Quad9

It is thanks to the Domain Name System (DNS) that we don’t have to know IP addresses by heart in order to browse the web. Instead, we simply enter the website address into a browser. In other words, the DNS is re­spons­ible for what’s known as “name res­ol­u­tion” – using a name server, it converts the URL into the correct IP address.

Most people use the DNS service of their network provider. However, it is possible to access a different DNS server. In recent years, more and more providers have been pub­lish­ing public servers that are free to use for anybody. The best-known has to be Google’s DNS resolver, but if you’re worried about the security of your data in the hands of the internet giant, you can use a smaller service like Quad9. Rather than a com­mer­cial company, Quad9 is a non-profit or­gan­isa­tion.

The or­gan­isa­tion behind the Quad9 service also goes by the same name and is a con­sor­ti­um that includes IBM, Packet Clearing House (PCH) and the Global Cyber Alliance (GCA). Both, PCH and GCA are advocates for online security and privacy. They share the same aim, namely, to provide a DNS resolver that is both in­de­pend­ent from com­mer­cial interests and available to users free of charge.

As well as being free to access, Quad9 is spe­cific­ally focused on security and privacy. The team behind the DNS resolver promises that no user data is collected. Indeed, Quad9’s pi­on­eer­ing role is largely down to its emphasis on security. The service supports both DNS over TLS (DoT) and DNS over HTTPS (DoH). In recent years, it has become in­creas­ingly clear that tra­di­tion­al DNS has big security gaps due to a lack of en­cryp­tion. This makes it more vul­ner­able to DNS hijacking. The new tech­no­lo­gies ef­fect­ively protect users from cyber criminals and also from gov­ern­ment cen­sor­ship.

Fur­ther­more, Quad9 uses DNSSEC, which ensures that the delivered results are accurate. It also uses black­lists supplied by various security providers to filter out websites that have been clas­si­fied as harmful. To avoid becoming cen­sor­ship bodies them­selves – after all, in theory, anyone could simply blacklist a website they didn’t like – the different or­gan­isa­tions in the con­sor­ti­um check each other’s lists. This prevents any single party from pursuing its own in­di­vidu­al interests. Cen­sor­ship requests from local pro­sec­utors are only applied after a defin­it­ive decision has been made in court, and even then, the cen­sor­ship is only local.

The name itself is a giveaway – the IP address is 9.9.9.9. Perhaps it’s also a nod to Google’s service, which you can reach via 8.8.8.8. However, the Quad9 DNS service can also be accessed via other IP addresses (both IPv4 and IPv6):

As you can see, Quad9 provides both secure and non-secure access. Of course, the provider re­com­mends using secure con­nec­tions, which apply DNSSEC and blacklist filters. However, if you’re looking for an entirely un­filtered browsing ex­per­i­ence (along with the danger of exposing yourself to risks), you can access the non-secure IP addresses. Quad9 provides two IP addresses, both of which can be entered in your operating system settings. In the event that one of the com­mu­nic­a­tion channels is tem­por­ar­ily un­avail­able, the system can, therefore, switch directly to the other address.

Quad9 also provides an EDNS Client Subnet. This is primarily designed for Content Delivery Networks (CDNs). This type of network is used to make media files available on websites without over­load­ing the central server. The EDNS performs load balancing and can answer CDN requests more rapidly. IoT providers are also involved in order to ensure secure DNS access for smart objects.

If you want to use one of the two encrypted con­nec­tions, you have to use specific ports. For DoT, you need to use Port 853 and for DoH you need to use the standard HTTP port 443.

Quad9 doesn’t use just one DNS server. If you choose to use the service, your request will be forwarded by Anycast to one of more than 100 servers located all around the globe. With Anycast, multiple servers have the same address, but the system always selects the shortest path.

What ad­vant­ages does switching to Quad9 DNS provide?

• Available free of charge
• User data is not recorded
• Secure con­nec­tions
• No gov­ern­ment cen­sor­ship
• DNS over TLS and DNS over HTTPS
• DNSSEC
• Blacklist filters
• Over 100 servers
• Run by a non-profit or­gan­isa­tion