Quad9 will pull its free DNS out of France rather than block beIN Sports' pirate tennis streams, after a Paris court pointed at the malware it already blocks worldwide

Chris in a Belle Epoque poster style holds up a blank sheet of newspaper in front of a packed tennis stadium while a tennis ball arcs over the top of the paper. — Illustration: LockerGnome

Quad9 is leaving France over tennis.

“Starting November 24, Quad9 will no longer be able to offer its free cyberprotection service to users located in France,” the Swiss nonprofit wrote on October 22. The day before, the Tribunal judiciaire de Paris ruled for beIN Sports France, which Quad9 describes as “a Qatari company with offices in France.”

The fight started in May. A May 13 judgment ordered Quad9 to stop resolving domains of pirate IPTV sites for as long as the WTA tennis season runs, through its last match on November 14. beIN came back saying Quad9 hadn’t blocked them. Quad9 didn’t argue. Its CTO attested on September 25 that the domains had seen no blocking by Quad9, on that date or any earlier one.

beIN asked for €10,000 a day for each domain. The court set €1,000 a day, from the ruling until the order ends. “The good news is the court significantly reduced the financial penalty, from €580,000 to €1,000 per day,” Quad9 wrote. “However, for Quad9, this has never been just a financial issue: it is a matter of principle.”

The principle is that Quad9 has no idea who you are. “We have no database of users associating them with jurisdictions,” the post says. There’s no sign-up and no ID, and “we have no list of French users, because we do not keep dossiers of our users at all.”

The court found a way around that, and it used Quad9’s own product. The judgment says Quad9 never showed that blocking by location was impossible, and that it “paraît se contredire” (appears to contradict itself), since it already filters malicious domains worldwide. That’s the pitch on 9.9.9.9: a resolver that refuses to answer for malware and phishing sites.

Quad9 agrees it could do that. Adding beIN’s names to its blocklist, applied to “our protective services (9.9.9.9 & secondaries) globally but not to our nonprotective services (9.9.9.10 & secondaries),” would satisfy the court. It would also have what Quad9 calls the “extraterritorial” effect of applying a French ruling to every user on Earth.

Location-based blocking has already burned it once. In a German case brought by Sony Music, Quad9 tried geoIP blocking as a “hack.” “The plaintiff (Sony Music Entertainment GmbH) then used a VPN to access the blocked content from Germany in circumvention of the geoIP blocking,” the post says, and Quad9 was fined for contempt. It eventually won that case, but it took “several years, six figures of cost to Quad9.”

So it’s taking the third door. “Quad9 will not block the domains in question,” the post says, and French users get 30 days to switch. “An appeal is pending.” By Quad9’s own math, the penalty tops out at 24,000 euros if it ignores the order until November 14. It’s leaving ten days after the order it won’t follow runs out.

Why it matters

Quad9 says the money was never the threat. The tennis order caps out around 24,000 euros. The post counts “approximately 20 different lawsuits pending against Quad9 (and other recursive resolver operators) that demand we comply with blocking hundreds of different names.” One fine is a bill. Twenty of them, each pinned to a different list, is a business model Quad9 can’t run.

A protective feature became the evidence. Quad9 sells itself on blocking bad domains for everyone. The court read that as proof it could block beIN’s domains too. Any service that filters anything now has to explain why it can’t filter one more thing.

Blocking a name doesn’t take anything down. The post points at “thousands of other open DNS systems” anyone can switch to in a minute. Its analogy: “This is like holding a piece of newspaper in front of a stadium full of people to block the view of a concert.” The streams stay up. The French users lose a resolver that blocked malware for them, and the post’s list of French networks it sees traffic from includes EDF, SNCF and the government’s own digital agency, DINUM.

The pressure is moving down the stack. Rights holders started with the pirate sites, then the internet providers, and now the free resolvers that sit between a name and an address. A resolver that keeps no user records and runs in one jurisdiction can’t do geography, so the order leaves it with three choices: block for everyone, pay, or leave the country.

Expect more of the third. Quad9 is a nonprofit with a principle and a 20-case backlog in France. Smaller resolvers with no lawyers will quietly drop French traffic, and the ones that stay will be the ones that already know where their users are.

Steal this

If anyone on your network in France uses 9.9.9.9, its secondary addresses or Quad9’s encrypted DNS, change the router and every hard-coded device before November 24, then run a DNS leak test to confirm. Kind of like forwarding your mail before the post office closes, not after the letters start bouncing.
When you pick a replacement, check where the operator is based and what it logs, because the next court order will go to whoever is easiest to reach. Picking a resolver is like picking a bank: the rate matters less than who can freeze the account.
If you run a service that blocks anything for safety, write down why you can’t selectively block by country before a lawyer asks. Quad9’s malware list was read back to it in court. This is like keeping receipts for the expense you know an auditor will question.

The appeal is still pending, and the order it’s about expires before Quad9 even goes.

More Infrastructure