MacSouverain

FREN
radar

Quad9 may pull out of France, get your DNS plan B ready

beIN wants up to 580,000 euros a day from Quad9, which is weighing an exit from France. Nothing is settled, but your DNS deserves a second resolver.

On November 2, Mullvad switches off its public DNS resolvers, and we advised you to move to Quad9. In late October, the court decides whether to impose on Quad9 the penalty beIN Sports is asking for, and Quad9 is weighing cutting France off if so. Nothing is decided. But if Mullvad and Quad9 both drop out the same week, your fallback needs a plan B.


What is happening


On May 13, 2026, at the request of beIN Sports, the Paris Judicial Court ordered Google, DNS4EU and Quad9 to block, for French users, sites illegally streaming WTA tennis matches. Six domains at first, 52 added since, 58 in total.

Google and DNS4EU comply. Quad9 has blocked none of them. A deliberate refusal, and a change of course, since in 2024 it had applied the blocks obtained by Canal+ for the entire planet while it appealed.

beIN first asked for a penalty of 2,000 euros per day and per domain. Turned down in May, the judges finding nothing yet showed that Quad9 intended to resist. beIN came back for more with 10,000 euros per domain and per day, up to 580,000 euros a day across the full list. The hearing took place in early October, and the ruling is expected at the end of the month.


Why Quad9 says no


The Swiss foundation says it cannot reliably define a “French user”. It collects no data about its users and would have to rely on IP geolocation databases it considers inaccurate.

If the penalty is imposed, Quad9 lists three options, not yet submitted to its Foundation Council. Block for France alone, at the risk of new penalties with every geolocation error. Block for the entire planet, which would amount to applying a French ruling to the whole internet. Or stop serving the users it places in France.

The third option has a precedent. In June 2024, Cisco cut OpenDNS off for France rather than comply with an injunction obtained by Canal+. The service has remained unavailable there since, according to the press.


The real issue goes beyond tennis. The French law of August 3, 2026 on professional sport, passed in July, does not mention DNS but targets anyone designated by the judge, resolvers included, and organizes blocking during the live broadcast, with domains added mid-match. Quad9 considers this delegated power dangerous.

A DNS resolver is the phone book your Mac checks before every page. Making it answer “number unknown” on a broadcaster’s report, often reviewed by the French regulator Arcom only after the fact, is letting the rights holder tear out the pages that bother it.


What it changes for you


Two options out of three keep Quad9 working for you. Its blocking 58 pirate streaming sites changes nothing about your browsing, unless you were watching the WTA on a shady site, but that is another conversation.

Only the exit from France really affects you. If Quad9 stops answering addresses it places in France, the profile installed on your Mac or iPhone points to a server that no longer answers you. With an encrypted profile, Apple provides no automatic fallback to plain-text DNS, so your pages stop loading until you change the setting. And you find out with no warning.

And the calendar has a sense of humor. Ruling around late October for Quad9, Mullvad DNS shutting down on November 2. The fallback we recommended goes to court the same week the other one goes dark.


Your plan B, on Mac and iPhone


No need to leave Quad9 today, nothing is settled and the service is still good. The idea is to have the spare tire in the trunk before the flat.


Pick a second encrypted resolver. Two European candidates, active as of October 13.

DNS4EU, launched with European Union money and now owned by Czech company Whalebone. Pick the unfiltered variant. Official profiles for iPhone and iPad, IP addresses anonymized before logging according to its policy. Its limit, it applies court-ordered blocks on all its variants, and it complied with the May order. That is also why it will stay reachable in France.

Digitale Gesellschaft, a Swiss association, no queries stored, no filtering, over DoH and DoT. Its limit, no official profile for Apple, it fits better in a tool like dnscrypt-proxy.


On iPhone. Install the unfiltered DNS4EU profile, the only one of the two candidates to offer one, then set Quad9 back as the active configuration, type “DNS” in the Settings search to get there. iOS keeps both and lets you choose. The day Quad9 drops out, you switch in three taps. If you have a VPN running, its DNS is the one answering, not the profile, check with the test below.

On Mac. No shortcut here. Neither candidate provides an encrypted profile for macOS, you have to go through a tool. It is also the real fix, no longer depending on a single provider. dnscrypt-proxy, level 2 of our DNS article, queries several resolvers and drops the one that stops answering.

Put Quad9, DNS4EU and Digitale Gesellschaft in its list, and an outage becomes a non-event. Thirty minutes of setup, once.

Check who actually answers. An installed profile proves nothing, you need to see which resolver handles your queries. The simplest, open on.quad9.net, it tells you in one line whether you go through Quad9. To find out who answers instead, dnscheck.tools shows the operator’s name.

On iPhone, run the test again on Wi-Fi then on mobile data, the profile has to hold on both networks. If your ISP is what shows up, your profile is doing nothing and your queries go to it.


As a counterpoint. Cloudflare and Google will get you going in two minutes. They are American clouds subject to the CLOUD Act, and Google already applies the order. An emergency spare, not a destination.


Quad9 may win, block or leave. None of these outcomes should catch you off guard. Your DNS should depend on no single provider, whoever it is, even the best one.


Read next, The DNS, your digital Achilles heel


Sources