Quad9 is leaving France on November 24, 2026, and French users must choose another DNS resolver before that date. For a small or midsize business, Cloudflare 1.1.1.2 is a simple choice with antimalware filtering. DNS4EU Protective is better suited to individuals looking for European infrastructure. Google Public DNS and Cloudflare 1.1.1.1 provide general-purpose resolution without broad antimalware filtering.
Why is Quad9 leaving France on November 24, 2026?
Quad9 is leaving France following a decision by the Paris Judicial Court requiring the blocking of services illegally broadcasting sportive competitions. On October 21, 2026, the court assorted a penalty of €1,000 per day. Quad9 prefers to stop serving French users rather than implement these blocks.
The case originates with an order dated May 13, 2026. Google and Quad9 were required to block, from France, IPTV domains and services broadcasting WTA tennis matches without authorization. The order was enforceable despite Quad9’s appeal and was to remain in effect until November 14, 2026.
The legal basis extends beyond this specific dispute. In 2026, Article L333-10 of the Sports Code allows rights holders to request proportionate measures from any intermediary capable of stopping the repeated and serious distribution of sporting events. Domain lists can be updated quickly during a live broadcast.
Quad9 also says it is facing approximately 20 French proceedings corncerning hundreds of domain names. However, this figure, published by Quad9 on October 22, 2026, is not supported by an independent count. The appeal is still pending, but it does not automatically suspend enforcement of the decision.
What does Quad9’s departure mean for a small or midsize business?
Le départ de Quad9 peut empêcher les postes, serveurs ou équipements réseau configurés avec ce résolveur d’accéder normalement aux sites et services en ligne. Quad9 n’a pas précisé si les requêtes françaises subiront un refus explicite, une absence de réponse ou une autre erreur après le 24 novembre 2026. Attendre la coupure crée donc un risque évitable.
A recursive DNS service translates a human-readable name, such as a web domain, into a network address that machines can use. If this service stops responding, the internet connection may appear active whorle websites, SaaS tools, APIs, and messaging services become inaccessible.
The risk does not affect only the office router. A Quad9 address may be configured in a server, firewall, VPN, browser using encrypted DNS, mobile profile, or Docker container. Containerized environments deserve a specific check, just like the measures presented for securing a NAS and its Docker containers.
In the projects we undertake, we often see DNS settings defined at multiple levels with contradictory rules. The router uses one provider, the VPN imposes a second, and the browser bypasses both with DNS over HTTPS, meaning encrypted DNS queries within a web connection.
Which DNS should replace Quad9 in France?
The best replacement for Quad9 depends on the priority need. Cloudflare 1.1.1.2 offers simple antimalware filtering. DNS4EU Protective combines threat filtering with resolution on European infrastructure for individuals. Cloudflare 1.1.1.1 and Google Public DNS are suitable for general-purpose resolution, but they do not identically replace Quad9’s security policy.
| Service | Primary addresses | Filtering | Encrypted DNS | Point to note |
|---|---|---|---|---|
| Standard Cloudflare | 1.1.1.1 and 1.0.0.1 | No general antimalware filter | DoH and DoT | General-purpose resolution |
| Cloudflare malware | 1.1.1.2 and 1.0.0.2 | Malicious domains | DoH and DoT | Simple filtering for workstations and networks |
| Google Public DNS | 8.8.8.8 and 8.8.4.4 | No general antimalware filter | DoH and DoT | DNSSEC validation |
| DNS4EU Protective | 86.54.11.1 and 86.54.11.201 | Malwares, hameçonnage et serveurs de commande | Yes | Public service with limited bandwidth intended for individuals |
| Unfiltered DNS4EU | 86.54.11.100 and 86.54.11.200 | No general security filter | Yes | Court-ordered blocks remain applicable |
DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt the transport of DNS queries. DNSSEC, supported in particular by Google Public DNS, verifies the authenticity of signed responses. These mechanisms address different risks and do not automatically block a malicious domain.
Regarding privacy, Cloudflare states in 2026 that it does not sell personal data from its public resolver for advertising purposes. The company says it does not normally retain source IP addresses persistently, except in samples representing no more than 0.05 % of traffic for diagnostics and protection against attacks.
In 2026, Google says it normally deletes within 24 to 48 hours logs associating a customer’s IP address with their queries, with potentially longer retention for certain security events. Google specifies that Google Public DNS data is not used for advertising targeting. To explore further the difference between encrypted transport and overall privacy, the analysis on the limitations of a VPN when it comes to application data provides a useful parallel.
Honestly, public DNS4EU is not the right choice for an organization’s entire network. Its operator targets individual users, applies a bandwidth limitation, and recommends that organizations evaluate a professional offering or an internally managed resolver.
Antimalware filtering and court-ordered blocking: what is the difference?
Antimalware filtering blocks domains associated with malware, phishing, or criminal command-and-control infrastructure. Court-ordered blocking prohibits access to domains designated by a court decision. A DNS service presented as “unfiltered” may therefore still be subject to the legal obligations of the country where it operates.
This distinction changes the trade-off. Choosing Cloudflare 1.1.1.1 or Google Public DNS to avoid a security filter does not guarantee the absence of legal blocks. Google also states that it may block domains for security reasons or to comply with legal obligations.
Conversely, Cloudflare 1.1.1.2 adds a layer of protection against malicious domains, while 1.1.1.3 also filters adult content. DNS filtering remains a first line of defense. It replaces neither updates nor endpoint protection nor the correction of vulnerabilities such as those detailed in our discussion of the risks associated with PHP vulnerabilities and network equipment.
A common pitfall is to set a filtering DNS server as the primary server and a non-filtering DNS server as the secondary. A device may query either one interchangeably: the second server does not passively wait for a failure. According to Google Public DNS documentation in 2026, resolvers configured together must apply equivalent DNS filtering and DNSSEC validation policies.
How can you migrate before Quad9 leaves France?
Quad9’s hors migration should begin with an inventory, followed by a controlled test on a few devices before general deployment. For a small, well-documented organization, the operation can fit into a scheduled intervention. A network with a VPN, internal servers, and encrypted DNS requires more comprehensive testing and a prepared rollback.
The following checklist covers the points that most often cause an outage or an unintended bypass of filtering:
- Record the Quad9 addresses and hostnames present in routers, DHCP servers, firewalls, VPNs, servers, browsers, mobile profiles, containers, and monitoring tools.
- Document the existing configuration with screenshots, exports, and the list of affected devices before making any changes.
- Choose your criteria separately: jurisdiction, privacy, DNSSEC, DNS over HTTPS or DNS over TLS, antimalware filtering, centralized administration, and acceptance of French court-ordered blocks.
- Configure two addresses from the same provider or two resolvers that genuinely apply equivalent policies.
- Test ordinorary websites, DNSSEC errors, encrypted transport, internal names with split DNS—that is, names that differ depending on whether you are inside or horsor of the company—as well as the VPN.
- Verify filtering with an official provider test page, without downloading a dangerous file.
- Keep the old settings and an already tested fallback configuration so you can quickly return to the previous state.
Le point délicat est souvent le split DNS. Un serveur public ne connaît pas les noms internes de l’entreprise ; le remplacer directement peut donc casser l’accès à un intranet, à une imprimante ou à une application métier. Dans ce cas, les postes doivent continuer à interroger le résolveur interne, lequel transmet seulement les demandes publiques au nouveau fournisseur.
On the agency side, the usual approach is to first modify a representative pilot group: a desktop workstation, a remote ordinateur under a VPN, a mobile device, and a noncritical server. Validation over one business day reveals errors that a simple test of opening a website does not show.
Should you wait for the outcome of Quad9’s appeal?
Waiting for the outcome of Quad9’s appeal unnecessarily exposes French users to an interruption on November 24, 2026. The appeal is still pending, but the decision is enforceable, and Quad9 is publicly maintaining its withdrawal schedule. Preparation and testing must therefore be completed before the deadline, even if a legal change remains possible.
Quad9 has not made public the exact technical comport planned for connections originating in France. A complete outage is therefore not the only scenario: an explicit refusal or no response at all are also possible. In any case, an untested failover can disrupt browsing, APIs, software updates, and certain security checks.
Preparing for the migration does not necessarily mean switching all equipment on the same day. You can validate the new resolver now, document the settings, and schedule the final change during a maintenance window. At this stage, a few hours of preparation are preferable to an improvised diagnosis after the outage.
Framing this change in advance avoids most interruptions and inconsistent security policies. An outside perspective can be useful lorsque DNS is combined with the VPN, internal servers, managed browsers, and conformité constraints.
FAQ about replacing Quad9
Will Quad9 continue to work in France after November 24, 2026?
Quad9 announces the discontinuation of its services for users located in France as of November 24, 2026. The service has not specified whether requests will be denied, time out, or produce another error.
Does changing the DNS modify the company’s public IP address?
Changing the DNS resolver does not modify the public IP address provided by the internet service provider. The change concerns the translation of domain names into network addresses, not the identity of the connection.
Does Cloudflare 1.1.1.1 block malicious websites?
Cloudflare 1.1.1.1 is not the general antimalware filtering variant. Cloudflare reserves this filtering for the 1.1.1.2 and 1.0.0.2 addresses in 2026.
Is DNS4EU suitable for an enterprise network?
The free public DNS4EU service is intended for individuals and has bandwidth limitations in 2026. DNS4EU recommends that organizations consider an enterprise offering or an internally managed resolver.
Does encrypted DNS prevent a court-ordered block?
DNS over HTTPS and DNS over TLS encrypt the query between the device and the resolver. Encrypted DNS does not prevent the selected provider from applying a court-ordered block.