Quad9 is leaving France. If you're in France and anything you own points at 9.9.9.9, you have until Tuesday, November 24, 2026, when Quad9 stops serving French users. That covers your router, your Pi-hole upstream, your Unbound forward-zone, the DoH setting in your browser and the DNS= line in a resolved.conf you wrote in 2021 and haven't looked at since.
This post covers why it's happening, a one-liner to find every Quad9 address on your machines, which alternative DNS to switch to, and configs for systemd-resolved, macOS, Windows, OpenWrt, Pi-hole, Unbound and browser DoH. I finish with a complaint about where this leaves anyone in France who wants a resolver nobody can lean on.
Why Quad9 is leaving France
On October 21 a French court ruled against Quad9 in a case brought by beIN, the Qatari sports broadcaster. The order requires Quad9 to stop resolving a list of domains that beIN says carry pirated sports streams, for users in France. Quad9 announced the next day that it won't do that and will leave instead.
The court did cut the penalty from €580,000 to €1,000 per day: "a daily penalty of 1.000 euros until the blocking concludes on November 14 (i.e., 24.000 euros)", in Quad9's words. An appeal is pending. So this one case's penalty isn't what's driving them out; the number of cases is. The post says there are "approximately 20 different lawsuits pending against Quad9" and that it "cannot survive the accumulation of penalties yet to be assessed" across them.
Why not just geo-block the beIN domains for French IPs? Quad9 tried that approach in Germany. In the 2021–2023 Sony Music case, Sony "used a VPN to access the blocked content from Germany" and Quad9 was fined for contempt. They won that case in the end, but came away knowing that an IP-based filter only counts as compliance until someone connects through a VPN. As they put it: "Autonomous systems are not exclusively geographically-mapped and cannot be used as a jurisdictional identifier."
Who breaks on November 24 (including Mullvad users)
The list at the bottom of Quad9's post is the best part. French networks currently using Quad9 include DINUM (the state's digital agency), RENATER, France Travail, SNCF, EDF, France Télévisions, Thales Services Numériques, Stormshield, Institut Pasteur, AP-HM, and "hundreds" more. On Lobsters, one commenter called the list "the most hilarious part" and singled out EDF: the national power company resolves through a Swiss non-profit that a sports broadcaster just pushed out of the country.
The timing makes it worse. On September 3 Mullvad announced it is shutting down its public encrypted DNS, with a November 2, 2026 deadline. It moves Mullvad Browser's default DoH to Quad9 and told manual users to migrate to Quad9. So French users who did what Mullvad advised get to migrate a second time, three weeks later. One HN commenter pointed out that when small resolvers shut down and hand their users to Quad9, "it pools more users into one place."
Quad9's post doesn't say how it will cut off French users. Assume 9.9.9.9, 149.112.112.112, 2620:fe::fe and 2620:fe::9 will stop working for you, and don't count on 9.9.9.10 either.
Find every place 9.9.9.9 is hiding
Grep before you change anything. It's easy to fix the router and forget the Docker daemon.
# Linux: resolved, netplan, NetworkManager, unbound, /etc/docker/daemon.json
sudo grep -rnIE '9\.9\.9\.(9|10|11)|149\.112\.112|2620:fe::|quad9' /etc 2>/dev/null
# Compose files and dotfiles: point it at wherever you keep them
grep -rnIE '9\.9\.9\.(9|10|11)|149\.112\.112|2620:fe::|quad9' ~ 2>/dev/null
# What resolved is actually using right now
resolvectl status | grep -i 'DNS Server'
# OpenWrt
uci show network | grep dns; uci show dhcp | grep serverPlaces I'd check by hand: forward-addr: 9.9.9.9@853#dns.quad9.net in unbound.conf, "dns": ["9.9.9.9"] in Docker's daemon.json or a dns: key in a compose file, a Quad9 template in Windows 11's encrypted DNS dropdown, and the DHCP settings on whatever router your ISP gave you.
Quad9 alternatives compared: Cloudflare, DNS4EU, AdGuard, NextDNS, Unbound
| Resolver | Operator / jurisdiction | Filtering options | Encrypted | French blocking orders |
|---|---|---|---|---|
| Cloudflare 1.1.1.1 | Cloudflare, US | none / 1.1.1.2 malware | DoH, DoT | Complies (Paris appeal court upheld it) |
| DNS4EU | Whalebone, Czech Republic, EU co-funded 2023–2025 | protective, child, no-ads, unfiltered | DoH, DoT | Applies court blocks to every variant, including unfiltered (source) |
| AdGuard DNS | AdGuard, Cyprus | default (ads, trackers, phishing) / unfiltered | DoH, DoT | Not public as far as I can find |
| NextDNS | NextDNS, commercial | per-account blocklists | DoH, DoT | Not public as far as I can find |
| Mullvad DNS | Mullvad, Sweden | n/a | n/a | Shuts down November 2, 2026 |
| Unbound (recursive) | You | whatever you configure | to your LAN | Nobody to serve an order on |
Here's what I'd tell a friend in France:
- On a laptop, use Cloudflare or DNS4EU unfiltered over DoH. Both will apply the French piracy blocks. Google, Cloudflare and Cisco were ordered in 2024 to block domains for Canal+, and the Paris Court of Appeal upheld those orders in March 2026, so expect the same from any large resolver still operating in France. Cisco pulled OpenDNS out of France rather than comply, so it's not an option either.
- DNS4EU is an EU project and behaves like one. It answers on EU infrastructure under EU law and states that court-ordered blocks apply even to "unfiltered." It also rate-limits and says the public resolvers are for individuals, not organisations, so it won't replace Quad9 for RENATER.
- For a home network, run a recursive Unbound. I think this is the only good long-term answer, and the rest of the post explains how.
Copy-paste configs
The examples use DNS4EU unfiltered with Cloudflare as fallback. Swap in other IPs from the table if you prefer.
Linux (systemd-resolved)
# /etc/systemd/resolved.conf.d/10-no-quad9.conf
[Resolve]
DNS=86.54.11.100#unfiltered.joindns4.eu 86.54.11.200#unfiltered.joindns4.eu 2a13:1001::86:54:11:100#unfiltered.joindns4.eu
FallbackDNS=1.1.1.1#one.one.one.one 1.0.0.1#one.one.one.one
DNSOverTLS=yessudo systemctl restart systemd-resolved
resolvectl status
resolvectl query example.comIf NetworkManager pushes per-link DNS from DHCP, set ipv4.ignore-auto-dns yes on the connection, or the router's 9.9.9.9 will keep winning.
macOS
networksetup -setdnsservers Wi-Fi 86.54.11.100 86.54.11.200
networksetup -getdnsservers Wi-Fi
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponderAlso check System Settings → Privacy & Security → Profiles. Old Quad9 or Mullvad .mobileconfig profiles take priority over this setting.
Windows (admin PowerShell)
Get-DnsClientServerAddress
Set-DnsClientServerAddress -InterfaceAlias "Wi-Fi" -ServerAddresses ("1.1.1.1","1.0.0.1")
Get-DnsClientDohServerAddressWindows 11 ships Cloudflare as a built-in DoH template, so after setting the IPs you can pick "On (automatic template)" under Settings → Network → your adapter → DNS server assignment.
Router (OpenWrt)
uci set network.wan.peerdns='0'
uci del network.wan.dns
uci add_list network.wan.dns='86.54.11.100'
uci add_list network.wan.dns='86.54.11.200'
uci commit network && service network restartOn a consumer router, open the WAN or DHCP page and replace 9.9.9.9 and 149.112.112.112. If the router only lets you set DNS on the WAN side, also check that its DHCP server isn't handing Quad9 directly to clients.
Pi-hole v6
sudo pihole-FTL --config dns.upstreams '["86.54.11.100","86.54.11.200"]'Better still, point it at a local Unbound on port 5335 using Pi-hole's own guide, then:
sudo pihole-FTL --config dns.upstreams '["127.0.0.1#5335"]'Unbound: delete the forward-zone
If your unbound.conf has this:
forward-zone:
name: "."
forward-tls-upstream: yes
forward-addr: 9.9.9.9@853#dns.quad9.netdelete the whole block. Without a forward-zone, Unbound resolves from the root servers itself. Then sudo unbound-checkconf && sudo systemctl restart unbound.
The catch is that your queries to authoritative servers go out unencrypted, so your ISP can see them, and stopping that is why a lot of people moved to DoH in the first place. In exchange, no third party can be ordered to filter your answers. In France in 2026, I'd accept that trade-off.
Firefox and Chrome DoH
Firefox: about:preferences#privacy → DNS over HTTPS → Max Protection → Custom → https://unfiltered.joindns4.eu/dns-query. Or in about:config, set network.trr.uri to that URL and network.trr.mode to 3.
Chrome: chrome://settings/security → Use secure DNS → Custom → same URL. If you manage fleets, the DnsOverHttpsTemplates policy is the knob to look for.
Mullvad Browser users on the default DoH get moved to Quad9 automatically. If you're in France, set a custom DoH URL now.
Which resolver is next?
Quad9 was the resolver people picked because it was a Swiss non-profit foundation, didn't log user IPs and was willing to fight in court. None of that protected it. Twenty pending lawsuits did more damage than any single ruling.
The other big resolvers are no better off. Cloudflare and Google complied. Cisco left. DNS4EU says in its docs that it will comply. Any public resolver still serving France unfiltered is just one the rightsholders haven't sued yet.
On HN, gerdesj put it in one line: "When an org resorts to fiddling with DNS they've already lost whatever argument is to be had." True, but they keep winning in court anyway, and users are the ones who end up reconfiguring.
So, which DNS resolver are you running right now? And would you still trust it if your government leaned on it? If you think a recursive Unbound is overkill for most people, tell me why in the comments.
Sources
- Quad9, "Au revoir, France": https://quad9.net/news/blog/au-revoir-france/
- Hacker News discussion: https://news.ycombinator.com/item?id=50195959
- Lobsters discussion: https://lobste.rs/s/s0aktw/quad9_dns_resolver_exit_france
- Mullvad, shutting down public encrypted DNS: https://mullvad.net/en/blog/2026/9/3/shutting-down-our-public-encrypted-dns-servers-and-sponsoring-quad9-instead/
- DNS4EU public resolvers: https://www.joindns4.eu/for-public
- AdGuard DNS provider list (AdGuard, Cloudflare, NextDNS addresses): https://adguard-dns.io/kb/general/dns-providers/
- Techdirt on the French Canal+ blocking orders: https://techdirt.com/2026/04/23/france-keeps-breaking-the-internet-to-stop-piracy-even-though-its-not-working/
- Pi-hole Unbound guide: https://docs.pi-hole.net/guides/dns/unbound/