Quad9's free DNS resolver blocks malicious domains without logging user IPs

What Quad9 does

Quad9, a public recursive DNS service run by the Swiss-based Quad9 Foundation, drew fresh attention after a link to its homepage reached the Hacker News front page. The core idea is straightforward: instead of using the DNS servers assigned by your ISP or enterprise network, you point your devices at Quad9, and every hostname lookup gets checked against a continuously refreshed list of known-malicious names. If a match is found, the lookup is refused and the connection to that host never happens.

According to Quad9, this shields computers, phones and IoT systems from malware, phishing, spyware and botnets, and because answers come from a globally distributed resolver network, it can also improve resolution performance.

The scale behind the service

The figures Quad9 publishes on its site point to a substantial operation:

• More than 670 million blocked lookups on an average day.
• Over 230 resolver clusters spread across more than 110 countries.
• Threat intelligence supplied by more than 25 cybersecurity firms.

That threat feed is what turns the resolver into a security product: the company says it provides a real-time picture of which hostnames are known to serve malware or other threats, so blocking happens before a browser or application ever reaches the hostile server.

A privacy-first resolver

Quad9's second selling point is what it does not do with your data. The foundation states that when devices use the service normally, no data containing the user's IP address is ever logged in its systems, that connections can be encrypted where the client supports it, and that the platform was designed to be GDPR-compliant from its first public announcement in 2017.

The reasoning it gives is that nearly every internet transaction begins with a DNS event, and those lookups reveal sensitive information about the person behind them — data that has created, in Quad9's words, a strong commercial motivation for other resolver operators. Quad9 describes itself as the only large DNS resolver whose founding charter lists privacy as a primary goal. These characterizations come from the foundation itself rather than an independent audit, though its Swiss jurisdiction and not-for-profit structure are part of the pitch.

How to switch over

Getting started requires no sign-up, account data or contract. Users change the DNS server settings on a device to the addresses published in one of Quad9's service profiles. Configuring the setting at the router or access point extends the protection to everything on the local network — which matters most for IoT devices, many of which ship with no anti-malware defenses of their own.

The site also offers a lookup tool that lets anyone check whether a specific hostname or domain is among the millions Quad9 blocks, useful for troubleshooting a site that suddenly stops resolving. The service is free to use and funded through grants, partnerships with commercial and non-commercial organizations, and donations from individuals and corporate sponsors.

Why it matters

DNS is the first step in almost every online interaction, which makes the resolver a uniquely effective choke point for defense: block a malicious name there and the malware payload, phishing page or botnet controller is never contacted. Because the protection lives in the network path rather than on the endpoint, it covers devices that cannot run antivirus software and requires no agents, licenses or maintenance.

For enterprises, swapping the recursive resolver setting is one of the cheapest security layers available, and Quad9 frames it as protection whose value compounds across users, businesses and the banks and e-commerce firms they rely on. For individuals, the lack of accounts, contracts and cost means trying it carries essentially no risk. The trade-off is that any filtering resolver becomes a party you trust to decide what resolves; Quad9 answers that concern with its no-IP-logging stance and charter, but those remain the foundation's own commitments. For anyone still running default ISP DNS, it is a practical upgrade worth a few minutes of configuration.