Quad9

Quad9 operates a public recursive DNS resolver with a specific differentiating feature: real-time blocking of domains associated with malware, phishing, and botnet command-and-control infrastructure. The service, named for its IP address 9.9.9.9, launched in 2016 as a nonprofit foundation headquartered in Switzerland — a deliberate choice of jurisdiction that aligns with Switzerland's strong privacy laws and provides organisational independence from commercial interests. Quad9 does not log IP addresses associated with DNS queries, positioning it as a privacy-respecting alternative to commercial DNS resolvers whose data practices are less transparent.

The threat intelligence that powers Quad9's blocking capability comes from a consortium of threat feed providers who contribute malicious domain data to the foundation. The resolver checks each queried domain against this aggregated threat database in real time and returns NXDOMAIN (no such domain) for matches rather than the actual IP address, preventing the client from reaching the malicious destination. This blocking happens at the resolver layer without any software installation on the querying device, making it effective for any device that points its DNS configuration at 9.9.9.9. The anycast routing network distributes Quad9 resolvers across more than 200 locations in over 90 countries.

Quad9 infrastructure incidents affect any network or device configured to use Quad9 as its primary or secondary DNS resolver. A resolver degradation event causes DNS queries to time out, which presents to end users as websites being unreachable — browsers show "This site can't be reached" with a DNS error regardless of whether the destination site itself is healthy. Applications that use system DNS rather than a hardcoded resolver are affected by configuration-level dependencies on Quad9. Partial degradation — where some anycast nodes are unhealthy but others are not — produces inconsistent resolution from different geographic locations and can be difficult to diagnose because the resolver appears to work from some locations while failing from others.

Outage.gg tracks Quad9 resolver status through community reports from network administrators and users. If DNS resolution is timing out, specific sites are being incorrectly blocked, or the resolver is unreachable, the live status page shows current incident data.