In short. Quad9 is a free public DNS resolver at 9.9.9.9 that refuses to answer queries for known malicious domains. It is run by a Swiss non-profit foundation. Quad9 offers three modes on three different address sets: filtered, unfiltered, and filtered with client subnet forwarding. Setup takes a couple of minutes on a device or router, and it supports both DoH and DoT.
What Quad9 is and who runs it
Quad9 is a public recursive DNS resolver. It does the same job as your ISP's resolver: it turns a domain name into an IP address. The difference is one extra step — before returning an answer, Quad9 checks the requested domain against threat intelligence lists. If the domain appears on those lists, the resolver returns NXDOMAIN, meaning "no such name". The connection is never established at all.
The service grew out of a joint effort by IBM, Packet Clearing House and the Global Cyber Alliance. Operation later moved to an independent foundation registered in Switzerland. The jurisdiction is not a box-ticking detail: Swiss data protection law combined with non-profit status is exactly what separates Quad9 from resolvers operated by commercial companies with advertising businesses attached.
A public resolver does not make you anonymous. It only changes who sees your DNS queries. Your ISP still sees the IP addresses you connect to, and the SNI field in the TLS handshake often reveals the hostname anyway.
Quad9 addresses: 9.9.9.9, 9.9.9.10 and 9.9.9.11
The most common confusion around Quad9 is that it is not one address but three sets with different behaviour. Choosing the address is choosing the policy.
| Addresses | Threat blocking | DNSSEC | ECS | Best for |
|---|---|---|---|---|
| 9.9.9.9 149.112.112.112 2620:fe::fe | Yes | Validated | No | The default choice for most people |
| 9.9.9.10 149.112.112.10 2620:fe::10 | No | Not validated | No | Malware research, debugging |
| 9.9.9.11 149.112.112.11 2620:fe::11 | Yes | Validated | Yes | When CDN proximity matters |
ECS (EDNS Client Subnet) forwards part of your IP address to the authoritative server so a CDN can hand back the nearest edge node. The trade-off is direct: with ECS your content loads from a closer point of presence, without ECS your subnet never leaves the resolver. The primary 9.9.9.9 address does not send ECS, and that is a deliberate privacy decision rather than an oversight.
The second address in each pair is not a lesser fallback — it is an equal peer. Configure both: if one becomes unreachable, the operating system fails over without your involvement.
Never mix addresses from different modes. Pairing 9.9.9.9 with 149.112.112.10 produces behaviour that depends on which resolver answered first: one query gets filtered, the next slips through. Debugging that is genuinely painful.
What Quad9 actually blocks
Quad9 aggregates threat lists from several independent intelligence providers. Domains land on those lists when they are observed distributing malware, running phishing pages, or acting as botnet command-and-control endpoints.
The boundary matters. Quad9 is not parental control and not an ad blocker. It does not strip trackers, filter adult content, or remove banners. If you need content filtering, that is a different class of resolver. If you need ad blocking, that belongs to a browser extension or a dedicated DNS service built for it.
False positives are possible with any list-driven mechanism. The symptom is recognisable: a site fails to open, the browser reports a name resolution error, and the same domain loads normally through a different resolver. How to confirm that is covered below.
Privacy: what Quad9 logs
Quad9's stated policy is that it does not retain the source IP address of a query. What it does keep is aggregated statistics: which domains were requested, from which country or autonomous system, and how often. That is enough to operate the network and study threats, and not enough to reconstruct who looked up what.
Compare that with a typical ISP resolver, where every query is tied to your subscriber account by construction. The difference is real, but it does not turn DNS into an anonymity tool — see the warning above.
How to configure Quad9
A sensible order is router first, individual devices second. Router-level configuration covers the whole network, including a television or a smart plug that may expose no DNS settings of its own.
Router
In the router's web interface look for the WAN, Internet or DHCP section. You want a "DNS servers" field that accepts manual entry. Enter 9.9.9.9 and 149.112.112.112, save, and reboot. Clients pick up the new addresses on their next DHCP lease renewal, or immediately if you reconnect them.
Windows
netsh interface ip set dns name="Ethernet" static 9.9.9.9
netsh interface ip add dns name="Ethernet" 149.112.112.112 index=2
ipconfig /flushdns
netsh interface ip show dnsserversFind the interface name with netsh interface show interface — it may well be "Wi-Fi" or "Ethernet 2" rather than the value shown here.
macOS and Linux
# macOS — substitute your service name from networksetup -listallnetworkservices
sudo networksetup -setdnsservers "Wi-Fi" 9.9.9.9 149.112.112.112
sudo dscacheutil -flushcache
# Linux with systemd-resolved
sudo resolvectl dns wlan0 9.9.9.9 149.112.112.112
sudo resolvectl flush-caches
resolvectl status wlan0Hand-editing /etc/resolv.conf is pointless on most modern distributions: NetworkManager or systemd-resolved will overwrite the file on the next connection.
After switching resolvers, flush the cache on the device and in the browser — Chrome keeps a DNS cache of its own. A full walkthrough of every caching layer lives in the separate guide on flushing the DNS cache.
DoH and DoT: encrypted Quad9
Plain DNS travels in clear text over UDP: any node along the path can see which domains you request and can forge the reply. DoH (DNS over HTTPS) and DoT (DNS over TLS) close that gap with encryption.
# DoH — this URL goes into browser settings
https://dns.quad9.net/dns-query
# DoT — hostname for system resolvers
dns.quad9.net
# Testing DoH with curl (RFC 8484 wireformat)
curl -s -H 'accept: application/dns-message' 'https://dns.quad9.net/dns-query?dns=AAABAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB' | xxd | head -3Firefox and Chrome can speak DoH themselves, independently of system settings. That is convenient and treacherous in equal measure: the browser may be talking to its own DoH resolver while you believe the whole machine is on Quad9. When verifying a setup, verify from the browser rather than from a system utility alone. The protocol mechanics are covered in the article on DNS over HTTPS.
Quad9 versus Cloudflare 1.1.1.1 and Google 8.8.8.8
| Property | Quad9 9.9.9.9 | Cloudflare 1.1.1.1 | Google 8.8.8.8 |
|---|---|---|---|
| Operator | Non-profit foundation, Switzerland | Commercial company, US | Commercial company, US |
| Malicious domain blocking | Yes, by default | On a separate address | No |
| ECS on the primary address | No | No | Yes |
| DNSSEC validation | Yes | Yes | Yes |
| DoH / DoT | Yes | Yes | Yes |
The choice comes down to what you value. If you want threat filtering with no extra configuration, Quad9 is the straightforward answer. If raw response time matters most, measure all three from where you actually are. If maximum CDN compatibility matters, pick the variant that forwards ECS.
An "average internet" speed figure tells you nothing about speed at your location: it depends entirely on how far you sit from each network's nearest point of presence. The only honest way to choose is to measure. A broader comparison lives in our roundup of public DNS servers.
How to verify Quad9 is really in use
The most common mistake is entering the addresses and assuming the job is done. Three things deserve checking: which resolver actually answers, whether filtering works, and whether anything you need has broken.
# Which resolver is really answering
dig +short o-o.myaddr.l.google.com TXT @9.9.9.9
# Compare Quad9 and another resolver on the same domain
dig +short example.com @9.9.9.9
dig +short example.com @1.1.1.1
# Confirm DNSSEC validation (look for the ad flag)
dig example.com @9.9.9.9 +dnssec | grep -E 'flags:|ad'If dig is unavailable — a locked-down corporate laptop, for instance — the same checks work from a browser. The DNS Lookup tool returns every record type and compares the answers of roughly twenty resolvers side by side, so a Quad9 answer that differs from the rest stands out in a single table. When you suspect a domain has been blocked in error, compare its answers across resolvers with the DNS propagation check: a divergence on Quad9 alone, while every other resolver agrees, is a filter hit rather than a problem with the domain.
If you run a site and would rather learn about resolution problems before your visitors do, DNS records can be placed under continuous monitoring — a vanished or altered record then arrives as an alert instead of a support ticket.
When Quad9 is the wrong choice
Some situations make a filtering resolver an obstacle.
- Internal domains. Corporate zones such as
.localor.corpare unknown to Quad9 because it is public. You need split-horizon DNS: internal zones on an internal resolver, everything else outbound. - Threat research. If your work requires resolving known-malicious domains, the primary address gets in the way — that is precisely what 9.9.9.10 exists for.
- Hard dependence on CDN geolocation. The absence of ECS may route you to a more distant edge node. Where that genuinely matters, use the .11 address set.
- A requirement to keep resolution inside the perimeter. If policy forbids DNS leaving your network, a public resolver fails the requirement by definition.
Frequently asked questions
Is Quad9 free?
Yes, for ordinary use there is nothing to pay. The service is funded by donations and partner organisations rather than by selling user data.
How does 9.9.9.9 differ from 9.9.9.10?
The .9 address filters malicious domains and validates DNSSEC. The .10 address does neither — it is a raw mode for cases where filtering gets in the way. Do not combine the two in one pair.
Will Quad9 slow down my connection?
The list lookup happens on the resolver side and is imperceptible in practice. Real speed differences come from the distance to the nearest point of presence. Measure that yourself rather than trusting figures from someone else's review, which describe someone else's geography.
A site stopped opening after I switched to Quad9. What now?
Compare the answer for that domain on 9.9.9.9 and on any other resolver. If Quad9 returns NXDOMAIN while others return a normal address, the filter fired. If the domain is yours and you are confident it is clean, Quad9 has a review process. For a one-off check, switching temporarily to 9.9.9.10 is enough.
Do I still need Quad9 if I already run antivirus?
They are different layers. Antivirus reacts once a file has been downloaded or a page opened. A filtering resolver prevents the connection from being established at all. The layers complement each other; neither replaces the other.
Does Quad9 work on mobile?
Yes. Android has a Private DNS setting that accepts dns.quad9.net, enabling DoT across every network including mobile data. iOS requires a configuration profile or an app.
Migration checklist
- Decide which mode you need: .9 for filtering, .10 for none, .11 for filtering with ECS.
- Configure both addresses of the chosen mode, never mixing modes.
- Start at the router so devices without DNS settings of their own are covered.
- Add the IPv6 addresses if IPv6 is active, otherwise part of your traffic bypasses the change.
- Flush the DNS cache on the system and in the browser.
- Confirm Quad9 is answering rather than a cached older resolver.
- Disable the browser's separate DoH setting or point it at Quad9 too, or the browser will go its own way.
- Test internal domains, VPN and corporate resources before rolling the change out network-wide.
- Remember 9.9.9.10 — it is the fastest way to establish whether the filter is to blame.