Quad9, the free Swiss nonprofit DNS resolver, has announced that from 24 November 2026 it will no longer serve users in France. The trigger was a Paris court ruling on 21 October 2026 that held Quad9 to a blocking order obtained by the broadcaster beIN against pirate sports-streaming domains, backed by a penalty of €1,000 a day. The episode is a useful test of where French blocking law is heading, and of whether the country's own legislative design offers a better model than ad hoc litigation.
The strongest case for the court
Rights holders have a real grievance. Live sport loses most of its value the moment a pirate stream goes up, and a slow notice-and-takedown process is useless for a match that ends in two hours. DNS resolvers are a legitimate chokepoint: if an operator can alter answers to filter malware, it can plausibly alter them to filter a stream. According to TorrentFreak, the Paris court's position is that Quad9 owed reasonable efforts and instead did nothing. That is a coherent view of a service that profits from no one but is still part of the delivery chain.
What the order actually requires
The order is not a one-off. TorrentFreak reports that a May order covering six domains has grown to 58, and that the court set the penalty at €1,000 per day in total. In its announcement, Quad9 says the court cut the penalty from the €580,000 a day beIN sought. Quad9 estimates the total at about €24,000 until the blocking ends on 14 November, before legal costs. It also says about 20 other pending French cases, brought against it and other DNS resolvers, demand that hundreds of names be blocked, and that an appeal is pending.
The low penalty is not the point. The problem is the compliance model. Quad9 says it has no database tying users to jurisdictions, requires no sign-up and keeps no user records, so it cannot determine who is in France. It cites a German case in which Sony Music used a VPN to reach blocked content and then argued the geo-blocking had failed; Quad9 says it was fined for contempt. Its choice, as the EFF summarises it, is between extending French law to the whole world and trying to block only French users, which it says cannot be done reliably. Withdrawal is the only option left that breaks no one else's rights.
What the SREN law actually built
France's 2024 digital-regulation statute, Loi n° 2024-449 of 21 May 2024 (SREN), shows how the legislature handled the same chokepoint. Article 14 rewrites Article 11 of the 2004 LCEN so that Arcom, the audiovisual and digital regulator, can notify ISPs and providers of domain-name resolution systems to block listed addresses. The design has limits:
- Narrow subject matter. The power covers content from persons targeted by EU sanctions under Article 215 TFEU, not a general censorship mandate.
- Process before blocking. A formal notice and a 72-hour warning period come first, and the regulator sets the deadline.
- Proportionate sanctions. Failure to block or delist carries a cap of 1% of worldwide turnover, rising to 2% for repeat violations.
The SREN provision is not the basis of the beIN case. The sources I reviewed do not cite SREN in connection with this ruling, and I make no claim that they do. The comparison is about design. Parliament named resolvers in a statute, defined the trigger, put a regulator in the middle and capped the penalty. A private plaintiff, by contrast, can now stack domain after domain onto a single order, with a per-day penalty and no fixed ceiling on scope.
Why this is the wrong direction
Three problems follow. First, the blocking is easy to evade. Quad9 notes that users simply switch to another free resolver, so the practical effect is to move traffic from a privacy-focused, security-filtering service to alternatives with no such mandate. The EFF makes the same point: the withdrawal will not remove any infringing material from the internet.
Second, extraterritoriality is built in. When a service cannot locate its users, an order limited to France becomes, in practice, an order for everyone or no one. A Swiss nonprofit should not have to choose between applying Paris's decisions to every user worldwide and leaving a market of tens of millions.
Third, the collateral cost is real. Quad9 blocks malware and phishing domains. French users who move to other resolvers lose that protection. A rule meant to protect broadcast revenue ends up reducing cybersecurity for ordinary people.
A proportionate path
Nothing here requires abandoning enforcement against pirate streams. The SREN model points to a better one: put the regulator, not individual litigants, in charge of resolver notices; require identified, verified targets; set short deadlines for live events with an automatic expiry; and define in advance what counts as reasonable effort for a resolver that has no way of locating its users. A court that must decide whether Quad9 did enough should also ask what compliance is technically possible for a service built to know nothing about its users.
The French outcome so far is lopsided. The rights holder gets a reduced penalty and a departing defendant. Users lose a privacy and security service. The pirate sites remain reachable through any other resolver. If the pending appeal and the 20 other cases follow the same pattern, more operators will make the same calculation. France would then have invested heavily in blocking while making its own internet less open and less safe, which is a poor trade for a country that wants to lead on digital rules.