Quad9 will stop answering DNS queries from France on November 24, 2026. The Swiss nonprofit announced the exit on October 22, one day after the Paris Judicial Court ordered it to pay €1,000 a day for refusing to block 58 domains that beIN Sports says stream pirated tennis. Quad9 has blocked none of them. It says it never will, and it would rather lose every user in France than start.

The fine is small. beIN asked for €10,000 per domain per day, which works out to €580,000 a day across the 58 names. The court cut that to €1,000 a day total, and the penalty only runs until the underlying blocking order expires on November 14. Quad9 puts the whole bill at about €24,000 before legal fees. A resolver that handles traffic for the French prime minister's digital directorate can find €24,000.

The €24,000 would not have moved anyone. The court's reasoning did.

How a tennis stream turned into a resolver exit

The case started on May 13, 2026, when the Paris court granted beIN a blocking order under Article L.333-10 of the French Sports Code against Google, Whalebone (which runs DNS4EU), and Quad9. The original list was six domains carrying WTA matches. Two updates later it was 58. TorrentFreak reported that beIN's first request for a daily penalty was denied in May because nothing showed Quad9 intended to resist. Then Quad9 resisted, in writing, by confirming to the court that it had not blocked a single name.

The October 21 ruling (case RG 26/11882) draws a line that infrastructure people should read twice. In the same month, the same court refused beIN's penalty requests against Cloudflare and several VPN providers. Those companies had blocked at least some of the domains. Quad9 blocked zero. The court's position is that a resolver must make reasonable efforts, and partial compliance counts as reasonable. Total refusal does not.

That is a legal incentive to lie a little. Block a few names, answer honestly for the rest, and you are fine. Refuse on principle and you pay. Quad9 chose to pay and leave.

Quad9 is the second public resolver to walk out of France. Cisco's OpenDNS went dark for French and Portuguese users on June 28, 2024, after Canal+ won a similar order covering around 117 domains tied to Premier League and Champions League streams. Google complied with that one and still answers queries in France. Cloudflare has been blocking selectively and escaped penalties in October. The pattern is clear: the companies with legal departments bend, and the nonprofit with a Foundation Council gets fined.

Why Quad9 says it can't comply

The court order applies to users located in France. Quad9 keeps no user database, requires no registration, and logs no individual IP addresses. To block for French users only, it would need a commercial GeoIP database to decide which queries came from France. Quad9 says those databases are incomplete, and I agree with them. I've watched GeoIP put a datacenter in the wrong country more than once, and mobile carriers with NAT pools make it worse.

Quad9 also has history here. When Sony Music sued it in Germany in 2021, Quad9 tried GeoIP blocking as a stopgap so it could keep serving German users while the case ran. Sony's lawyers connected through a VPN, reached the blocked site, and went back to the court. The court agreed Quad9 was out of compliance and fined it for contempt. Quad9 won the whole case at the Dresden Higher Regional Court in December 2023, which held that a resolver is a neutral intermediary and not a perpetrator. The win took two years and six figures in legal costs, and the contempt finding was never overturned.

So Quad9's view of GeoIP blocking is that it is both technically wrong and a proven way to get fined anyway. The alternative is blocking the 58 names globally, which Quad9 did in Germany for a while in 2023. It refuses to do that for France. From the announcement:

Such a system would set a precedent that any nation could impose their laws, morals, economic demands, or social constructs upon any other nation by the means of blocking DNS names, and thus blocking communication and content.

There is a hole in that reasoning, and Quad9's CTO John Todd admitted it on Hacker News. To stop serving French users on November 24, Quad9 will most likely use GeoIP. The same imprecise database it won't trust for a blocklist is good enough for a shutoff. Todd's answer is that the two cases are different in kind: refusing service to a region keeps the answers honest for everyone who gets one, while a blocklist keyed to country means some users get lies. I buy that distinction. A court might not, and a French user on a badly mapped IP will get cut off while a French pirate on a VPN won't notice.

The 20 cases behind this one

The announcement says roughly 20 other lawsuits are pending in France against Quad9 and other resolver operators, covering hundreds of domain names, and those are what pushed Quad9 out. Each one can end with its own daily penalty. beIN's lawyers set the template, and Canal+ and the leagues it licenses now know it works.

France also changed the law in July 2026. Rights holders can now add domains to a block list automatically during a live broadcast, with the regulator ARCOM reviewing the additions afterward. Quad9 called that "recklessly dangerous" in October. A resolver operator who accepts the beIN order is accepting a feed of names that nobody has vetted, updated in real time by the party that profits from the block. That is a filtering product, and Quad9 was never built to be one.

The ruling's territorial scope is also a mess. It covers metropolitan France, the overseas departments, and Saint-Pierre and Miquelon, but not French Polynesia, New Caledonia, or Wallis and Futuna. An anycast resolver with no account system is supposed to implement that boundary from IP addresses alone.

If you have 9.9.9.9 in a config file in France, you have 30 days

Quad9 published a partial list of French networks it saw querying in one typical hour. It includes DINUM (AS60855), the directorate that runs the state's interministerial network. It includes France Travail, the national employment agency. CEA Paris-Saclay, Institut Pasteur, fifteen RENATER autonomous systems covering the research and education network, and the Région Nouvelle-Aquitaine are on it too. Quad9 says there are hundreds more and it picked these at random.

That traffic comes from resolver settings in router templates, DHCP scopes, cloud-init files, Docker daemon configs, and the fallback entry someone added to resolv.conf in 2019 and forgot. On November 24, every one of those lookups starts failing or timing out, depending on how Quad9 implements the cutoff. If the primary is Quad9 and the secondary is also Quad9, which is how most of the setup guides tell you to do it, that network loses DNS.

Thirty days is not long for a change control process at a government agency. Quad9 itself says the message will not reach some users in time.

Quad9's unfiltered addresses (9.9.9.10 and its secondaries) will go too. The exit covers the whole service, filtered and unfiltered. And if you were on Quad9 for the malware blocking, the replacements in France are now Google, Cloudflare, and DNS4EU, all of which have accepted at least some court ordered blocks. The one resolver that refused is the one leaving. That is the outcome a blocking regime produces when it fines refusal and rewards partial compliance.

Quad9 has an appeal pending. It won the German appeal, but that took until the end of 2023 for a case filed in 2021, and the French docket has 20 more cases behind this one. My prediction: the appeal will not conclude before the next penalty ruling lands, and no public resolver that operates on principle will be reachable from France by the end of 2027. The pirate streams will still be reachable, because the people who want them already know how to change a DNS server.