Quad9

What Is Quad9?

When you type a website name, your device has to ask “what IP address is this domain?” Those DNS lookups are a constant stream of metadata about where you’re trying to go—often visible to whoever operates your DNS resolver, and sometimes to anyone watching the network path if you’re using plaintext DNS.

Quad9 solves two problems at once: privacy (by offering encrypted DNS options and a no-account service model) and security (by offering a “secure” resolver that blocks known malicious domains before your browser ever loads them). You don’t install a “private browser” here in the traditional sense; you’re swapping the DNS layer your devices use, which can reduce DNS-level tracking and stop a chunk of commodity malware/phishing traffic at the door. Quad9 frames its mission as providing a secure, private recursive resolver for the public benefit, not as an adtech or data-monetization play.

What makes Quad9 distinctive is the combination of: (1) a free, public resolver with threat blocking on its default “secure” service, (2) strong privacy commitments (including stating they do not store client IP addresses), and (3) a fairly modern encrypted-DNS lineup (DoT, DoH, DNSCrypt, plus DoH3 and DoQ enabled across its network).

Quad9 Features and Performance

Quad9 isn’t a VPN. It won’t hide your IP from websites, and it won’t encrypt all your traffic. What it does control is DNS resolution—both how it’s transported (encrypted vs. plaintext) and, on certain endpoints, whether known malicious destinations get blocked at the DNS layer.

Protocol support (encrypted DNS options)

Quad9 supports the major encrypted DNS transports you actually see in modern clients: DNS over TLS (DoT), DNS over HTTPS (DoH), and DNSCrypt. It also enabled DNS over HTTP/3 (DoH3) and DNS over QUIC (DoQ) across its global resolver network; for users already on Quad9’s DoH hostname endpoint, Quad9 says no configuration change is needed to take advantage of DoH3 where the client supports it.

From an “is it likely to work on hostile Wi‑Fi?” perspective, DoH is often the most compatible because it runs over HTTPS. Quad9’s own documentation also nudges DoH for devices that frequently roam onto guest networks, where DoT can be blocked more often.

Service variants: secure, unfiltered, and ECS trade-offs

Quad9 offers multiple resolver “flavors,” not just one IP address. The key split is:

• 9.9.9.9 (Secure): threat-blocking recursive DNS service.
• 9.9.9.10 (No Threat Blocking): for users who want Quad9’s recursive resolver without threat blocking.
• 9.9.9.11 (Secure + ECS) and 9.9.9.12 (No Threat Blocking + ECS): variants that enable EDNS Client Subnet (ECS) for better CDN geolocation accuracy in some cases, at the cost of sending a portion of your IP network information onward to authoritative DNS/CDN infrastructure. Quad9 explicitly describes ECS as a privacy trade-off and keeps ECS off by default on the standard service.

This matters for performance in the real world: the fastest resolver isn’t just about raw DNS latency; it’s also “did you get routed to the right CDN edge.” If you’ve ever had a resolver send you to the wrong region (slow video, weird website localization, or suboptimal cloud endpoints), ECS can help in some setups—but you’re paying with privacy leakage by design. Quad9 acknowledges that leakage and makes the ECS-enabled endpoint opt-in.

Threat blocking (what it blocks—and what it doesn’t)

Quad9’s “secure” service integrates multiple threat intelligence feeds and blocks domains/hosts associated with malware, phishing, botnets, spyware, ransomware, and similar security threats. Quad9 also states it does not block content and that agreements with threat-intel providers require the blocking criteria to be security-related, not general content categories.

One practical detail: when Quad9 blocks a domain, it returns NXDOMAIN. That’s intentionally simple and broadly compatible, but it also means blocks can look like “the domain doesn’t exist.” Quad9 documents a way to distinguish a Quad9 block from a normal NXDOMAIN by checking a specific response characteristic (AUTHORITY count in the response) and points users to a “Blocked Domain Tester.”

DNSSEC validation

Quad9 provides DNSSEC validation on its service endpoints and announced that DNSSEC strict validation would be active across every Quad9 service endpoint starting June 15, 2026. In plain English: Quad9 is positioning “authenticity checks” for DNS answers as a baseline feature, not a premium add-on.

Performance characteristics (what you can realistically expect)

Quad9 runs an anycast resolver network, so your DNS requests should normally route to a nearby location automatically. That helps keep latency low without you needing to pick a “closest server.”

Encrypted DNS performance is mostly about connection setup and persistence. DoT/DoH typically keep connections open, so the cost of the initial TLS handshake is amortized over time; DoH3/DoQ move this onto QUIC, which can reduce handshake overhead and avoid some TCP head-of-line issues in certain conditions. Quad9’s own announcement emphasizes QUIC’s encrypted-by-default design and TLS 1.3 requirement as part of why these transports are attractive.

No review can honestly promise “Quad9 is faster than X for everyone,” because routing and CDN behavior are location-dependent. What you can take from Quad9’s own design is: (1) anycast should usually keep resolver RTT reasonable, (2) ECS is available if CDN mapping is the bottleneck for you, and (3) QUIC-based encrypted transports are supported if your client can use them.

Pricing and Plans

Quad9’s public resolver service is free and does not require an account, sign-up, or contract.

There are no paid tiers to compare here: no monthly/annual plans, no feature gating, and no “refund window,” because there’s nothing to buy for the DNS resolver itself. If you’re evaluating Quad9 alongside paid DNS filtering products (or VPN bundles that include “secure DNS”), Quad9 is closer to critical Internet infrastructure than a subscription app: you point your device/router at it, and you’re done.

Privacy and Security Assessment

Jurisdiction: Switzerland (good baseline, not magic)

Quad9 is a Swiss foundation and positions Swiss jurisdiction as part of its privacy posture. Switzerland is often seen as a relatively privacy-protective jurisdiction compared to many adtech-heavy DNS operators, but jurisdiction alone doesn’t guarantee anything. What matters more is: what’s technically stored, what’s linkable to you, and what can be compelled.

Logging and data handling (what Quad9 claims to collect)

Quad9’s Data and Privacy Policy (version 1.1, published June 24, 2026) makes several clear claims:

• Quad9 says it does not collect or record user IP addresses, and does not store a proxy identifier in lieu of IP addresses.
• It states that the source (“Reply To”) IP address is present to deliver a response, but is held only in volatile memory briefly to service the query and increment counters, then discarded.
• Quad9 describes telemetry primarily as aggregate counters (by POP, protocol type, response codes, and other dimensions), rather than per-user logs.

Quad9’s FAQ also reiterates that it does not store client IP address data, and notes that it does log rough geolocation (city/state/country) used for analysis and shared with threat-intelligence partners (without IP address).

Important nuance: Quad9 draws a line between “no IP logging” and “some telemetry about blocked domains.” In its 2025 explanation, Quad9 says it shares “stripped DNS telemetry” related to malicious domains with partners—timestamp, query/type, and approximate geography—explicitly stating it does not store or transmit any form of IP address (including hashed or translated).

Transparency and law-enforcement requests

Quad9 publishes a transparency report stating it keeps no IP-address-based user data and has no user accounts. The report also includes a request history table (with years listed) and states “no requests for data” for the years shown.

Blocklist transparency (no “secret blocks”)

Quad9’s privacy policy states it will not implement undiscoverable block lists and that blocked domains can be searched and attributed to the source/analyst proposing the block. This is a meaningful differentiator versus DNS filtering products that won’t tell you why something failed.

Open-source posture

Quad9 maintains public GitHub repositories (including documentation and client app projects). That’s a positive sign for transparency in tooling and documentation, but it’s not the same as saying the entire production resolver stack is open source (and Quad9 does not claim that in the sources above). So the honest read is: some Quad9 software/docs are open, but you shouldn’t assume “fully open-source resolver infrastructure” unless Quad9 explicitly says so.

Independent audits (what we can and can’t confirm)

In the sources reviewed here, Quad9 publishes detailed policy documents, but there is no clearly identified independent third-party audit report verifying “no logs” in the way many VPNs publish audits. If Quad9 has one, it’s not surfaced in the official sources above. The practical result: you’re relying on policy + architecture claims + transparency reporting, not an external attestation.

Known controversies / incidents

Quad9 has been involved in a notable legal conflict in Germany related to DNS blocking demands from Sony Music Germany. Quad9 publicly described a Hamburg Regional Court ruling in November 2021 related to an injunction seeking to force Quad9 to stop resolving certain domains. Quad9 also published updates and described later appeal developments in Germany.

From a privacy/security buyer’s perspective, the main takeaway isn’t “Quad9 is unsafe.” It’s that public DNS resolvers can become legal choke points, and courts may attempt to impose blocking obligations even on infrastructure providers. That’s a real risk category for any resolver operating globally.

Strengths and Limitations

Strengths

• Strong privacy stance by design: no accounts; policy states no client IP storage.
• Threat blocking on the default secure resolver for malware/phishing-style domains.
• Modern encrypted DNS support: DoT, DoH, DNSCrypt, plus DoH3 and DoQ enabled across the network.
• Clear opt-in privacy trade-off option (ECS) when you need better CDN localization.
• Documented behavior for blocks (NXDOMAIN signaling and troubleshooting guidance).

Limitations

• Not a VPN: it won’t hide your IP, bypass IP-based blocks, or encrypt all traffic.
• Threat blocking can cause false positives (any blocklist-based security DNS can), and the “NXDOMAIN” approach can be confusing during troubleshooting.
• ECS improves some routing but leaks partial client network info to authoritative servers/CDNs by design (opt-in, but still a privacy cost).
• No confirmed independent no-logs audit in the sources reviewed, so verification is policy-based.

Who Should Use Quad9?

Quad9 is a strong fit for:

1. Home users who want “set-and-forget” DNS security: you get basic protection against known malicious domains without installing endpoint security, and you can enable encrypted DNS in modern OS/browser/router stacks.
2. Privacy-minded users who want encrypted DNS without a subscription: DoT/DoH/DNSCrypt support is there, and Quad9’s policy states it does not store client IP addresses.
3. Admins who want an opt-in knob for CDN geolocation issues: the ECS-enabled endpoints exist specifically to address real-world “wrong region” problems, with clear documentation about the privacy trade-off.

Quad9 is not a great fit for:

1. People who need VPN outcomes (streaming catalog changes, IP masking, ISP throttling mitigation, geo-unblocking): DNS isn’t a VPN.
2. Users who want ad/tracker blocking at the DNS layer: Quad9 positions its blocking as security-focused (malware/phishing/etc.), not general-purpose content filtering.
3. Organizations that require audited compliance artifacts for “no logging” claims: Quad9 provides detailed policies and transparency reporting, but an independent audit isn’t clearly confirmed in the sources above.