Video summary

The Nonprofit Fighting to Keep DNS Private (Quad9 Interview)

Main summary

Key takeaways

Technology

Summary of key technological concepts & Quad9 features

1) Why DNS privacy matters (beyond HTTPS)

  • HTTPS encrypts page content, but DNS queries are often unencrypted, so an observer can still infer user activity via the “name → IP” lookups (metadata).
  • Even when content is encrypted, parties that can observe and aggregate DNS queries can infer destinations from DNS metadata.
  • Quad9’s goal: provide privacy-respecting recursive DNS so the resolver operator does not collect identifying information about end users.

2) What “recursive DNS” is (and what Quad9 replaces)

  • DNS is compared to the internet’s “phone book.”
  • When you type a hostname, your device sends it to a recursive resolver, which returns an IP address.
  • Quad9 replaces the default recursive resolver typically provided by an ISP, school, or employer.

3) Quad9 privacy stance and Swiss legal constraints

  • Quad9 is a nonprofit based in Switzerland.
  • Operational claims include:
    • No signup / no username
    • No unique user identifiers
    • No collection of personal data
    • No storage of IP addresses (as described in the interview)
  • The interview ties these claims to Switzerland’s legal constraints, including potential criminal penalties.

4) Encryption protocols: DoT, DoH, DoQ (and “DNS over Quick”)

The interview contrasts encryption options and notes adoption trends:

  • Unencrypted DNS (historically UDP, no encryption)
  • DNS over TLS (DoT): encrypted DNS over TLS (typically TCP 853)
  • DNS over HTTPS (DoH): DNS carried over HTTPS (typically TCP 443); browsers historically supported this directly
  • DNS over QUIC / DoQ: DNS over QUIC (UDP-based); described as operating on UDP 853
  • HTTP/3-based DNS (DoH3 / variants): UDP over 443 (QUIC under HTTP/3)

Adoption note: even when encryption is available, the speaker says usage can still be relatively low (sometimes < 20% of traffic).

Quad9’s automation push:

  • The interview argues for automatic upgrading, e.g., devices switching to encrypted DNS when they recognize a resolver like 9.9.9.9.
  • It also mentions Apple devices being able to auto-upgrade to DOQ for resolver answers.

5) Protocol recommendation ranking (speed/complexity)

If users must choose:

  1. DoQ (DNS over QUIC) first (slightly faster; less HTTP overhead)
  2. DoH3 (HTTP/3-based) second
  3. DoT (DNS over TLS) next
  4. DoH (TCP-based) last (older TCP-over-443 model)

This ranking is based on performance and concerns about server CPU/memory overhead at Quad9 scale.

6) DNS over HTTPS vs censorship/circumvention concerns

The interview highlights a policy/architecture tension:

  • DoH uses port 443, like normal HTTPS, making it harder to block DNS specifically without interfering with other HTTPS traffic.
  • Quad9 acknowledges this concern but also notes legitimate enterprise/security reasons to filter.
  • The speaker prefers DoT/DoQ because different ports can allow DNS filtering without exposing visible DNS metadata in the same way—while noting Quad9 doesn’t like censorship, and that governments may still require filtering.

7) SNI / ECH discussion (another leakage vector)

  • SNI (Server Name Indication): during a TLS handshake, observers can often see the intended hostname, even if the content is encrypted.
  • ECH (Encrypted Client Hello): encrypts handshake information further.
  • Quad9 claims:
    • No ECH implementation yet
    • Rationale: when connecting to Quad9’s known resolver IPs, observability is constrained (the claim is that SNI is less “meaningful” for their setup).
  • The speaker’s view: even if not everything is perfectly hidden, users should encrypt what you can.

8) Quad9’s security features: malware/phishing blocking

Quad9 offers blocklist-based DNS defenses:

  • On the blocking-enabled service (notably 9.9.9.9), Quad9 maintains a rotating list of ~4 million malicious domains from 35+ partners (mostly cybersecurity companies).
  • When a blocked name is queried, the resolver returns NXDOMAIN (“NX domain”) and marks the response as prohibited.

Service variants mentioned:

  • 9.9.9.9: blocking enabled
  • 99910: blocking disabled
  • 99911: includes EDNS Client Subnet (ECS) (see below)

Reported scale: about 600 million blocks/day, plus a real-time “globe” visualization.

Threat analysis approach:

  • Quad9 says it does not do deep, bespoke threat valuation like some for-profit vendors.
  • Instead, it relies on partner feeds and uses quarterly/periodic sampling approaches rather than continuous competitive-style analysis.

9) Setup/guide: changing DNS across devices and environments

The interview provides practical guidance:

  • Home/organization networks (Windows/Mac/Linux): typically via DHCP/router TCP/IP settings.
  • Quad9 provides configuration guides for Windows and Mac.
  • Android: “Private DNS” feature; Quad9 may appear on some devices.
    • Quad9 Connect app on F-Droid can add stats (optional).
  • iOS/iPadOS:
    • The speaker notes iOS hides DNS provider visibility.
    • Quad9 supports an MDM profile.
    • A suggested workaround is overriding at the home router by setting DNS to 9.9.9.9.

Router-first approach: many users are described as benefiting when admins set DNS at the router so end users “don’t notice” the change.

10) EDNS Client Subnet (ECS) & privacy-performance tradeoff

  • Quad9 describes a privacy-first default where authoritative DNS servers do not receive end-user subnet/location information.
  • ECS option (99911):
    • Leaks limited IP information (the first portion of the client IP) to authoritative servers.
    • Improves CDN/geographic selection accuracy in some cases.
    • Quad9 says it’s slightly slower because it reduces cache effectiveness by fragmenting cache entries by subnet.

Claimed use case: helpful for users far from Quad9 infrastructure (e.g., rural or island settings) where geo-accuracy may improve CDN selection.

11) DIY filtering vs Quad9’s scope

  • Quad9 does not offer “fully customizable” filtering as a product, citing cost and complexity (UI/tooling).
  • DIY alternative suggested:
    • Run your own Pi-hole / local forwarding cache
    • Configure it to forward queries to Quad9 for confidentiality plus additional local filtering.

12) VPN vs DNS: trust separation and latency notes

  • The speaker argues VPN + Quad9 can separate trust:
    • Using Quad9 for DNS may add limited meaningful leakage when traffic is behind a VPN tunnel.
  • Guidance: best approach depends on trust model and technical setup.
  • Quad9’s stance implies performance impact is likely minimal (close to major exchange points), and local caching can make resolution effectively immediate.

13) Monetization and “aggregate data” products (privacy-preserving framing)

The interview discusses Quad9’s nonprofit funding and potential revenue models that avoid end-user privacy compromise:

  • Quad9 is grant/sponsorship funded and explores sustainability.
  • Monetizable aggregate outputs proposed:
    1. Newly Observed Domains (NOD)
      • Fast discovery of newly seen domains in Quad9 telemetry.
      • Used by threat intel partners to identify newly registered/short-lived malicious domains faster.
      • Quad9 claims partner ingestion can occur within about ~15 seconds.
    2. False-positive reduction insights
      • Telemetry provided to threat intel providers about blocking events (including where/what FQDNs were blocked).
      • Also described is a “virtual block”/simulation idea to estimate impact before committing.
    3. String Similarity / Brand protection via GitHub (“String Similarle”)
      • Open-source string matching to detect lookalike/brand impersonation using confusables, phonetics, and IDN/Cyrillic/leetspeak-style variations.
    4. (Possible additional concept) “zone visibility”
      • An idea to help large DNS zone operators understand what is actually present/queried in their zones based on what gets requested via Quad9.

14) Legal/policy fight: DNS blocking lawsuits in Europe

Major events described:

  • Quad9 moved from the U.S. to Switzerland in 2021.
  • Legal pressure:
    • Sony (Germany) attempted to force DNS blocking of allegedly pirated-content domains.
    • Quad9 states courts ruled DNS blocking ineffective (DNS is treated as an “open book,” and users can switch resolvers).
  • Ongoing pressure:
    • New cases in France seeking to force Quad9 and other providers to block hundreds of sites.
    • Quad9 argues this sets a dangerous precedent by normalizing authority-driven filtering.
    • Quad9 emphasizes end-user choice: blocking is optional via service variants (e.g., 99910) or by allowing users to configure their own resolvers.

Broader EU-level possibility:

  • The speaker notes EU frameworks may exempt DNS providers in certain circumstances, but outcomes depend on court interpretation and whether cases reach EU-level decisions.

15) Organization size and business model

  • Team described as fewer than 10 people, with several contractors.
  • Staffing snapshot:
    • 1 customer support role
    • ~4 engineers
    • plus GM/business operations/grants staff
  • Operational model:
    • Quad9 reportedly avoids paying for many datacenter/network hosting resources.
    • It relies on ~200 worldwide locations where facilities are donated or provided cheaply.
    • Core bandwidth costs are described as low compared to staffing, CPU/memory, and server operations.
  • Funding:
    • Quad9 encourages donations and large donors to defend against legal actions.

Main speakers / sources

  • John Todd (Quad9) — primary interviewee, describing Quad9’s DNS, privacy/security approach, protocol choices, revenue models, and legal/policy actions.

Original video