Quad9

Quad9
Name	Quad9
Type	Non-profit organization
Founded	2017
Founders	Global Cyber Alliance; Packet Clearing House; IBM; Independent Security Researchers
Headquarters	Zurich, Switzerland
Services	DNS security, recursive DNS resolver, threat intelligence

Quad9 Quad9 is a non-profit recursive DNS resolver service that provides malware and phishing blocking by combining threat intelligence feeds with public recursive DNS infrastructure. The service aims to improve internet security and privacy for end users by blocking access to known malicious domains while minimizing data retention and operational exposure. Quad9 operates globally through a distributed network of anycast-enabled resolvers and partnerships with internet exchange operators, research centers, and privacy-focused organizations.

Overview

Quad9 delivers DNS resolution with integrated threat intelligence to block domains associated with malware, phishing, botnets, and other cyber threats. The project interfaces with threat feed providers such as IBM, National Security Agency, Interpol, VirusTotal, and regional computer emergency response teams like US-CERT and CERT-EU while leveraging infrastructure partners including Packet Clearing House, Internet Society, and multiple internet exchange points like DE-CIX, LINX, and AMS-IX. Quad9's resolver network employs anycast routing similar to services provided by Cloudflare, Google Public DNS, and OpenDNS (now part of Cisco). Governance and operation involve collaborations with standards bodies such as the IETF and registries like ICANN.

History and Development

Quad9 was launched in 2017 following pilot initiatives spearheaded by the Global Cyber Alliance, Packet Clearing House, and IBM to demonstrate a public-interest DNS filtering service. Early milestones included deployment at internet exchange points coordinated with organizations such as RIPE NCC and APNIC and integration of threat intelligence where feeds originated from entities including Kaspersky Lab, Symantec, and national CERTs. The project expanded through partnerships with regional providers like Swiss Federal Institute of Technology in Zurich collaborators and registry operators including ARIN and LACNIC. Legal and policy discussions engaged stakeholders such as European Commission officials and privacy advocates from groups like Electronic Frontier Foundation.

Technical Architecture and Operation

Quad9's technical architecture uses a global anycast fabric to present a unified resolver IP address from multiple physical sites, employing routing and peering arrangements with internet exchange operators such as DE-CIX and AMS-IX. Resolver nodes run DNS recursive software compatible with standards from the IETF, including implementations that support DNS over TLS and DNS over HTTPS protocols specified in RFCs authored by working groups like DPRIVE. Threat intelligence is aggregated from feed providers including VirusTotal, IBM X-Force, and various national CERTs, then applied via policy engines to produce response actions such as NXDOMAIN or sinkholing. Infrastructure providers such as Packet Clearing House and cloud platforms like Amazon Web Services or regional data centers operated by organizations like Equinix host nodes to ensure geographic diversity and resilience.

Privacy and Security Features

Quad9 emphasizes privacy-preserving design decisions influenced by privacy advocates including Electronic Frontier Foundation and legal frameworks like the General Data Protection Regulation. The service implements minimal logging policies and geofenced telemetry similar to practices recommended by OECD and academics at institutions such as Carnegie Mellon University and ETH Zurich. Security features include blocking of known-threat domains using intelligence from IBM, Kaspersky Lab, Symantec, and national CERTs, as well as support for authenticated encryption in transit via DNS over TLS and DNS over HTTPS. Operational security is hardened through collaborations with incident response organizations like FIRST and network operators coordinated by NOG communities and research partnerships with SANS Institute.

Performance and Adoption

Quad9's anycast deployment and peering strategy aim for low-latency resolution comparable to commercial resolvers run by Cloudflare and Google Public DNS. Performance evaluations by researchers at APNIC and RIPE NCC measured latency, hit rates, and blocking efficacy relative to services from Cisco OpenDNS and other public resolvers. Adoption is driven by end-users, device manufacturers, and ISP partnerships; notable adopters and integrators have included consumer router vendors and enterprise security suites from firms such as Trend Micro and Palo Alto Networks. Regional adoption has been facilitated through collaborations with telecoms like Swisscom, content delivery networks such as Akamai, and academic networks run by Internet2.

Governance and Funding

Quad9 operates under a non-profit governance model with oversight from founding organizations like the Global Cyber Alliance and infrastructure partners including Packet Clearing House; advisory input comes from security firms such as IBM and independent researchers affiliated with universities like University of Cambridge and ETH Zurich. Funding sources include grants, donations, and in-kind contributions from partners; supporters have included corporate sponsors, philanthropic foundations, and public-interest organizations similar to Mozilla Foundation and Internet Society. Policy decisions and technical direction are informed by standards forums at the IETF and stakeholder consultations involving regional registries like RIPE NCC and APNIC.

Category:Domain Name System Category:Internet security services