Au Revoir, France: The Free DNS Shield Protecting French Banks and Ministries Just Chose Exile Over a €1,000-a-Day Fine
Au Revoir, France: The Free DNS Shield Protecting French Banks and Ministries Just Chose Exile Over a €1,000-a-Day Fine
Published: 2026-10-23 | Reading Time: ~11 minutes | Channel: techminute
Somewhere in France right now, a mid-size bank's IT team is realizing — possibly before the bank's own security department has — that one of its quiet layers of protection against phishing and malware goes dark on November 24.
That layer is Quad9: a Zurich-based Swiss nonprofit foundation that has spent nearly nine years operating one of the world's most trusted free DNS resolvers, the 9.9.9.9 service that hundreds of millions of devices and thousands of enterprise networks use as their first line of cyber-defense. This week, Quad9 announced it will make its cybersecurity protection and general services unavailable to users in France, effective Tuesday, November 24, 2026.
The reason is not a hack, an outage, or a funding crisis. It is a ruling from the Third Chamber of the Paris Judicial Court (case No. RG 26/11882) in a lawsuit brought by beIN — the Qatari sports broadcaster — demanding that Quad9 block 58 domain names linked to unlicensed tennis streams. Quad9 refused to block a single one, on principle and on protocol grounds. The court answered with a penalty of €1,000 per day, a massive haircut from the €580,000-per-day beIN had asked for, but enough — combined with roughly 20 other pending French lawsuits — to make continued operation in France an existential risk.
So Quad9 picked the only exit that keeps its mission intact: leaving.
The story made it to the top of Hacker News (1,281 points, 430 comments) within a day, and if you only read the headline, it sounds like a familiar "big rightsholder vs. piracy" skirmish. It is much stranger and much more important than that. This is a case where the court's own logic turned out to be: blocking nothing gets you fined; blocking a little gets you praised. Where a Qatari broadcaster's enforcement action will strip malware protection from French banks, government networks, universities, and mobile users — and won't measurably slow down a single tennis-stream pirate. And where a small nonprofit chose the nuclear option rather than tell its users a lie in a DNS response.
Let's dig in.
The Context: How France Started Jailing DNS
To understand why a DNS resolver would rather leave a country of 68 million people than comply, you need the decade-long arc of French site blocking.
For years, French courts ordered ISPs to block piracy domains at the DNS level. That worked about as well as a "no diving" sign at a public pool: users simply changed their device or router settings to a public resolver — Google's 8.8.8.8, Cloudflare's 1.1.1.1, Cisco's OpenDNS, Quad9 — and the ISP block became a speed bump.
The rightsholders' response was the escalation that defines this whole saga: go after the resolvers themselves. In June 2024, a Paris court ordered Google, Cloudflare, and Cisco to tamper with their own DNS resolvers to block roughly 117 pirate sports-streaming domains — the Canal+ case, built on Article L333-10 of the French Sports Code. As CircleID reported at the time, Google indicated it would comply. Google's own attorney, Sébastien Proust, told the court the practical impact would be negligible — only about 0.084% of French internet users even use alternative DNS resolvers, and vanishingly few would give up on pirate streams because of a DNS block. The court upheld the injunction anyway.
Two things followed from that precedent:
- The players who complied stayed. Google, Cloudflare, and Cisco (OpenDNS aside — more on that in a second) implemented some form of blocking for French users.
- The exit door opened quietly. In 2024, OpenDNS suspended its service in France in response to a Canal+ blocking order, per TorrentFreak. Almost nobody noticed. OpenDNS was, in effect, the first public DNS resolver to walk out of France.
What changed this week is that the second one walked out loudly — with a manifesto — and the walkout is aimed at the heart of how the internet's phone book works.
Under the Hood: Why a DNS Resolver Can't "Just Block France"
Here's the technical bind, and it's genuinely elegant in its cruelty.
Recursive DNS is jurisdiction-blind by design. Quad9's service is free, requires no sign-up, collects no user dossiers, and therefore has no database associating users with countries. When a laptop in Lyon and a laptop in Lisbon both query 9.9.9.9, the resolver has no reliable way to know which is which. IP geolocation — the obvious "hack" — is imprecise, unauditable, and, as Quad9 learned the hard way, legally radioactive.
The extraterritorial trap. Quad9 could satisfy the court trivially by adding the 58 tennis-stream domains to its global malicious-domain blocklist, which applies to all users of its protective services (9.9.9.9 and its secondaries, not the unfiltered 9.9.9.10). But that would apply French law to every internet user on Earth — for the commercial benefit of one private foreign company. Quad9's answer: such a system would set a precedent that any nation could impose their laws, morals, economic demands, or social constructs upon any other nation by the means of blocking DNS names. One country's court order becomes the world's DNS policy. That's not compliance; that's extraterritorial censorship with a Swiss accent.
The Sony trap. And if you think geofencing is a reasonable middle path, Quad9 has already run that experiment — and lost, twice over. In the Sony Music Entertainment Germany case (2021–2023), Quad9 attempted exactly this: geoIP blocking for German users while the case was pending. Sony's investigators used a VPN to make a German lookup appear to come from elsewhere, demonstrating the block could be circumvented. The court agreed with Sony and fined Quad9 for contempt. Quad9 eventually won the case on appeal — years later, six figures in costs, and a permanent institutional lesson: geolocation-based compliance isn't technically sound, and when it fails, you don't get credit for trying — you get fined for failing.
That's why Quad9's statement reads the way it does: "There is no way we can determine which users this ruling applies to – we have no list of French users, because we do not keep dossiers of our users at all." Compliance is either global censorship, technically-impossible precision, or a known legal trap. They chose none of the above.
The Incentive Machine: Blocking Nothing Gets You Fined
Now to the part of this story that should make your jaw drop, because it reveals how the enforcement regime actually works.
In October 2026, beIN asked the same Paris court for daily penalties against Cloudflare and several VPN providers. The court refused — because those companies had blocked at least some of the demanded domains, which the court accepted as "reasonable effort." In September, Canal+ similarly lost its penalty request against Cloudflare.
Quad9, meanwhile, blocked zero domains — and confirmed as much to the court in a written statement. Result: fined, and exiting.
Read that again, because the incentive structure is inverted from everything internet engineering stands for:
| Actor | Behavior | Court outcome |
|---|---|---|
| Cloudflare / VPNs | Blocked some demanded domains | Penalty request refused (Oct 2026); Canal+ lost its Cloudflare penalty bid in September |
| Quad9 | Blocked nothing, on principle | Fined €1,000/day; withdrawing from France |
The system doesn't reward technical soundness or principled resistance — it rewards partial compliance. It is, in the most literal sense, a machine for laundering censorship through intermediaries one "reasonable effort" at a time. Quad9's broader fear is spelled out in its announcement: "Once the tools of censorship are built, they are rarely used sparingly or justly."
And there's a firepower asymmetry under all of this. beIN initially demanded €580,000 per day — €10,000 per day for each of the accessible domains. The court cut the penalty to €1,000 per day, which runs until the blocking measure ends on November 14 — about €24,000 total, plus legal costs. For a deep-pocketed broadcaster, that's a rounding error. For a nonprofit funded by donations and threat-intel partnerships, the fine was never the real weapon: it's the approximately 20 other blocking cases pending against Quad9 and other resolvers in France, any of which can metastasize into the same endgame. As Quad9 put it: "Quad9 cannot survive the accumulation of penalties yet to be assessed in 20 other pending cases, nor those of future cases similar to the one brought by beIN."
Inaction wasn't an option. So: exit.
By the Numbers
| Metric | Figure | Note |
|---|---|---|
| beIN's demanded penalty | €580,000/day | €10,000/day per accessible domain |
| Court-imposed penalty | €1,000/day | A ~99.8% reduction — but still a fine |
| Implied total (to Nov 14) | ~€24,000 | Excluding Quad9's legal costs |
| Domains in the blocking order | 58 | Pirate tennis-stream domains |
| Pending French cases | ~20 | Against Quad9 and other resolvers |
| HN engagement at publish | 1,281 points / 430 comments | #1 on the front page |
| Quad9's service tenure in France | ~9 years | Free, no sign-up, no user dossiers |
| Domains in the original 2024 Canal+ order | ~117 | vs. Google, Cloudflare, Cisco |
| French users on alternative DNS | ~0.084% | Google's counsel's estimate of the affected share |
That last row deserves a pause. The entire enforcement architecture — ISPs, then resolvers, then VPNs, now exit-for-noncompliance — targets a mechanism that Google's own lawyer testified affects roughly one-twelfth of one percent of French internet users. Which raises the question of what any of this is actually for.
What This Changes
1. France is building a resolver vacuum. With OpenDNS gone (2024) and Quad9 leaving (Nov 24), French users who value privacy-forward, malware-filtering resolvers have lost two of the most respected options. Where do they go? Toward less trustworthy resolvers — or toward whatever their OS defaults to. That's not a privacy win; it's a security downgrade. Quad9's own traffic statistics show French traffic from "infrastructure, national security, finance, education, and other networks of critical importance" — those users lose phishing and malware filtering that took years to build. The cruel irony: beIN's lawsuit will strip protection from French institutions to police tennis streams that remain one DNS-server-change away anyway.
2. "Reasonable effort" is now the only rational strategy — and it's corrosive. The Cloudflare outcome tells every intermediary in Europe the optimal play: block something, look cooperative, avoid penalties. Each incremental block normalizes the next. This is the boiling-frog model of intermediary censorship, and Quad9's exit is the frog's refusal — loud, expensive, and now on the record.
3. The extraterritoriality precedent cuts both ways. If French orders can silently rewire resolvers worldwide, then so can the next country's orders — including ones about political speech, religious content, or economic rivals. Quad9's refusal to apply French law globally is, quietly, one of the more principled stands on internet governance this year. Germany's courts ultimately agreed with the underlying argument in the Sony case — that resolvers are not perpetrators. France's Third Chamber has now gone the other way.
4. The appeal is coming. Quad9 says it will appeal, and it has a German precedent for winning on appeal. But appeals take years and six figures — resources a nonprofit doesn't have in beIN quantities. The asymmetry is the enforcement strategy: as Quad9 told TorrentFreak, "the opposition has more lawyers than we have money and time."
⚠️ Limitations & Caveats
Let's be honest about the other side of the ledger:
- Quad9 is a party, not a neutral narrator. Its farewell post is eloquent and self-serving in equal measure. beIN's position — that Quad9's refusal left a court order dead-lettered for months — has a certain force too. The court specifically noted Quad9 made "no action at all" where other defendants made "reasonable efforts." Reasonable people can dispute whether pure neutrality is a shield or a dodge.
- DNS blocking genuinely is weak enforcement. Even beIN gets little practical benefit: users who want those streams can switch resolvers in about 30 seconds. Quad9 itself compares the exercise to "holding a piece of newspaper in front of a stadium full of people to block the view of a concert." That cuts against both sides: the measure is ineffective, and the resistance is symbolically outsized.
- The mechanics of the Nov 24 exit are undecided. Quad9 told TorrentFreak it is "still evaluating its options" for how it will technically stop serving French users. All options are, in its words, imperfect. Expect imperfection.
- The geographic scope has quirks. Per heise, the ruling covers France plus its overseas territories, regions, and departments — including Saint-Pierre and Miquelon — but not French Polynesia, New Caledonia, or Wallis and Futuna. Real-world enforcement of that boundary will be... creative.
- Piracy is a real harm. Nothing here should be read as condoning it. Quad9 itself states clearly: "we do not condone content piracy." The dispute is about who gets conscripted to enforce it and how — not whether it should be fought.
🎯 The Bottom Line
A Qatari broadcaster's French tennis-stream crusade just cost French users one of the internet's best free security services — and the precedent it sets ("block a little and you're safe; block nothing and you're exiled") will outlive this case by years. The deepest irony is that France is about to learn the same lesson every DNS-blocking regime eventually learns: you can't censor the phone book without breaking it for the innocent callers first. On November 24, French users get a message they didn't choose and don't deserve: your protection is gone, your pirates are fine. Tell your representatives that looking up names is not a crime — Quad9's words, and hard to argue with.
📚 Sources
- Quad9 — "Farewell, France" — Official announcement: Nov 24 withdrawal date, penalty figures, Sony Germany precedent, ~20 pending cases, extraterritoriality argument. https://quad9.net/news/blog/au-revoir-france/
- TorrentFreak — "DNS Resolver Quad9 Will Leave France After Court Orders Piracy Blocking Penalty" — Paris court ruling RG 26/11882, €1,000/day penalty vs. beIN's €580K/day demand, OpenDNS 2024 precedent, Cloudflare/VPN penalty refusals. https://torrentfreak.com/dns-resolver-quad9-will-leave-france-after-court-orders-piracy-blocking-penalty/
- heise online — "Censorship ruling prompts DNS service Quad9 to leave France" — Court chamber and case numbers (RG 26/11882; prior 26/02207), geographic scope details, appeal plans. https://www.heise.de/en/news/Censorship-ruling-prompts-DNS-service-Quad9-to-leave-France-11497631.html
- CircleID — "French Court Orders Google, Cloudflare, Cisco to Poison DNS in Anti-Piracy Crackdown" (June 18, 2024) — The Canal+ origin case: ~117 domains, Article L333-10, Sébastien Proust's 0.084% estimate. https://circleid.com/posts/20240618-french-court-orders-google-cloudflare-cisco-to-poison-dns-in-anti-piracy-crackdown
- Hacker News — "Quad9 to exit France" — Community reaction: 1,281 points, 430 comments, #1 front page (community-sourced sentiment). https://news.ycombinator.com/item?id=50195959
- TorrentFreak — "DNS Resolver Quad9 Rejects French Piracy Blocks, Weighs Exit as beIN Seeks Up to €580K a Day" (Oct 5, 2026) — Background on the penalty escalation. https://torrentfreak.com/dns-resolver-quad9-rejects-french-piracy-blocks-weighs-exit-as-bein-seeks-up-to-e580k-a-day/
All claims verified against Gold-tier (Quad9's official announcement) and Silver-tier (TorrentFreak, heise online, CircleID) sources. Each source URL was scraped and confirmed accessible with full content. Last verified: 2026-10-23.