Overview

You’re administrating DNS for a building, office, business, ISP, etc, and you want to use Quad 9. Great choice!

Note

For ISPs or organizations with more than 5,000 users behind a forwarding cache, or if you expect more than 500 queries per second from a single egress IP address, please contact Quad9 Support with the details of your deployment, so that we can work together to ensure a smooth and successful deployment.

Caching forwarders and their optimal configuration are critical when sending queries en masse to Quad9, and is highly preferred over direct assignment via DHCP to end users with regards to:

Performance

Reducing the amount of queries that recurse to Quad9, saving bandwidth and providing a faster experience for the end user when their queries are already in the forwarders’ cache.

Security

Enabling query logging or some type of high-level metrics is advised to identify possible compromise from specific endpoints or customers, and is sometimes required by local law.

Local Policy

Being able to block or analyze certain FQDNs at the forwarder level puts more control in the hands of the network administrator without relying exclusively on Quad9 to block malicious domains.

When setting Quad9 as the recursive resolver in your infrastructure and caching DNS forwarders, please consider the following best practices.

Exclusivity

Since DNS forwarders use round-robin ordering when forwarding queries to a list of recursive DNS servers, Quad9 must be set as the exclusive recursive DNS servers in your forwarders. Adding additional, non-Quad9 recursive DNS servers will result in a percentage of your DNS queries not being protected by Quad9’s threat blocking.

Caching

It is imperative that your DNS forwarders are configured to cache response data in order to avoid excessive recursive queries to Quad9 and to provide significantly faster DNS resolution for devices on the network.

Ensure that your DNS forwarders have enough memory or disk space allocated to the cache to avoid the cache filling up.

The amount of memory that should be dedicated to DNS caching varies greatly from megabytes to gigabytes based on the amount of DNS requests originating from your network endpoints.

BINDdnsdistUnboundKnot ResolverWindows DNS Server

Bind caches in memory by default, so the only limitation is exhausting available memory in the system.

To check the size of the current cache, you can dump the cache to a local file and then examine the file size, which will be approximately how much memory is being used by cache:

rndc dumpdb -all

ls -alh /var/bind/

Caching is disabled by default, but can be enabled for in-memory storage

Allocated cache size is determined by the msg-cache-size and rrset-cache-size options in the unbound.conf file

You can check the amount of memory that your cache is currently using to compare against the cache size you allocated in unbound.conf by using the unbound-control command to view stats for mem.cache.rrset and mem.cache.message values.

Knot Resolver caches on disk by default, but can be configured to use memory/tmpfs, backends, and share cache between instances. Knot Resolver has excellent documentation about all things caching

In-memory caching can be configured using the Set-DnsServerCache cmd applet.

Memory usage can be checked using the Get-DnsServerStatistics cmd applet.

Use the Primary and Secondary Quad9 IP Addresses

Configuring both the primary and secondary IP of your desired Quad9 service helps naturally load balance the DNS queries in the Quad9 infrastructure.

Use IPv6

If your network is capable of IPv6, also configure the primary and secondary IPv6 addresses of your desired Quad9 service in your DNS forwarders, which helps naturally load balance the DNS queries in the Quad9 infrastructure.

If IPv6 is not in use, Quad9 strongly encourages you to investigate how to get it enabled on your network. IPv6 route paths are often faster compared to IPv4 paths, which leads to a higher chance of success at faster speeds with better redundancy.

Separate IP Addresses for Each DNS Forwarder

Each DNS forwarder should, ideally, send and receive DNS queries to Quad9 using different public IPv4 and IPv6 addresses, even if the addresses are within the same subnet.

Disable DNSSEC Validation

Since Quad9 already performs DNSSEC validation, DNSSEC being enabled in the forwarder will cause a duplication of the DNSSEC process, significantly reducing performance and potentially causing false BOGUS responses.

dnsdistKnot ResolverPowerDNS RecursorUnbound

Add this in dnsdist.confabove your pool assignment.

if noDNSSECOnNOSEC then  addAction(NetmaskGroupRule(nmgNOSEC, false), SetDisableValidationAction(), { name="R_NO_DS" })end

Add this to the kresd.conf file and reload/restart the kresd service.

-- turns off DNSSEC validationtrust_anchors.remove('.')

In recursor.conf, disable dnssec and reload/restart pdns-recursor

dnssec=off

Comment out these lines in unbound.conf and reload/restart unbound.

trust-anchor-file:auto-trust-anchor-file:trust-anchor:trusted-keys-file:

Disable QNAME Minimization

QNAME Minimization is a privacy feature that is intended to be used when you operate a recursive resolver (Quad9), but in a DNS forwarder, it provides no privacy enhancement and significantly reduces performance. What is QNAME Minimization?

BINDdnsdistUnboundKnot Resolver

In the options { section of the named.conf file, add the following line and reload/restart named/bind9.

qname-minimization disabled;

QNAME Minimization is not supported in dnsdist. Nothing to do here.

Add this in the unbound.conf and reload/restart unbound.

qname-minimisation: no

In the kresd.conf file, add a policy to disable QNAME Minimization and restart/reload the kresd service.

policy.add(policy.all(policy.FLAGS('NO_MINIMIZE')))

Questions? Issues? Contact us!

Get Support

Summary

Quad9 believes that DNSSEC is required for a secure DNS and will only implement Negative Trust Anchors (NTAs) for the shortest time possible when it believes the greater harm would come from taking no action.

This post will talk about our NTA policy moving forward, including background on what an NTA is and when they will be used by Quad9.

DNSSEC & NTAs: General Background

Quad9 tries to be as secure and trustworthy as possible when resolving domains for end users, and one of the many methods we use to ensure this security is to validate domains that are using DNSSEC.

DNSSEC is a complex method of ensuring that domain names are cryptographically secured against tampering between end users, recursive resolvers, and authoritative servers. In short, it attempts to guarantee the response received by the recursive resolver (Quad9) was sent by the owner and operator of the domain across the set of potentially untrusted networks which comprise the internet. Extending this security guarantee all the way to the end user requires encryption between the user and the recursor, which is beyond the scope of this document but is something Quad9 offers with several available encryption protocols. DNSSEC is useful to protect the answers across what is typically the “longest” section of the transaction – between the recursive resolver and the authoritative server. It can be used all the way to the client, but very few stub resolvers like laptops or mobile devices implement DNSSEC validation and rely on the recursive resolver for that task. DNSSEC does not secure the transaction against observation during the lookup process; it only validates that the sender’s data is genuine.

DNSSEC has been increasingly prevalent with domain name operators in recent years to prevent a variety of security issues surrounding possible illicit DNS tampering. It also provides a number of additional benefits against some types of denial-of-service attacks and has other secondary benefits upon which new stability and security tools are being built. For a full explanation of DNSSEC, please take a look at this quick primer

Signing a zone with DNSSEC is an implicit demand by the authoritative domain name system operator that Quad9, the recursive resolver operator, must not resolve the domain if the encryption process returns with a fault. A DNSSEC fault would indicate that someone is attempting to subvert the domain name data of the authoritative server by some mechanism, and the DNSSEC failure is then the intended result. A domain hijack, cache poisoning, or other malicious action would cause such a failure, and Quad9’s refusal to return a corrupted name in those circumstances is the desired outcome.

In some circumstances, DNSSEC may be configured for a zone but may not work properly during a complete query chain process as a result of something other than malicious actions. This is most often due to misconfiguration, or in some circumstances it is due to some intermediary device or network element either corrupting or refusing to pass DNSSEC messages appropriately. Sometimes the failure is the result of differing interpretations of IETF RFC standards between authoritative and recursive resolvers or between two differing versions or packages of either authoritative or recursive software. Any of these types of faults will end with the same result as though there was an attempt to subvert the domain maliciously; the recursive resolver (Quad9) will mark the lookup as failing the DNSSEC tests, the lookup itself will fail, and the client will receive an error.

What happens when a fault is not a fault?

It is possible for a recursive resolver to selectively ignore DNSSEC validation for a zone which shows faults during the DNSSEC process. An exception rule can be inserted in a recursive resolver called a “Negative Trust Anchor (NTA)” which specifically excludes a domain or zone from DNSSEC validation processes, even if that zone is marked as being DNSSEC-signed by the owner. This is typically done when a domain/zone failure would cause significant operational problems for the users of the recursive resolver and typically only when a domain/zone is known to be faulty due to a configuration or other issue unrelated to any known security incident.

NTA exception rules manually inserted into recursive resolvers to bypass DNSSEC for a host or domain remove the integrity validation guarantees for that domain tree. NTAs are intended to be temporary workarounds for configuration mishaps, but they are sometimes used when a network path has difficulty passing DNSSEC records or when bugs are encountered in operational settings that cause failures for a small set of domains.

We believe NTAs are dangerous and often lead to more longer-term problems than they solve in the short term. Quad9’s intention is to let any records in a zone that is “broken” from a DNSSEC perspective remain unresolvable in order to encourage authoritative operators to repair the problem with the non-functional zone. If we or other recursive resolver operators continue to insert NTA exceptions in our respective systems, this will cause the operator of the faulty authoritative zone to receive contradictory information about the status of their DNSSEC configuration from various recursive resolvers which may or may not have identical NTA settings. Having a zone which resolves in an inconsistent way between recursive resolver operators creates conditions where authoritative operators are both uncertain of faults and may be unmotivated to correct issues that occur. In our experience, the state of some resolver systems working correctly (i.e., failing to resolve) and some not working correctly (i.e., resolving the name) with DNSSEC leads to an assumption of fault by the most distant participant, which slows or halts the repair process. In other words: “This is the fault of some other person, very far away from me: Ticket Closed.” With some resolvers working and some not, this may lead to authoritative operators blaming the recursive operator and vice versa. An even worse outcome that may occur is when there are support organizations involved who are not well-versed in DNS security, which may lead to further delays when inconsistent results are demonstrated by end users.

This implicit disregard of DNSSEC requirements by insertion of NTAs and the subsequent failure to repair both lead to a reduction in secure behaviors and is contradictory to the goals of DNSSEC adoption by both authoritative operators and recursive operators alike, and more importantly it reduces security overall for end users.

Prisoner’s Dilemma

We hope that other providers join us in eliminating or significantly reducing their NTA lists and making those lists public as we have done on our website here: https://quad9.net/service/negative-trust-anchors/. Inconsistent or unclear NTA inclusions by various providers leads to a “prisoner’s dilemma” where the recursive operators who have the worst security (meaning a higher number of NTAs or no validating DNSSEC at all) are most likely to receive migratory users in the case of faults that would cause a strict recursive operator to appear to be non-functional. Recursive operators who “defect” or who were never cooperating with DNSSEC security standards to start with will seem to be functional for resolution of what should be faulty DNSSEC lookups. In these cases, users may end up incorrectly considering those resolvers more reliable when in fact they are less secure.

Quad9 does operate a service with no DNSSEC (and no malware blocking) which can be used for testing DNSSEC versus non-DNSSEC validated answers. Our DNS service operating on 9.9.9.10/149.112.112.10/2620:fe::10 is non-validating, but we would strongly suggest it is not used for more than testing purposes as there are no protections provided by that resolver service address, as opposed to our other service addresses which have DNSSEC strict validation and malware blocking.

Our intention is to avoid adding NTA exceptions in the future and bring the NTA list down to zero entries as an eventual goal. If it is possible for other DNSSEC-validating, large recursive operators to also commit to the reduction or elimination of NTA records, then the criteria we use for adding NTA exceptions below will significantly change or be removed entirely. We may not be in that condition today, but it is our hope that the continued improvement of DNSSEC and expansion of strict DNSSEC validation will eventually allow the elimination of the concept of NTAs and subsequent prisoner’s dilemma conflict between recursive operators.

We recognize in certain extraordinary circumstances that NTAs may still be operationally necessary (see below). Adding an NTA is implicitly against the desire of the zone owner/operator; it is a declaration to ignore the security settings demanded by the authoritative server. But often there are conflicting goals in operational environments which require temporary solutions to prevent outcomes which are ultimately worse than others. End users expect that domains will resolve “correctly” by their own definition and are typically unaware of DNSSEC or the distinction between correct and incorrect resolution with security settings as an additional layer of complexity.

Users who believe that the recursive resolver is at fault (instead of the domain operator) may be at risk for changing their settings to a resolver that answers in the way they expect, even if that result is less secure. Once that change is performed it is unlikely they will change back to the DNSSEC validating resolver, even though that migration implies they have moved to a resolver that either already has an NTA or is not doing DNSSEC strict validation. Such a migration implicitly means lower security for that end user. We believe this type of migratory behavior (abandonment of security-oriented DNS for nonsecurity-oriented DNS) is a net negative overall. It is worse than the addition of an NTA if we can validate that adding the NTA does not produce results that we know to be malicious for the period of time necessary.

Quad9 will apply the following criteria when deciding to add an NTA:

1. If we receive significant customer complaints about a faulty DNSSEC-signed zone, AND
2. If we believe this will lead to a significant number of customers leaving the platform if it does not resolve, AND
3. If we believe the zone in question is simply faulty instead of compromised,

then we MAY consider adding an NTA for that zone or parent zone. Meeting these criteria does not always mean an NTA will be added, but these are our minimal requirements.

There are additional criteria we would evaluate further which may prevent the addition of the NTA, and an NTA exception is to be considered as the last option to prevent user migration in large numbers.

As part of an NTA addition, we will try to reach the operators of the zone in question to notify them of the fault and ask them about the repair status. We will frequently re-evaluate the list of NTA additions to remove zones which no longer meet the criteria or which have been repaired. Zone owners/operators may contact us to remove NTAs, regardless of the zone’s functional condition.

NTA History

Quad9 was one of the first large-scale recursive resolvers to validate DNSSEC. “Validating” means if a DNSSEC failure is observed, instead of just logging a fault but continuing to answer the query, we will not answer the question. In 2017 when Quad9 was publicly launched, DNSSEC was still undergoing significant deployment churn, especially underneath several top level domains. The “.gov” and “.mil” domains are operated by the US Government, which had mandated DNSSEC deployment in a relatively short period of time across all domains within those two zones. We think this is a well-considered policy and improves the security for both users and operators. However, several circumstances led to an unexpected result:

1. There are a large number of zones and independent operators of zones within those two top-level domains, with varying levels of DNSSEC expertise;
2. The level of DNSSEC robustness in available software packages at the time of the deployment was not universally stable; and
3. The timeframes for deployment for certain organizations may have been shorter than required for error-free implementation.

These three reasons (and quite certainly others) led to a significant portion of the .gov and .mil TLDs having long-term DNSSEC failure rates which were higher than in other TLDs and which caused critical errors for end users. (Note: there was a similar circumstance for Canadian Provincial government zone errors, but the circumstances around that deployment are not known to us.)

As an additional complication, in North America, Quad9 is extensively used by state/province, local, and small federal agencies as an inexpensive additional security layer. This means any DNSSEC failures on .gov domains were especially difficult from a customer service perspective, as that user base would present “fix-or-leave” support tickets which could only be solved by addition of NTAs. The .gov/.mil domains were at a volume that was sufficient for us to exclude both TLDs from DNSSEC validation in order to prevent end users from moving to non-validating resolvers, which was a sad and counter-intuitive result of what was a useful security initiative.

In subsequent years since the addition of those NTAs, the improvement of DNSSEC software and expertise has gradually created an environment where these blanket NTAs are no longer needed. The number of faulty zones is now down to the point where these top-level domain NTAs can be removed. The remaining misconfigured zones will either stop resolving as intended or will be identified and selectively accepted with a temporary NTA, and the operators of those zones will be given notice that we will remove the NTAs in a short period of time.

Other recursive resolvers have installed NTAs, most without rigorous documentation. There are almost certainly many .gov and .mil zones that are excluded from DNSSEC validation across other validating DNSSEC recursive resolvers, along with other zones in .com, .net, .org, and almost every other active top-level GTLD (generic top-level domain) or CCTLD (country code top level domain) zone. Our hope is that by publishing our NTA list on our website, as well as our criteria, we can take the first steps to an industry-wide model of transparency, notification, and action to prevent users from experiencing confusing or insecure DNS interactions.

Quad9 has added no NTAs in the last five years that have lasted more than 24 hours. Notably, the .bd TLD outage of April 2024 was an event where we assisted the Bangladesh user community by putting in a temporary NTA. We do not expect this policy statement to change the frequency of these events.

Summary

We will not eliminate NTAs today with this policy, but our goal is to reduce them to a very small number with very limited scope. Our intention is to remove them entirely at some point in the future when DNSSEC becomes as ubiquitous as HTTPS on websites, or when some other authorization/authentication mechanisms (such as ADOT and similar protocols and new signaling methods like DELEG) are implemented to assure the integrity of the resolution chain between recursive and authoritative DNS operators. By clarifying our policy and publishing our NTA list, we hope to create a demonstration of behavior for making security policy and treatment more transparent across the DNS resolver community. We invite others to join us.

At Quad9, our mission is to provide free, privacy-oriented DNS security to everyone, everywhere.  The Asia regions are home to some of the world’s fastest-growing digital economies which has made them primary targets for localised threats.

With an expanding user base across the Asian regions, we are looking for Threat Intelligence partners who specialise in those regional threats.

Why partner with Quad9?

Global threat feeds are essential, but they often lack the “boots on the ground” digital context required to stop regional campaigns before they spread. We are looking for partners who can help us identify domains used for:

• Regional phishing campaigns
• Localized botnet C2 infrastructure
• Attacks targeting Asian TLDs or regional languages

What do you get from Quad9?

In return for your intelligence feeds, Quad9 offers a unique value proposition: anonymized, real-time telemetry. ​​As a Swiss-based nonprofit, Quad9 is bound by some of the world’s strictest privacy laws. Our telemetry is strictly anonymized—we never store or share PII (Personally Identifiable Information). You get the data you need to fight crime; our users get the privacy they deserve.

Let’s Build a Safer Internet Together

We are ready to integrate your expertise into our global network of hundreds of clusters. Please reach out to us at support@quad9.net to start the conversation.

To protect our users, Quad9 blocks DNS lookups of malicious host names from an up-to-the-minute list of threats. This blocking action protects your computer, mobile device, or Internet of Things (IoT) systems against a wide range of threats, such as malware, phishing, spyware, and botnets, and it can improve performance and privacy. This blogpost provides security insights on the threats blocked by Quad9 DNS between July and December 2025. This time we analyzed the top 25 domains blocked by us. The report combines DNS telemetry data and open-source intelligence with statistics and analysis to provide security insights on the top malicious domains visited by our users and blocked by Quad9 DNS.

To better understand the nature of the high-volume threats targeting our Quad9 users, we categorized the top 25 blocked domains by their primary intent. The following chart illustrates the distribution of these threats, revealing a significant concentration in CrowdStrike mimicking domains in relation to the CrowdStrike outage in 2024 and malvertising infrastructures.

Mirai Botnet: 1.8 Billion Monthly Queries to a Single Domain

The Mirai botnet remains one of the most persistent and evolving threats in the cybersecurity landscape since its source code was famously leaked in 2016. Originally designed to enslave insecure IoT devices – such as IP cameras, DVRs, and home routers – by exploiting weak factory-default credentials, Mirai has since spawned numerous variants that continue to plague modern networks. The scale of its operations is often staggering; for instance, our analysis of top blocked domains revealed a single domain attributed to the Mirai botnet (perferctdmng[.]is) received more than 1.8 billion queries in just one month.

This massive volume of traffic highlights the nature of Mirai’s automated scanning and Command & Control (C2) communications, where hundreds of thousands of infected “zombie” devices continuously attempt to “phone home” or receive instructions for large-scale Distributed Denial of Service (DDoS) attacks.

Impersonation Risks: Analyzing 224M Queries to Fake Meta Support Domains

Beyond high-volume botnet activity, we also identified significant traffic directed toward metaverifiedsupport[.]net, a domain that masquerades as an official support channel for Meta Verified services. In H2 2025, we blocked 224,128,635 queries to this domain, with the highest concentration of activity originating from users in Turkey and Brazil. Our analysis confirms that this is a fraudulent domain used primarily for email forwarding in phishing and spam campaigns. The use of a “.net” TLD is a common red flag for credential harvesting operations designed to exploit users seeking account verification or assistance.

Threat Actors Exploiting CrowdStrike Incident

In July 2024, a faulty update to CrowdStrike’s Falcon Sensor security software caused widespread disruption across global IT systems. This incident resulted in millions of Windows computers crashing, severely impacting critical services in various sectors including air travel, banking, and healthcare. After the incident, CrowdStrike Intelligence has observed threat actors exploiting the Falcon Sensor incident. These actors are engaging in various malicious activities including:

• Phishing emails: Disguised as legitimate support communications from CrowdStrike.
• Impersonation: Posing as CrowdStrike staff during phone calls.
• False research claims: Presenting themselves as independent researchers, falsely linking the technical issue to a cyberattack and offering remediation guidance.
• Malicious scripts: Selling scripts that allegedly automate recovery from the content update issue, likely containing malicious code.

Quad9 blocked domains abused by those Threat Actors. In total, in H2 2025, we observed more than 3.9 billion DNS queries to 12 domains.

Omnatour Malvertising: A Persistent Top Threat

It should not come as a surprise that Omnatuor malvertising campaigns continue to plague users globally. Previously highlighted in our Cyber Insights reports (H1 2025, H2 2024, H1 2024), these attacks hijack browser settings to distribute harmful riskware. Cybercriminals exploit compromised websites to deliver spyware, employing sophisticated evasion techniques to avoid detection. In the second half of 2025, the Omnatour malvertising network proved to be an overwhelming force, accounting for the top 5 most blocked domains by Quad9. This resulted in an astounding 3.7 billion blocked queries attributed to just these four domains alone.

Conclusions

Over the years, it’s become easier and cheaper for cybercriminals to attack Internet users. Quad9’s mission is to improve the security and stability of the Internet, reducing users’ vulnerability to risk and helping them become more effective in their daily online interactions – even in the face of growing cyber attacks.

By preventing connections to malicious sites, Quad9 eliminates exposure to risks before they are downloaded to computers or a victim can access the fraudulent website. The inability to reach a malicious host means that defenses, such as virus protection, or user-based detection, such as certificate examination, are never called into action.

As a DNS provider, Quad9 has the unique opportunity to analyze the volumes and trends of malware campaigns. If you are a security researcher or threat intelligence provider and want to hear more, contact us via our website at: https://quad9.net/support/contact

Quad9 is a global nonprofit DNS security service that protects users from phishing, malware, botnets and other malicious domains by blocking threats at the DNS layer. Based in Switzerland and operating under strict privacy laws, Quad9 serves more than 100 million users worldwide, including public institutions, enterprises, ISPs, and individuals seeking free, privacy-first cyber protection.

References:

https://www.reversinglabs.com/blog/taidoor-a-truly-persistent-threat

https://blogs.infoblox.com/threat-intelligence/pushed-down-the-rabbit-hol

Australian telco Swoop has teamed up with Swiss-based cybersecurity nonprofit Quad9 to deliver free, enterprise-grade DNS protection nationwide, ensuring Australians regain access to fast, reliable security against online threats.

The agreement re-establishes local DNS routing for Quad9 in Australia after several major ISPs stopped directing traffic to its domestic servers earlier this year, a shift that forced Australian queries offshore to Hong Kong, Singapore and Los Angeles, resulting in slower response times and reduced reliability.

By hosting Quad9’s infrastructure across five major metropolitan hubs at no cost, Swoop has enabled the immediate return of fast, resilient DNS resolution for Australian users. Quad9’s threat-blocking service filters access to domains known to be associated with malicious activity, offering built-in protection without the need for software downloads, sign-ups or subscription fees.

Quad9, headquartered in Switzerland and governed under strict privacy laws, provides security services to more than 100 million users globally, including universities, libraries, government bodies, emergency services and ISPs.

“Quad9 exists to make the internet safer for everyone,” said Zachary Gilman, Network and Interconnection Manager at Quad9. “We operate as a neutral, nonprofit service with less than ten full-time staff supporting over 100 million users worldwide. Partnerships like this one ensure that Australians can continue to access free, privacy-first protection at the performance levels they expect.”

Restoring Critical DNS Security on Australian Soil

Earlier this year, major Australian ISPs stopped routing traffic to Quad9’s local servers, forcing Australian users to connect via Hong Kong, Singapore and Los Angeles. The increased distance created performance and reliability issues for people relying on Quad9 for protection against malicious domains.

Recognising the impact on end-user security and network performance, Swoop stepped in to host Quad9’s infrastructure across five major Australian metropolitan hubs – at no cost to Quad9. This has brought critical DNS security infrastructure back onshore, improving speed, resiliency and reliability for Australian users.

“Swoop saw an opportunity to support Australians who rely on secure, high-performance connectivity,” said Alex West, CEO of Swoop. “By hosting Quad9’s services for free across our network, we’ve helped restore fast, resilient access to essential security infrastructure that protects millions of people every day.

“This partnership sits right at the intersection of what Swoop cares about: robust infrastructure, customer-first connectivity and a safer online experience for everyone.”

Gilman added: “Swoop has made a huge contribution to Australia’s internet ecosystem. They recognised that this was core security infrastructure, acted quickly, and used their network to make sure our services remained available and performant nationwide. It’s exactly the kind of collaboration the internet was designed for critical services supported by organisations that care about community, not profit.”

John Todd, Quad9 CTO said: “We are thrilled to be bringing faster access for our services to our dedicated and technology-savvy user community in Australia. This partnership with Swoop ticks all the boxes – geographic diversity, great connectivity, and a common shared goal of security and privacy for end users.”

Because Quad9 is headquartered in Switzerland, its services are also backed by some of the world’s strongest privacy laws, ensuring that threat blocking does not come at the expense of user privacy or data exploitation.

A Safer Internet, Free for Every Australian

Quad9’s DNS security is openly recommended by the ACSC to Australians who have been targeted by phishing and online scams, and demand for simple, effective protection continues to grow as cyber threats become more frequent and sophisticated.

With Swoop’s support:

• Australians can access world-class DNS security at no cost
• There is no software to install or manage – users simply configure their devices or networks to use Quad9 by setting their DNS resolvers to 9.9.9.9 / 149.112.112.112
• Threat protection is delivered in real time, blocking known malicious domains before they can cause harm
• Services are delivered under Swiss privacy protections, ensuring a privacy-first approach to security

“Between Swoop’s engineering capabilities and Quad9’s nonprofit security mission, this partnership is a genuine win for Australian internet users,” West said. “It’s a powerful reminder that connectivity isn’t just about speed – it’s about safety, trust and doing the right thing for the wider community.”

About Swoop:
Swoop is a national provider of data, mobile and voice services to channel, business and residential customers with a focus on its own fibre and fixed wireless infrastructure. The Swoop network is designed and scaled to deliver ultra-reliable, high throughput, flexible telecom network services. Swoop is established and has the goal to build its business to become Australia’s best challenger internet and telecommunications provider.

Committed to exceptional service and competitive pricing, Swoop also offers voice services and tailored solutions. With a strategic focus on growth through acquisitions and network expansion, Swoop aims to become Australia’s premier challenger in the telecom space. Since listing in 2021, Swoop has acquired nine companies including Moose Mobile, Speedweb, Countrytell, Voicehub, Luminet, iFibre, Beam Internet and Community Communications and continues to gain recognition, recently named as a Digital Transformation Leader by AFR and a finalist in the 2023 Australian Growth Company Awards.

About Quad9:
Quad9 is a global nonprofit DNS security service that protects users from phishing, malware, botnets and other malicious domains by blocking threats at the DNS layer. Based in Switzerland and operating under strict privacy laws, Quad9 serves more than 100 million users worldwide, including public institutions, enterprises, ISPs and individuals seeking free, privacy-first cyber protection.

27 November 2025

Dear European Unions Legislative Authorities, the European Parliament, and the Council of the European Union,

As General Manager of Quad9, I am writing to express serious concern regarding emerging proposals that would require DNS resolvers to intervene in content enforcement actions. Such measures risk compromising a critical security layer that protects European citizens and businesses from online crime.

Quad9 is a nonprofit public-benefit foundation providing recursive DNS resolution with embedded security protections to more than a hundred million users globally. It operates exclusively at the recursive DNS layer and does not host, modify, or distribute content. Our role is to prevent communication with known malicious hosts based on threat intelligence sourced from multiple independent providers. This protective function is recognised under the principle of technical neutrality in EU telecommunications regulation and is consistent with the objectives of NIS2, which places strong emphasis on resilience and security of essential digital infrastructure.

The scale of the online threat is well-documented. In the 12 months to mid 2025, German consumers alone were estimated to have lost €10.6 billion to online scams including phishing, account compromise, and malware-enabled fraud. In that same time period, Quad9 blocked billions of attempted connections to malicious infrastructure across the EU. These blocks represent prevented harm. Weakening or encumbering the operation of recursive DNS resolvers would foreseeably increase exposure to exactly the types of attacks responsible for these losses.

There is a material difference between:

• Content distribution services, which can be used to transmit infringing content, and
• Security infrastructure services, which prevent the spread and impact of online crime.

Applying content-enforcement measures at the DNS resolver layer conflates these roles and risks undermining the security posture of citizens, businesses, public administrations, and critical services.

We therefore ask that forthcoming legislative and regulatory measures:

• Preserve the principle of technical neutrality by ensuring DNS resolvers operating as security services are not compelled to alter DNS replies.
• Avoid DNS-layer blocking obligations directed at recursive resolvers, as such measures interfere with the underlying infrastructure of the internet, increasing systemic vulnerability.
• Ensure proportionality under the Digital Services Act, recognising that nonprofit public-benefit infrastructure providers do not have the scale or role of hosting, platforming, or content-distribution intermediaries.
• Promote a consistent EU-wide environment for safety-enhancing network services, in line with the objectives of NIS2, to strengthen the resilience of digital infrastructure across Member States.

Quad9 stands ready to provide data, operational evidence, and technical expertise to support the Commission’s work in ensuring that measures to combat online piracy do not inadvertently weaken the security and stability of the European digital ecosystem.

Yours sincerely,

Simon Forster
General Manager
Quad9 Foundation

Zürich, Switzerland — 19 November 2025 — Quad9, the global public-benefit cybersecurity provider, is pleased to announce the appointment of Sylvie LaPerrière to its Foundation Council.

With more than 30 years of global leadership spanning telecommunications, digital infrastructure, and nonprofit governance, LaPerrière brings deep expertise in nonprofit board stewardship, infrastructure security, and international multi-stakeholder negotiations to the organisation’s governance.

“Sylvie brings a powerful combination of strategic governance experience, product insight, and global partnership leadership that aligns directly with our mission,” said Simon Forster, Quad9 General Manager. “Her work in expanding global connectivity, guiding high-impact organizations, and driving cross-border collaboration will strengthen our council and consolidate Quad9’s impact worldwide.”

LaPerrière has forged a career at the intersection of technology, product innovation, and international infrastructure development. Her portfolio includes executive leadership in deploying Google’s Equiano Subsea Cable along Africa’s western coast and scaling the internet backbones of Tata Communications and Teleglobe—underscoring her ability to bridge technical strategy, product execution, and complex international negotiations.

A recognised nonprofit and industry governance leader, LaPerrière has chaired the boards of directors of Canada’s Advanced Research and Innovation Network (CANARIE), the North American Network Operators’ Group (NANOG), the Montreal Internet Exchange (QIX), the Amsterdam Internet Exchange (AMS-IX), and served as a board member for Packet Clearing House, guiding organisations through strategic growth, policy alignment, risk oversight, and stakeholder engagement.

As LaPerrière joins the council, Mary O’Brien—an advocate and champion of Quad9 since its launch in 2017—announced the conclusion of her more than three-year tenure. Bill Woodcock, Chair of Quad9’s Foundation Council said, “We’re delighted to welcome Sylvie to Quad9’s Foundation Council, where I look forward to benefiting from the same leadership qualities she’s applied in many other internet governance fora. We’re very grateful for the help she’s already given the organisation in leading our executive search, and we look forward to a long and productive collaboration. At the same time, I’d like to extend my deepest appreciation to Mary O’Brien, whose mantle Sylvie is assuming; Mary’s contributions and support over the past three years have been invaluable, and the organisation and the Council are both very grateful for the time and attention that she’s so generously contributed to our cause. We wish her well in her future endeavours.”

“I am honored to join the Foundation Council at such a pivotal moment,” said LaPerrière. “I believe deeply in the power of global collaboration to solve infrastructure and access challenges. I look forward to contributing my experience to advance Quad9’s mission and expand its impact across communities and borders.”

LaPerrière’s  appointment reflects Quad9’s continued commitment to strengthening its leadership with global expertise in governance, product strategy, and cross-sector collaboration to advance sustainable, inclusive, and secure digital access, especially in underserved and vulnerable communities.

About Quad9

Quad9 is a nonprofit foundation based in Switzerland that provides free cybersecurity services to the emerging world via secure and private DNS lookup. Quad9 operates more than 245 locations across more than 115 nations, blocking hundreds of millions of malware, phishing, and spyware events daily for an estimated 100+ million end users. Quad9 reduces harm in vulnerable regions, increases privacy globally against criminal or institutionalised interception of Internet data, and improves performance in underserved areas. quad9.net

Media Enquiries:
Renée N. McLaughlin
Communications Manager
Quad9
rmclaughlin@quad9.net

Around the world, courts are increasingly allowing holders of intellectual property (IP) rights to shift the cost and burden of enforcement onto neutral third parties — including the organisations that keep the internet running.

In principle, those who benefit financially from IP protection should bear the cost of enforcing it. Yet in practice, large rights holders are targeting intermediary infrastructure providers — such as DNS resolvers — because pursuing the actual infringing parties is complex, time-consuming, and expensive.

This legal trend is now affecting the very foundations of how the internet functions — including the DNS resolvers that translate every web address into the digital pathways we use daily.

Recent court orders have sought to compel DNS providers, including free public services like Quad9, to block domains allegedly associated with unauthorised streaming of live sports and other copyrighted material. Instead of targeting the platforms that profit from infringement, IP owners are increasingly going after the neutral infrastructure providers that simply make the internet work.

For large commercial players such as Google, Cloudflare, or Cisco, these costs — legal, lobbying, or engineering — are absorbed as part of their business overhead.

For small, mission-driven nonprofits like Quad9, they represent an existential threat.

Which raises some important questions:

Governance and Control

• Should neutral, technical infrastructure be held responsible for the actions of others?
• How far should courts reach across jurisdictions to impose national laws on global networks?
• Who ultimately benefits from an internet governed by private legal action rather than public policy debate?
• Are we eroding the principle of network neutrality by making intermediaries arbiters of legality?

Innovation and Resilience

• Can small nonprofits survive under legal obligations designed for global corporations?
• What happens to privacy and resiliency when only a handful of corporations can afford to comply?
• Does shifting enforcement to infrastructure providers risk fragmenting the internet into nationally controlled networks?
• What precedent does this set for other forms of digital infrastructure, such as cloud storage or content delivery networks?

Rights and Freedoms

• At what point does legal compliance become de facto censorship?
• How should international law balance intellectual property rights with the right to access information?
• Is collateral damage to open, privacy-respecting services an acceptable price for enforcing IP rights?

These questions go to the heart of how the internet should function — open, fair, and accessible to all.

If you share that vision or can support Quad9’s mission to keep the internet private and secure for everyone, we’d love to hear from you (enquiry@quad9.net).

Summary

Quad9 will be discontinuing support within DNS-over-HTTPS (DOH) using HTTP/1.1 on December 15, 2025. This should have no impact on most users, but there are some older or non-compliant devices or software which may be unsupported after that time with DOH and which will have to revert to unencrypted DNS or shift to DNS-over-TLS.

Background

Quad9 was the first large-scale recursive resolver to offer standards-based encryption (DNS-over-TLS in 2017). We also provide DNS-over-HTTPS (DOH) as an encryption method, which has been slowly increasing as a percentage of our traffic since standardization and our inclusion of that protocol in 2018. Browsers have been the primary devices operating with DOH, which has some benefits: browsers are updated frequently and are typically kept up to date with newer standards.

The DOH standard recommends HTTP/2 as the lowest version of the protocol for use for DOH (https://datatracker.ietf.org/doc/html/rfc8484#section-5.2) but does not rule out using the older HTTP/1.1 standard. We have supported both HTTP/1.1 and HTTP/2 since our inclusion of DOH in our protocol stack seven years ago. However, we are reaching the end of life for the libraries and code that support HTTP/1.1 in our production environment and, therefore, will be sunsetting support for DOH over HTTP/1.1 on December 15, 2025.

Are you affected?

This sunsetting of HTTP/1.1 should not be noticed by the vast majority of our user community who are using Chrome (or any Chromium-based browser or stack), Firefox or Firefox forked projects, Safari (and to our knowledge all other Apple products/apps), or Android and iOS operating systems. They are all fully compliant with our existing and future DOH implementations and, to our knowledge, have always been compliant.

If your platform does not work without the older HTTP/1.1 protocol, then we would suggest you upgrade your system or shift to DNS-over-TLS which does not have an HTTP layer. There is always the possibility of moving to unencrypted DNS, but that decision should be closely considered as a downgrade of security and needs to be made carefully if you are in a network environment of higher risk.

The only platform that we are aware of directly that has ever used HTTP/1.1 and which will stop working after the sunset date are MikroTik devices that have been configured to use DNS-over-HTTPS, as those devices do not support the modern and recommended HTTP/2 transport protocol. We have communicated this to MikroTik on their support forum (https://forum.mikrotik.com/t/quad9-to-drop-support-for-http-1-1/264174/4), but there has not yet been an announcement by MikroTik as to when they will update their software to this more recent standard. Other than MikroTik, we have no specific knowledge of any other HTTP/1.1 devices or libraries with sizable user communities, though that does not mean there are no IOT devices or software libraries which are using that method.

From a geographic perspective, there is a community of users in Brazil who are on HTTP/1.1 which we believe to be MikroTik-based. Due to the fact that we cannot associate queries with users (or even one query with another) it is not easily possible for us to determine what types of devices these are, if not MikroTik, nor is it possible for us to inform those users about the impending change as by design we do not know who they are. We welcome any comments from our Brazilian community from knowledgeable users who can enlighten us as to the reasons for this geographic concentration (please contact support@quad9.net with details).

Our Reasoning

Despite our large geographic footprint and sizable user community, Quad9 remains a relatively small team. Our limited development efforts are better spent on bringing new features and core stability support to the Quad9 community, and we cannot justify the expense of integrating backwards compatibility for clients that are not meeting the recommended minimum version of protocols. HTTP/2 has been the recommended standard since the publication of the Request for Comments, and we believe this minimization of code is a reasonable step to take when compared with the costs and complexity of backwards compatibility development. In addition, HTTP/1.1 has significant speed and scale challenges, and as time progresses it may be the case that leaving it in our stack would introduce edge-case security or DOS attack vectors which would be difficult to discover and expensive to keep in our testing models.

The update allows us to move forward with additional, newer protocol support that we have been testing, which is ready for deployment and is part of a general refresh of our entire platform and system stack. We will have more flexibility and additional protocol support (keep watching this blog area for details), and the refresh also allows us to take better advantage of newer server hardware that we have been deploying worldwide to continue keeping pace with adoption rates.

We recognize this will cause inconvenience for some subset of users, and many users will not be aware of the change before it is applied as there is no assured direct method for us to communicate with our end users. This is the double-edged sword of not storing user data: we cannot directly notify everyone of changes.

If you know someone who will be impacted, please share and encourage them to take the necessary steps now to avoid interruption of service.

Quad9 ja CSC – Tieteen tietotekniikan keskus sopivat uudesta kumppanuudesta. Tämä yhteistyö parantaa kyberturvallisuussuojauksia korkeakouluissa ja tutkimuslaitoksissa Suomessa sekä laajemman yleisön joukossa, joka luottaa avoimeen DNS-infrastruktuuriin (Domain Name System, internetin nimipalvelujärjestelmä). CSC vastaa Suomen kansallisesta korkeakoulu- ja tutkimusverkko Funetista.

Funetilla on keskeinen rooli Suomen digitaalisessa infrastruktuurissa. Funet tarjoaa nopeita datayhteyksiä ja kehittyneitä verkkopalveluja korkeakouluille, tutkimuslaitoksille ja muille Funet-jäsenorganisaatioille. Yhteistyö Quad9:n kanssa laajentaa CSC:n turvallisuustarjoomaa maailmanlaajuisesti hajautetulla DNS-pohjaisella uhkien torjuntapalvelulla, joka asettaa käyttäjän yksityisyyden etusijalle ja parantaa kykyä torjua kyberuhkia.

“On tärkeää, että CSC on osa tätä kansainvälistä verkostoa, joka mahdollistaa Quad9:n kaltaisen hajautetun ja luotettavan järjestelmän,” sanoo Funetin johtaja Juha Oinonen. “Palvelu tuo käyttäjilleen uuden suojakerroksen, jonka avulla voidaan estää vaarallista ja haitallista sisältöä ilman kalliita lisäkomponentteja tai -palveluja. Useiden toisiaan täydentävien turvallisuusratkaisujen merkitys korostuu jatkuvasti muuttuvassa toimintaympäristössä, jossa kyberrikolliset alati kehittävät omia kykyjään.”

Tämän kumppanuuden myötä Quad9:n uhkia torjuva DNS-palvelu integroidaan Funet-verkkoon. Palvelu tarjoaa käyttäjille reaaliaikaista suojaa haittaohjelmia, tietojenkalastelua ja muita haitallisia verkkotunnuksia vastaan – yksityisyyttä vaarantamatta. Tämä tukee molempien organisaatioiden tavoitetta edistää turvallista ja avointa internetiä tutkimuksen, koulutuksen ja kaikkien verkon käyttäjien hyväksi.

“Funetin liittyminen Quad9-yhteisöön edustaa arvokasta laajennusta pyrkimyksissämme vahvistaa DNS-suojauksia yksityisyyden, turvallisuuden ja eheyden pohjalta. Olemme innoissamme siitä, mitä tämä kumppanuus tuo käyttäjillemme ympäri Suomea,” sanoo Quad9:n General Manager Simon Forster

Nyt julkistettava kumppanuus on jälleen yksi askel kohti vahvemman ja yksityisyyttä korostavan internet-infrastruktuurin rakentamista Euroopassa. Quad9 ja CSC pyrkivät yhdessä varmistamaan, että suomalaisilla organisaatioilla ja käyttäjillä on käytössään huipputason DNS-suojaus, jota tukee maailmanlaajuisesti hajautettu, läpinäkyvyyteen ja luottamukseen perustuva järjestelmä.

CSC – Tieteen tietotekniikan keskus Oy
on valtion ja korkeakoulujen omistama, voittoa tavoittelematon erityistehtäväyhtiö. Osana kansallista tutkimusjärjestelmää CSC kehittää, integroi ja tarjoaa korkeatasoisia ICT-palveluja tutkimukselle, opetukselle, kulttuurille, julkishallinnolle ja yrityksille. Lisätietoa:csc.fi