>We want a public service to be available. Going forward, we will support Quad9 instead of running it ourselves. Running a privacy-focused public DNS service is a highly specialized undertaking, and the Quad9 Foundation is the undisputed leader in the field. Rather than duplicating their efforts to achieve only part of what they do, we're putting those resources toward financially supporting Quad9 instead.

Brilliant.

▲

assumed_throwaw an hour ago | parent | next [-]

Unfortunately, Quad9 is censoring some domains in Europe (notably in France and Italy) following injunctions issued by rights holders [1]. That was not the case with Mullvad's DNS.

[1] https://quad9.net/news/blog/italian-blocking-demands-followi...

▲

loup-vaillant 21 minutes ago | parent [-]

> The German courts entirely disregarded our use of geo-IP lookups on queries, and asserted that since tests via a VPN were able to resolve the domain, we were in breach of court orders

Seriously, what the fuck? So you're supposed to block VPNs as well? What's next, Tor exit nodes? New VPN and Tor nodes as they pop up? I really don't like where this is going.

	▲	jwitthuhn 13 minutes ago \| parent \| next [-]
		The entire point is that it can't be reasonably enforced with any granularity. Rights-holders want it to be like that so a copyright win in a single country means something has to be taken down globally.
	▲	sparkling 10 minutes ago \| parent \| prev [-]
		>So you're supposed to block VPNs as well? What's next, Tor exit nodes? New VPN and Tor nodes as they pop up? Trivial to do nowadays: https://focsec.com/ >I really don't like where this is going. German courts think the internet revolves around German laws. There are some really insane cases, sometimes they will consider a website to fall under German jurisdiction simply for having a German-language version (somehow ignoring that Austria and Switzerland exist, ignoring German-speaking minorities in other countries, ignoring that a fully automated translation in 100+ languages is now possible at the click of a button).

▲

pbhjpbhj 2 hours ago | parent | prev | next [-]

On the Quad9 website:

>Since Quad9 already performs DNSSEC validation, DNSSEC being enabled in the forwarder will cause a duplication of the DNSSEC process, significantly reducing performance and potentially causing false BOGUS responses.

This sounds dodgy. Surely that means Quad9 can poison my DNS?

▲

Arainach 2 hours ago | parent | next [-]

Not if Quad9 is using DNSSEC, no.

What's the specific threat you're envisioning? If it involves Quad9 themselves being malicious, what would DNSSEC on the forwarding prevent?

This page explains how all of this works in detail: https://quad9.net/news/blog/quad9-enables-dnssec-on-all-serv...

	▲	zamadatix 2 hours ago \| parent [-]
		DNSSEC validation on your forwarder would prevent a maliciously modified record from Quad9 (or others) from being accepted locally - i.e. "Quad9 can poison my DNS". I've always been of two minds on this. On one hand, that concern is beyond any reasonable level of security/performance/reliability tradeoff for most any user. At the same time, it is a bit of a shame DNS doesn't have a more scalable & performant approach to security which can just always be done without having to consider it a tradeoff, however minor in practice.

▲

thenewnewguy 44 minutes ago | parent | prev [-]

Technically yes, in practice the odds your local resolver is validating DNSSEC is slim (and if you're intentionally configured it to do so, switch to a provider that isn't Quad9).

▲

oofdere 2 hours ago | parent | prev | next [-]

Quad9 doesn't have an adblocking DNS service though, so it's not really a replacement.

▲

ripdog 17 minutes ago | parent | next [-]

That's something people should run themselves. I run Adguard Home on my router. Unlike the main Adguard product, Adguard Home is fully FOSS. It's been rock-solid for me, and improves on pi-hole in various ways - like full IPv6 support.

	▲	sgc 5 minutes ago \| parent [-]
		It's probably the software I trust the most on my network to 'just work', and with the local caching I can use slower upstream dns providers and still have sub 1ms average latency (no performance worries by excluding google and cloudflare). I don't use it for dhcp, but it is a good fit that it's available as well. Couldn't be happier.

▲

ornornor an hour ago | parent | prev | next [-]

Mullvad had adblocking, malware blocking. And they didn’t block websites from governments blacklists in France and Italy. None of these features are available on Quad9.

Maybe it’s time to try nym.com?

▲

1970-01-01 an hour ago | parent | prev [-]

This is a very important detail. Adblock in 2026 is necessary and DNS will transparently do a lot of that work for you. It isn't just about lightning fast lookups and five-nines uptime anymore.

▲

cortesoft an hour ago | parent [-]

For blocking, I would much rather run my own service.

	▲	LetsGetTechnicl an hour ago \| parent [-]
		I've been loving the Pihole setup I just set up. It uses Quad9 as the upstream provider and then I do all the blocking myself. I used to use NextDNS but this is so much better and free!

▲

seany 2 hours ago | parent | prev [-]

I'm all for supporting quad9; but what if we just disable dnssec instead, it really solves nothing and continued support of it just makes it show up in compliance guides unnecessarily.