9.9.9.9: Quad9 malware-blocking public DNS
9.9.9.9 is Quad9, a free public DNS resolver run by a Swiss not-for-profit on AS19281. It blocks malicious domains and does not log your IP.
9.9.9.9 is Quad9, a free public DNS resolver that blocks domains known to serve malware, phishing and other attacks. It is run by the Quad9 foundation, a public-benefit not-for-profit foundation seated in Zürich, Switzerland, on its own network AS19281. Quad9 was founded with the Global Cyber Alliance, IBM and Packet Clearing House (PCH), and the service has been online since August 2016 (FAQ). Its reverse DNS name is dns9.quad9.net.
Addresses
Quad9 runs four services, each with two IPv4 and two IPv6 addresses:
| Service | IPv4 | IPv6 |
|---|---|---|
| Recommended: blocks malware, validates DNSSEC | 9.9.9.9, 149.112.112.112 | 2620:fe::fe, 2620:fe::9 |
| Blocks malware, with EDNS Client Subnet | 9.9.9.11, 149.112.112.11 | 2620:fe::11, 2620:fe::fe:11 |
| Unsecured: no blocking (Quad9 says for experts only) | 9.9.9.10, 149.112.112.10 | 2620:fe::10, 2620:fe::fe:10 |
| No blocking, with EDNS Client Subnet | 9.9.9.12, 149.112.112.12 | 2620:fe::12, 2620:fe::fe:12 |
The two ECS services pass part of your address on to the sites' DNS servers, which can give a closer CDN server; the recommended service does not.
Encrypted DNS
| Service | DNS over HTTPS | DNS over TLS (port 853) |
|---|---|---|
| Recommended | https://dns.quad9.net/dns-query | dns.quad9.net |
| With ECS | https://dns11.quad9.net/dns-query | dns11.quad9.net |
| Unsecured | https://dns10.quad9.net/dns-query | dns10.quad9.net |
| No blocking, with ECS | https://dns12.quad9.net/dns-query | dns12.quad9.net |
What 9.9.9.9 blocks
Quad9 checks each name against a list combined from more than 20 threat intelligence partners and answers NXDOMAIN for a domain that exists mainly to harm users: phishing, malware, exploit kits and fraud (about, FAQ). It does not block spam sites, ads or adult content, and Quad9 says it has no plans to offer content filtering. If a site you need is blocked, the 9.9.9.10 and 9.9.9.12 addresses skip the list.
Where is 9.9.9.9?
Quad9 is an anycast service in more than 200 locations: every site announces 9.9.9.9, and routing takes your queries to one of them, usually one near you. An IP location lookup gives one place for the address, but that is not necessarily where you are answered. To check you are using Quad9 at all, open on.quad9.net, which says yes or no.
What Quad9 logs
From the Quad9 privacy policy:
- Quad9 does not collect or record users' IP addresses. The source address is held in memory only while the query is answered.
- It keeps counters, such as how often a name was queried and from which Quad9 location (city, region, country of its own server), which may be archived.
- The foundation is subject to Swiss data protection law (FADP).
Look up 9.9.9.9 with the host.sh API
The API's lookup of 9.9.9.9, like that of any address, returns its network (connection.isp), reverse DNS (connection.hostname, with hostname=1) and location fields. Looking up an address other than your own needs a token:
curl -H "Authorization: Bearer YOUR_TOKEN" "https://api.host.sh/v2/lookup/9.9.9.9?hostname=1"
See Lookup and Response fields. For your own address, open the IP lookup or run curl host.sh.
FAQ
Who owns 9.9.9.9?
The Quad9 foundation, a not-for-profit foundation in Zürich, Switzerland. 9.9.9.9 is announced by its network AS19281.
What does Quad9 block?
Domains that its threat intelligence partners list as malicious: phishing, malware, exploit and fraud sites. It does not block ads, spam or adult content.
What is the difference between 9.9.9.9, 9.9.9.10, 9.9.9.11 and 9.9.9.12?
9.9.9.9 blocks malicious domains. 9.9.9.11 blocks them too and sends EDNS Client Subnet to the sites' DNS servers. 9.9.9.10 does not block anything, and 9.9.9.12 does not block but sends EDNS Client Subnet.
Does Quad9 log my IP address?
No. Quad9's privacy policy says it does not collect or record users' IP addresses; it keeps counters per domain and per Quad9 location.
What is the IPv6 address of Quad9?
2620:fe::fe and 2620:fe::9 for the recommended service.
This page as Markdown: /ip/9.9.9.9/index.md