Quad9 DNS (9.9.9.9) review: security-first, non-profit, no-log
An honest look at Quad9's malware-blocking DNS resolver — what it protects against, how private it actually is, its addresses, and how to set it up.
What is Quad9 (9.9.9.9)?
Quad9 is a free, security-focused public DNS resolver operated by the Quad9 Foundation, a Swiss non-profit. Its main address, 9.9.9.9, blocks domains known to host malware and phishing and validates responses with DNSSEC, while stating that it does not retain the source IP address behind each query.
Addresses and variants
Quad9 publishes three IPv4 configurations from the same infrastructure, plus IPv6 addresses. Pick the one that matches the behavior you want — filtered is the default and the one most people should use.
Secured (default) — malware blocking + DNSSEC
9.9.9.9 149.112.112.112 Unsecured (no filtering)
No malware blocking and no DNSSEC validation.
9.9.9.10 149.112.112.10 ECS enabled
Adds EDNS Client Subnet for CDN locality.
9.9.9.11 149.112.112.11 IPv6 (secured)
2620:fe::fe 2620:fe::9
For encrypted transport, Quad9's DNS-over-TLS hostname is dns.quad9.net and its
DNS-over-HTTPS endpoint is https://dns.quad9.net/dns-query. Most operating systems and routers
that support DoT or DoH will accept either directly.
Security: what the malware blocking actually does
Quad9's default address checks every domain you look up against threat-intelligence feeds contributed by multiple security vendors. If a domain is known to host malware, phishing, or command-and-control infrastructure, Quad9 refuses to resolve it — your device never gets an IP address to connect to, so the connection simply fails before it starts. It's a coarse but effective layer: it stops known-bad domains network-wide, on every device, without installing anything, but it can't catch a threat that never triggers a fresh DNS lookup, and any blocklist can occasionally misfire on a domain that changed hands or was recently cleaned up.
Quad9 also validates responses with DNSSEC on its secured address, which rejects DNS records that have been tampered with in transit — a layer of trust that complements, rather than replaces, the malware blocking.
Privacy: the non-profit angle
Quad9 is operated by the Quad9 Foundation, a Swiss non-profit with no advertising or data-resale business model. Its published privacy policy states that it does not retain the source IP address tied to your queries. Being a non-profit doesn't make a privacy claim automatically true, but it does remove the most common reason a free resolver would want to keep and monetize your query history in the first place — there's no ad business behind Quad9 that would benefit from it.
The default address does not send EDNS Client Subnet (ECS), meaning your rough network location isn't shared with the sites you visit for CDN routing purposes. If you specifically want that CDN-locality benefit and are willing to trade a little privacy for it, Quad9 offers a separate ECS-enabled address (9.9.9.11) rather than turning it on for everyone by default.
Who Quad9 suits
Quad9 is a strong fit if you want a set-and-forget layer of malware protection across every device on a home or small-office network — routers, smart TVs, and IoT devices included — without installing endpoint security on each one. It also suits privacy-conscious users who want a resolver run by an organization with no incentive to monetize query data. It is not the right choice if you're after ad blocking or family content filtering, since Quad9 deliberately stays scoped to security; pair it with a dedicated resolver like AdGuard DNS if ad blocking matters more to you, or compare it directly against the two most popular general-purpose options on the Cloudflare vs Google DNS page.
Pros and cons
Pros
- Blocks domains known to host malware, phishing, and other threats, using multiple threat-intelligence feeds — protection that applies to every device on your network, not just ones with security software installed.
- Run by Quad9 Foundation, a Swiss non-profit with no advertising or data-resale business model — the incentive to log and sell queries simply isn't there.
- States it does not retain source IP addresses tied to your queries, and publishes a plain-language privacy policy.
- Supports DNSSEC validation by default on its main resolver, rejecting forged DNS responses.
- Encrypted transport is available via DNS-over-HTTPS and DNS-over-TLS, so your queries aren't sent in the clear.
- Multiple addresses let you choose the exact behavior you want: filtered and validated, unsecured, or ECS-enabled.
Cons
- Malware blocking is a blunt instrument — it can occasionally flag a legitimate but compromised or newly registered domain, and it does nothing against threats delivered without a DNS lookup.
- No ad blocking or family content filtering — Quad9 is scoped to security, not general-purpose blocking.
- Its DoH endpoint doesn't expose the permissive CORS headers a browser needs to time it directly, so it can't appear in this site's in-browser speed test (see below).
- No default EDNS Client Subnet on the primary address, which is good for privacy but can occasionally mean a CDN routes you to a slightly less optimal edge server.
How to set up Quad9 DNS
Setting a public DNS resolver means entering its addresses in your device's or router's network settings, replacing whatever your ISP assigns automatically. Use 9.9.9.9 as the primary and 149.112.112.112 as the secondary, or the IPv6 pair if your network prefers IPv6. Step-by-step instructions for each platform:
- Change DNS on Windows
- Change DNS on macOS
- Change DNS on Android
- Change DNS on iPhone
- Change DNS on Linux
- Change DNS on your router
Setting it on your router applies Quad9's malware blocking to every device that connects to your network automatically, which is usually the most effective place to configure it.
Quad9 DNS — questions
What is Quad9 DNS and what does 9.9.9.9 do?
Quad9 is a free public DNS resolver, reachable at 9.9.9.9, operated by the Swiss non-profit Quad9 Foundation. It resolves domain names like any DNS server, but checks each one against threat-intelligence feeds first and refuses to resolve domains known to host malware, phishing, or other malicious activity.
Is Quad9 DNS safe and private?
Quad9 states that it does not log or retain the source IP address associated with your queries, and it is run as a non-profit with no advertising business model. As with any resolver, you are trusting the operator's stated policy — read Quad9's own privacy policy if you want the full legal detail.
Why can't I test Quad9 in the browser speed test?
Quad9's DNS-over-HTTPS endpoint doesn't send the cross-origin (CORS) headers a browser needs to time a request directly, so it can't be measured from client-side JavaScript. It can still be measured from a server-side edge test, which isn't bound by browser CORS rules — see the edge comparison on the speed test page.
What is the difference between Quad9's DNS addresses?
9.9.9.9 is the default: filtered for malware and validated with DNSSEC. 9.9.9.10 is unsecured — no filtering and no DNSSEC, useful for testing or troubleshooting. 9.9.9.11 adds EDNS Client Subnet for better CDN routing at a small privacy cost. Pick the one that matches what you want the resolver to do.
Does Quad9 make my internet faster?
Switching resolvers can shorten the brief delay before a page starts loading if your current DNS is slow, but it does not increase your download or upload bandwidth. Run the live speed test to see how Quad9's edge latency compares with other resolvers from your location.