On October 21 a French court ruled in favor of beIN, a Qatari broadcaster with offices in France, which had asked Quad9 to stop resolving a list of domain names it says are pirating its sports broadcasts. The next day Quad9 announced that it will stop answering queries from users in France as of November 24, and that it will not block those names anywhere. Quad9 is a Swiss nonprofit foundation that has given away a public recursive resolver at 9.9.9.9 for nearly nine years. It has no accounts and no sign-up, which means it cannot tell which of its users are in France. So it decided to lose all of them rather than keep the ones it cannot identify.
The money in the case is small enough to be misleading. The court reduced the penalty from €580,000 to €1,000 per day, and the blocking order is set to run out on November 14, which puts the total at about €24,000 plus legal costs. Quad9’s own post says the €1,000 a day is survivable. The problem is the queue behind it. About twenty more lawsuits are pending in France against Quad9 and other resolver operators, demanding the blocking of hundreds of other names, and the foundation expects many of them to reach the same posture. A daily fine that a nonprofit can absorb for twenty-four days is a different instrument when it is twenty-four days times twenty cases times however many more get filed.
Compliance had three possible shapes and Quad9 rejected all of them on the record. It could block the names globally, which would apply a French court’s findings to every internet user on earth. It could block by geography, and it has already tried that: during a 2021 to 2023 case brought by Sony Music Entertainment GmbH in Germany, Quad9 used geoIP filtering as a stopgap, Sony connected through a VPN, the court agreed that the filtering did not count as compliance, and Quad9 was fined for contempt. It eventually won that case, at a cost of several years and six figures, and it is still paying down the time. Or it could build the thing the order actually requires, which is a reliable map from a request to a jurisdiction, and that map does not exist for a service with no users on file.
What leaves on November 24 is not only a free service. Quad9 published a partial list of the networks it sees querying from France, and it reads like a country’s critical infrastructure rather than a consumer user base: national security networks, finance, education, ISPs, mobile carriers. Meanwhile the order accomplishes almost nothing on its own terms. The servers hosting the content stay up, the names stay registered, and anyone who wants the blocked content can point their machine at another free resolver, possibly one with weaker privacy practices or one operated from a jurisdiction with fewer scruples. Quad9’s own comparison is a person standing in a stadium holding up a newspaper.
The Hacker News thread ran to 1,049 points and 376 comments by the following afternoon, and the best line in it was the simplest. “Punishing the DNS resolver is weird,” wrote babarock. “Would you punish the phone book company for having the number of a criminal listed?” The most useful comment came from johnhtodd, who identifies himself in the thread as Quad9’s CTO and concedes the contradiction people kept pointing at: the foundation says geoIP blocking cannot satisfy a per-name order, and it will probably use geoIP filtering to drop French users anyway. “We could apply this same geoIP filter list now to selectively block French users from reaching the sites that we’ve been told to make unavailable,” he wrote. “But this would corrupt our core premise, which is that the DNS is not the right place for this to happen.”
🎩 Cask’s Take
The whole case turns on a property of the protocol that nobody wrote down because nobody had to. A recursive resolver is asked for the address of a name, and that is all it is told. It does not receive an identity, a location, or a reason. The privacy a resolver can offer is the same fact as the ungovernability a court runs into, and you cannot have one without the other. An order scoped to a country asks a system with no notion of countries to behave differently inside one of them, and the only faithful implementations left are to lie to everyone or to stop answering some people.
That is what makes the departure from France an honest reading of the architecture rather than a stunt. Quad9 is not refusing to obey a ruling it could obey. It is declining to build the surveillance the ruling presupposes, because a resolver that knows which requests came from France is a resolver that keeps a log of who asked what.
I keep coming back to the fine, because the fine is where the leverage lives. €1,000 a day is a rounding error for Google and Cloudflare, which have both been through the same French blocking regime and complied. It is fatal for a donation-funded foundation facing twenty open cases, and the difference between those two outcomes is not principle, it is balance sheet. The mechanism being tested here is whether rights holders can convert a legal theory into a queue long enough to exhaust the only operators who fight.
There is a quieter cost that lands on people who were never parties to any of this. The free resolver market has been consolidating for years, partly because running one at scale is thankless work, and consolidation is what makes orders like this cheap to enforce. Every time an operator exits and hands its users to a larger remaining operator, the next order gets more coverage for the same filing fee. A commenter in that thread, DemiGuru, put the loop precisely: “A blocking order is only as damaging as the resolver it impacts.”
So French users will move to whatever still answers them on November 24, and a share of them will move to something worse than what they had. The pirated streams will keep streaming. The only thing that changes is that one of the careful operators is no longer in the country, and the next court that wants a name taken down will find fewer parties willing to argue about it. A directory that cannot say who is asking cannot be told who to lie to, and the way this ends is that the directory leaves instead.