The internet was built to route around damage. Censorship and local obstruction look like network faults to it, and packets simply take another path. Courts, meanwhile, keep trying to draw national borders around protocols that were designed to ignore them.
That conflict came to a head on October 21, 2026. A Paris court ruled against Quad9, the Swiss nonprofit DNS provider, in a copyright case brought by beIN Sports. The ruling carries a financial penalty and an operational order that conflicts with Quad9’s architecture and privacy principles. Quad9 has announced that on November 24, 2026 it will withdraw its free public recursive DNS and security services from France.
A security-focused infrastructure provider is leaving a G7 country, and the cause is a dispute over pirated sports streams. The case raises hard questions about intermediary liability, about whether geographic filtering can work at all, and about an internet where a domain name resolves differently depending on who asks.
What a recursive DNS resolver actually does
When you type a URL into a browser, the browser has no idea where the server lives. It asks a recursive resolver, which works through the hierarchy. The resolver asks the root zone, gets a referral to the right Top-Level Domain (TLD) servers, asks those for the domain’s authoritative nameservers, and finally asks the authoritative servers for the A (IPv4) or AAAA (IPv6) record.
The resolver is a messenger with a cache. It does not host the content, route the packets that follow, or take part in the TLS handshake that delivers the page. Ordering it to block a domain is like ordering a phone directory operator to stop reading out a number, in the hope that the call never happens.
The analogy only goes so far. A DNS answer gives a destination’s coordinates and nothing more. A determined client has other ways to reach the same server: proxy networks, hardcoded IP addresses, a different resolver. Treating the resolver as a chokepoint for copyright enforcement gives a stateless lookup service the job of a stateful border guard, and that misreads what the service does.
Why blocking DNS by country doesn’t work
The court expects Quad9 to answer normally for users outside France and to return NXDOMAIN (non-existent domain), SERVFAIL or a sinkhole IP address for queries coming from inside France. That requires knowing where each client is.
Quad9 has no user accounts. Requiring authentication would mean abandoning its no-logging, privacy-first model and identifying millions of anonymous users. That leaves the source IP address of each packet, and IP geolocation is a guess. Commercial databases infer locations from BGP routing data, ISP registrations and latency measurements, and they lag behind how addresses are actually used. An IP address is a routing label with no location built in.
A query reaching a Quad9 anycast node could come from:
- A multinational’s central egress gateway in Frankfurt
- A mobile carrier’s Carrier-Grade NAT (CGNAT) pool shared by tens of thousands of devices in several countries
- A satellite provider whose topology doesn’t map to any single place
Enforcing a national injunction on that basis will over-block, cutting off legitimate foreign users behind a shared gateway, and under-block, letting French users slip through foreign proxies. For a small nonprofit engineering team, a flawless real-time geofence is out of reach.
📬 Stay Ahead of Cyber Threats
Get the latest cybersecurity news, critical vulnerabilities, threat intelligence, tutorials, and exclusive giveaways delivered straight to your inbox. No spam. Unsubscribe anytime.
Subscribe to the Newsletter →Encrypted DNS, VPNs and anycast make it worse
DNS used to travel in plaintext over UDP port 53, which let ISPs and network admins read and rewrite it. Browsers and operating systems have since moved to DNS over HTTPS (DoH), DNS over TLS (DoT) and DNS over QUIC to stop that kind of snooping and tampering.
When a French user sets their browser to use Quad9 over DoH, the query rides inside a normal HTTPS session. Quad9’s edge server sees the connection’s source IP, but that is often not the user’s own address. Behind a corporate VPN or a commercial privacy network, the source IP belongs to the exit node, which could be in any country. The court is effectively asking Quad9 to guess a person’s location from a tunnel built to hide it.
Anycast adds another layer. BGP and network proximity decide which Quad9 server answers a query, not the user’s nationality. Someone in Strasbourg may be served from Zurich or Frankfurt depending on congestion and peering. Enforcing a local court order across a network like that would require tracking users, which cuts directly against how stateless, high-performance DNS is designed.
The caching problem: split-horizon DNS at scale
Resolvers stay fast because they cache. They don’t ask the authoritative server on every request. They keep answers for the Time to Live (TTL) the zone specifies and serve repeat queries from memory. Without that, the load on global DNS would be unmanageable.
Blocking a domain for some users and not others means running parallel caches. A French user who queries a blocked domain gets a refusal or sinkhole address, and that altered answer has to be cached for French subnets only. A German user who asks for the same domain a moment later must get the real answer, fetched from the authoritative server and cached separately. So the resolver has to shard its cache by geography, which raises memory use and complexity.
Then a domain’s real IP changes. Invalidation has to reach every shard without leaking a blocked answer to an unrestricted user or the reverse. With encrypted DNS and shared CGNAT gateways, one source IP can stand in for thousands of people in different jurisdictions. Keeping the caches cleanly separated in that situation would need packet-level deep packet inspection (DPI), which defeats the purpose of an encrypted, privacy-focused service.
Malware blocking is global; copyright blocking is local
Quad9 already filters, so it matters what kind of filtering the court is asking for. Its main value is real-time threat intelligence, including feeds from IBM X-Force, used to block malware distribution, phishing and botnet command-and-control domains. That list works because the threat is the same everywhere. A ransomware payload is a problem in Tokyo, New York and Paris alike, so one global blocklist makes sense.
Copyright is a civil matter tied to territorial licensing and national law. A site streaming an unauthorized Women’s Tennis Association match may violate beIN Sports’ exclusive rights in France and be handled differently, or lawfully, somewhere with other licensing rules or fair use doctrines. Ordering a security resolver to enforce that means keeping jurisdiction-specific blocklists, which is fragile.
DNSSEC makes it harder. It uses a cryptographic chain of trust so a client can confirm the answer is what the zone owner signed. If a resolver swaps a signed answer for a sinkhole IP or an NXDOMAIN to obey a court, validation breaks and validating clients return SERVFAIL. Getting around that takes workarounds, such as intercepting queries before validation or using special policy mechanisms. Each one adds code complexity and attack surface, and the attackers who benefit are the ones who find flaws in the exceptions built for legal compliance.
The Digital Services Act and the “mere conduit” question
The legal fight turns partly on the EU’s Digital Services Act (DSA), Regulation (EU) 2022/2065. Recitals 28 and 29 name DNS services, domain registries and registrars as part of the internet’s technical plumbing. The intent was that providers who only supply naming and routing should generally get the “mere conduit” exemption and not answer for what end users do or what destination servers host.
Quad9’s defense rests on that reading. Resolving a name is automated, passive and neutral, and has nothing to do with the editorial or commercial choices of the site’s operator. The Paris court seems to disagree. Its reasoning appears to be that because a resolver makes access easy and could cut it off, it has to do so.
That reasoning has no natural stopping point. If holding a naming-layer “kill switch” creates liability for third-party infringement, every operator of a recursive resolver becomes a target: telecom giants, university IT departments, open-source hobbyists. The DSA was meant to harmonize the single market. Local orders backed by heavy daily fines push toward a patchwork of conflicting national injunctions that no global network can follow.
Störerhaftung and the German Sony Music case
The doctrine behind these orders is Störerhaftung, or interferer liability. German and wider European courts have used it to hold third parties responsible when they could have prevented a rights violation, even though they did not commit it.
Quad9 has been through this before. In the Sony Music litigation in Germany, the Hamburg Regional Court and then the Regional Court of Leipzig, in March 2023, treated Quad9 as implicated in a piracy portal’s infringement because its resolvers turned the site’s domain into a routable IP. Leipzig ordered global blocking of the domain. The courts held that Quad9 had a duty to examine its traffic and filter once notified.
Quad9 won on appeal, but only after spending heavily on lawyers and engineers. In December 2023 the Higher Regional Court in Dresden ruled that applying Störerhaftung to a passive, automated, foundational layer of the internet was disproportionate. It said a general monitoring obligation on DNS resolvers would conflict with the e-Commerce Directive and the DSA, and that remedies belonged against the actual hosts and operators of the infringing content.
The French courts now seem willing to test that precedent again, using compounding daily fines to force quick technical compliance without the full debate about intermediary liability.
Why Quad9 decided to leave
The German case showed what compliance costs even when you win. Legal fees pile up, interim injunctions loom, and building geofencing rules and then removing them is real engineering work. Rights holders also tested the blocks with VPNs and proxy networks, which produced endless arguments over whether the implementation was “sufficiently robust”.
Against that history, Quad9 faces about twenty similar pending cases in France. The Paris court set a penalty of €1,000 per day. beIN Sports had asked for €580,000 per day, and the judge reduced it. The lower figure is still only part of the picture, since legal fees and degraded operations come on top. A nonprofit funded by donations cannot sustain a war of attrition like that, and Quad9’s leadership concluded that withdrawing was the rational response.
Who loses when Quad9 leaves France
Most commentary frames this as internet freedom against copyright. The more immediate loss is in cybersecurity. Quad9 is a security layer built into the networks of major public and private institutions, not just a tool for privacy enthusiasts avoiding ISP tracking.
Quad9’s telemetry shows substantial query volume from French organizations in public administration, healthcare, energy and advanced research. They include networks tied to the Direction interministérielle du numérique (DINUM), the Commissariat à l’énergie atomique (CEA), Institut Pasteur and several hospital trusts. These organizations rely on Quad9’s threat feeds to quietly block millions of queries to malware droppers, ransomware command servers and credential-phishing domains before any connection is made.
After November 24 they will have to migrate quickly. Moving to an ISP resolver or a commercial alternative means reconfiguring DHCP scopes, internal DNS forwarders, firewall egress rules and endpoint management policies. Security teams also have to check whether the replacement matches Quad9’s threat intelligence, DNSSEC validation and privacy guarantees. A rushed move under a legal deadline risks gaps in protection during the transition, or a switch to a worse resolver that logs sensitive internal queries. A ruling aimed at a few sports piracy domains ends up forcing an unfunded national cybersecurity re-architecture on organizations with no connection to the dispute.
DNS blocking and the splinternet
The case also pushes toward fragmentation of the internet, often called the splinternet. DNS was designed as one global directory, where a name resolves to the same infrastructure whether the query comes from Berlin, Tokyo or Buenos Aires. That consistency underpins global commerce and communication.
If every country can force infrastructure providers to keep local blocklists based on domestic law, the internet turns into a set of intranets with borders. Large commercial ISPs have the legal teams, lobbying power and local engineers to handle that. Nonprofits, open-source projects and privacy advocates do not. Each time a provider like Quad9 is pushed out of a market, control of the naming layer moves toward a few large, heavily regulated companies. The independent resolvers that provide competition, innovation and privacy protection are the ones that disappear.
Why DNS blocking is a weak tool against piracy
DNS blocking is also a poor way to enforce copyright on technical grounds alone. Piracy operators know DNS providers are under legal pressure and build around it. They rotate domain names quickly, use peer-to-peer streaming, hardcode IP addresses into apps, and hide the true origin of streams behind reverse proxies and content delivery networks.
For most people, a block is a minor inconvenience. Anyone determined can switch to a non-compliant public resolver, use a foreign VPN, or load an updated list of IP addresses. The infringing content stays on its origin servers, untouched. Courts, rights holders and infrastructure providers spend a lot to enforce these blocks and get little reduction in piracy for it.
Action against hosting providers, payment processors and upstream transit networks hits the operation where it is physically and financially sustained. Going after DNS is like trying to stop a forest fire by confiscating the maps that show where the forest is, while the arsonists and the fuel supply go untouched.
What French network admins should do before November 24
If you run networks in France, treat the deadline as a project with a date. DNS resolution is often treated as an interchangeable utility, and that assumption is risky when your resolver is also a security control.
- Audit every dependency on Quad9’s 9.9.9.9 and 149.112.112.112 addresses across routers, firewalls, servers and endpoints.
- Look for hidden ones: IoT devices with hardcoded DNS settings, mobile device management profiles, and applications that use encrypted DNS separately from the operating system’s configuration.
- Evaluate replacements on their threat intelligence methods, DNSSEC validation, data retention and logging policies, and support for DoH and DoT.
- Test failover, confirm the new resolver works with your SIEM, and check that its filtering doesn’t block legitimate business domains.
The goal is to keep the same defensive posture you have today, with more than basic connectivity restored.
What the Quad9 case tells us about regulating DNS
Internet protocols are borderless and deterministic. Courts are territorial and subjective. DNS was built as a neutral, universal translation layer with no moral, legal or commercial judgment of its own, and conscripting it into local copyright enforcement runs against that design and puts costs on the people who keep it running.
Protecting intellectual property is a legitimate job for a legal system. The methods should be technically workable, proportionate and aimed at the real sources of infringement, not at the passive intermediaries that point the way. When November 24 passes, French users will lose a privacy-respecting security layer, and other countries’ courts will have a template for the same demand. If they follow it, the universal phonebook gets torn up one jurisdiction at a time.
