Quad9

Quad9 answers on 9.9.9.9 and is free for anyone to use. It validates DNSSEC on every address, speaks DNS over HTTPS and DNS over TLS, and also offers DNSCrypt, which most public resolvers have dropped. The default profile blocks domains associated with malware, phishing and command-and-control using feeds from more than twenty-five threat-intelligence providers, which the foundation says amounts to over 670 million blocks on an average day across more than 230 resolver clusters in over 110 countries.

What it deliberately does not do is as important as what it does. Quad9 offers no family or content filtering of any kind — its stated remit is security alone — so the use case Cloudflare serves with 1.1.1.3 has no counterpart here. Readers who want nothing filtered at all can use 9.9.9.10, and 9.9.9.11 adds EDNS Client Subnet for better CDN routing, which the default addresses leave switched off for privacy.

The reason to pick it over the incumbent is jurisdictional rather than technical. Quad9 does not store client IP addresses, treats them as personal data under the stricter of Swiss and EU law, and has obtained Swiss rulings that it is neither a telecommunications service nor subject to the surveillance act, so no retention obligation attaches to it. Requests from foreign authorities have to go through mutual legal assistance to the Swiss Federal Office of Justice. The honest trade-off is network size: Cloudflare has more points of presence and will usually be a little faster.

Quad9 is a Swiss charitable foundation in Zürich, registered as Quad9 c/o SWITCH with UID CHE-435.091.407 and supervised by the Federal Department of Home Affairs. Its registered purpose is explicitly non-commercial: free services that improve the privacy, security and stability of internet use. A Swiss Stiftung has no shareholders and no members, so there is nobody above the foundation to acquire it — the ownership question terminates at the entity itself.

The service began in 2017 as a joint effort of the Global Cyber Alliance, IBM Security and Packet Clearing House, which still supplies much of the network footprint; IBM donated the 9.9.9.9 address. The foundation was constituted in Switzerland in 2021 and is funded by donations and sponsorship rather than by selling data or advertising. It lists roughly fifteen named staff and an extended team, plus a five-person foundation council and a statutory auditor on the register.

Switzerland is load-bearing rather than decorative here. Quad9 publishes two Swiss findings of law it has obtained: the Post and Telecommunications Surveillance Service holds that the surveillance act does not apply to it, and OFCOM holds that it is not a telecommunications service under the Telecommunications Act. Between them those remove any retention or customer-identification obligation, and foreign legal demands have to travel through a mutual legal assistance treaty to the Swiss Federal Office of Justice.