World

Quad9 would rather leave France than block. Who loses?

A French court told Quad9 to block piracy domains for users in France. It's leaving instead. Banking's de-risking shows who loses when a middleman walks.

Paris; illustrative. Photo by Adrien on Unsplash

On 22 October, Quad9 said it will stop serving users in France on 24 November. Quad9 is a free DNS resolver run by a Swiss nonprofit, the service that turns a web address into a number your device can reach, and it blocks known malware and phishing domains on the way. A French court had ruled the day before that it must block a list of domains streaming sport without a licence, in a case brought by beIN. Quad9's reply: "Quad9 will not block the domains in question." It's leaving instead.

It isn't the first. Cisco's OpenDNS stopped serving France in June 2024 after a similar order. Google and DNS4EU, named in an earlier May order alongside Quad9, complied.

June 2024 OpenDNS (Cisco) stops serving users in France after a blocking order
13 May 2026 Paris court orders resolvers including Google, DNS4EU and Quad9 to block domains streaming WTA tennis (beIN)
21 Oct 2026 Court rules Quad9 must block; penalty cut from €580,000 to €1,000 a day
22 Oct 2026 Quad9 announces it will leave France
24 Nov 2026 Quad9 stops serving users in France

Sources: Quad9 blog, 22 Oct 2026; JustGeek.fr.

So the question I wanted to answer: when a court aims at pirates and hits a resolver, who actually ends up paying?

Why not just block the domains for French users?

My first reaction was that Quad9 was being dramatic. Google managed it. Block the names for French addresses and carry on.

Quad9's post makes the case that it can't do that honestly. It keeps no list of French users and doesn't log where queries come from, so it would have to lean on IP geolocation, which it calls unreliable. A VPN gets round it in seconds. It already paid "six figures of cost" fighting a German case brought by Sony Music between 2021 and 2023, which it says it eventually won. And the alternative, adding the domains to its global blocklist, would apply a French court order to every user in the world. Quad9 calls that "extraterritorial" and "entirely unworkable".

The money here is small. The court cut the penalty "from €580,000 to €1,000 per day." But Quad9 also says about 20 other lawsuits are pending, asking for hundreds more names. So the real cost for Quad9 is what comes after it says yes once: becoming a service that edits answers on request, with a queue of courts waiting to ask.

That changed my view. Quad9 looks less like a stubborn provider and more like the predictable result of where the order landed.

Diagram: a French court order to block named piracy domains for users in France leads two ways. Comply: Google and DNS4EU blocked the May 2026 list. Leave: OpenDNS stopped serving France in June 2024; Quad9 leaves on 24 November 2026 and French users lose its malware blocking — Two ways out of a blocking order. Sources: Quad9 blog, 22 Oct 2026; JustGeek.

Where else does a rule aimed at bad actors push the middleman out?

Banking has a word for it: de-risking.

A money transfer and exchange office with an open sign — A money transfer office; illustrative, not a firm named in the surveys. Photo by Anton Borzenkov on Unsplash

In October 2014 the Financial Action Task Force, which sets the global anti-money-laundering standards, put out a statement with a pointed title: case-by-case, not wholesale de-risking. It described banks "terminating or restricting business relationships" to avoid risk rather than manage it, and warned that this can "force entities, and persons into less regulated or unregulated channels."

A year later the World Bank published surveys showing large banks pulling services from smaller correspondent banks and from money transfer firms, with some cutting off whole categories of customer by country or business type. Gloria Grandolini of the World Bank said "turning away customers could actually reduce transparency in the system."

The rule was aimed at launderers. The cost of checking each customer fell on the bank in the middle. The cheapest move for the bank was to drop the whole category. The ones who lost access were mostly smaller banks and money transfer firms, and behind them ordinary people sending money, the ones the rule was never about.

A rule aimed at bad actors, carried by the middleman

Banks and de-risking (2014 to 2015)

Aimed at money launderers
Cost lands on the bank in the middle, checking each customer
Cheapest move drop whole categories by country or business type
Who loses money transfer firms, smaller correspondent banks
Warning pushes people to less regulated channels (FATF)

DNS resolvers and piracy blocking (2024 to 2026)

Aimed at pirate sport streams
Cost lands on the resolver, deciding who is in France
Cheapest move comply (Google, DNS4EU) or leave France (OpenDNS, Quad9)
Who loses French networks that chose Quad9 for malware blocking
Warning blocking bypassed by a VPN or another resolver (Quad9)

Sources: FATF, 23 Oct 2014; World Bank, 20 Nov 2015; Quad9, 22 Oct 2026; JustGeek.

Swap the nouns and you have Quad9. The order is aimed at pirate streams. The cost of checking who is French falls on the resolver. The cheapest honest move for a small nonprofit is to drop the whole country. And the people who lose are the French networks that used Quad9 for its malware blocking; its post lists government, education, health and transport networks among them.

So who ends up paying?

The French users who chose a resolver that blocks malware and doesn't edit answers for anyone else. They now have 30 days to choose again.

What I think happens next is an inference, not something anyone has measured: most of them move to a resolver that complies, often one of the biggest. Blocking orders are cheapest for the largest providers to carry, so each exit concentrates DNS for that country in fewer, larger hands. It mirrors the FATF warning: in banking, de-risking pushed people into less regulated channels. Here the exit pushes them into more heavily filtered ones.

There's a fair case on the other side. Rights holders pay a lot for live sport, and a pirate stream is gone by the time a site-by-site takedown arrives. DNS blocking is fast and cheap for them. And Quad9 chose to leave; nobody forced that particular door.

But if the order is meant to stop piracy, it doesn't get that either. Quad9's point is that the content stays up, and anyone determined switches resolver or uses a VPN. The block works best on the people who weren't trying to get round it.

On 22 October I wrote about a country trying to fine a website it can't reach. This is the same problem from the other end. That one reached for a site abroad that ignored it. This one reached a service that listened, and lost it.

The claim, in one sentence

When a rule lands on a middleman instead of the wrongdoer, the middleman's cheapest answer is often to leave, and the people who lose the service are the ones the rule was never about.

Established: The ruling, Quad9's exit date and reasons, OpenDNS's 2024 exit, Google and DNS4EU complying with the May order, and the FATF and World Bank findings on de-risking.
Inferred: That French Quad9 users will move to resolvers that comply, so blocking ends up concentrated in the biggest providers. No one has measured this.
Guess: That more small resolvers will geofence France rather than fight.

More on Daily Ferment: Can a country fine a website it can't reach? and Hijacked registries minted real Google certificates. Property fraud already has the fix..