier according to its pricing page, and says that past the quota it "will continue to answer DNS queries like a classic non-blocking DNS service" rather than cut you off. We were served that page in Indian rupees, so check the price in your own currency before you buy.

How you will notice. Whatever you choose, configure two unrelated resolvers rather than two addresses from the same operator, and keep a note of where DNS is set on each device. The networks that will have a bad November 24 are the ones where nobody can say which box hands out 9.9.9.9.

If you would rather not depend on anyone's resolver, running your own recursive resolver on the network is the other end of the trade: more to maintain, no operator to be served with an order. Upfynd lists 211 products under Open Source, 93 under Privacy and 139 under Security as of October 2026, which is where the self-hosted end of this lives.

One last thing, and we mean it as a caveat rather than a disclaimer: everything above describes documents we read on October 25, 2026, in a dispute that is under appeal in France. Court orders, their scope and their end dates change, and this is not legal advice. If real money or a compliance obligation rests on how your organization resolves names in France, read the current orders and take advice from someone qualified in that jurisdiction.

If you run anything in France, the next step is small and worth doing today: query each of your resolvers by address, write down what answered, and change the ones that will go quiet in a month. Then put a second, unrelated resolver behind it. For another case where a change in law decides what a tool may do, see our post on session replay and SB 690.