No list of French users

Twenty-four thousand euros. That is the most Quad9 would owe France for ignoring a court order: €1,000 a day until the blocking period ends on November 14. The court had already cut the penalty from €580,000. Quad9 is leaving anyway. From November 24, the Swiss nonprofit behind the 9.9.9.9 resolver will stop serving users in France rather than block a set of domains that beIN, the Qatari sports broadcaster, says carry pirated streams of its matches.

It's easy to read the announcement as a stand for DNS neutrality, but the more useful point is somewhere else. Blocking the names is easy. Quad9 already runs one global list of malicious domains for everyone on 9.9.9.9, and its own post concedes that adding beIN's names to that list "would satisfy the requirements of the court." Quad9 calls compliance "technically unfeasible," but the obstacle isn't technical. It's about jurisdiction. Quad9 can't apply that list only to France, because it doesn't know who is in France. On paper, the order is a blocking order. In practice it's an order to know where your users are.

That leaves three ways to comply, and Quad9's post goes through each one. First, it could block the names for everyone. Then a French ruling won by one private company applies to every user on the planet. Second, it could block by IP geolocation, which puts Quad9 back where it was in Germany. When it geo-blocked to stay in service during its 2021–2023 fight with Sony Music, Sony used a VPN to reach the content from inside Germany, and the court fined Quad9 for contempt. Third, it could find out who its users are, with sign-ups, accounts and proof of location. That is the one thing a free, no-sign-up resolver exists not to do.

Blocking orders work against internet providers because providers already have what Quad9 lacks. An ISP can obey a French court precisely, because it sends its bills to French addresses. Rules like this were written for parties that have customers. A public resolver only has queries.

On paper, the order is a blocking order. In practice it's an order to know where your users are.

The fair objection is that the commercial internet enforces borders every day with geolocation that is good enough. Streaming services license by country and accept that some viewers will use a VPN. A court could accept the same standard here, and Quad9 could keep serving France with an imperfect geo-block. Grant all of that. It still doesn't help, because "good enough" isn't the standard Quad9 has been held to. The German court counted a VPN workaround as noncompliance. When the bar is a block nobody can get around, the only design that clears it is one that knows who is asking. And the €24,000 was never the real exposure: Quad9 says it faces 20 other pending cases like this one.

The first cost falls on the French users who chose 9.9.9.9 because it blocks phishing domains for them, on their behalf and with their consent. The larger cost falls on every service built to work without accounts. Under this ruling, a service that doesn't know who you are can stay in a country only by obeying that country's courts everywhere or by asking every user where they are. Twenty-four thousand euros was never the price. The price was a list of French users, and Quad9 would rather leave France than start keeping one.