dns A field note by Vikrant Sharma
Quad9 blocks malware domains before your browser even tries
A DNS resolver that filters out known malicious domains at query time. No logs, no tracking, just threat intel applied at the network layer.
I have been looking at Quad9 this morning. It is a free DNS resolver that sits upstream of your requests and blocks known malware, phishing, and botnet domains before they resolve. You point your machine or router at 9.9.9.9 and it applies threat intelligence from eighteen different feeds in real time.
The interesting bit is what happens when you query a bad domain. Most security tools wait until you download something or click a link. Quad9 stops the DNS lookup itself. Your browser never gets an IP address back. The connection fails before it starts.
They do not log queries. They do not sell data. The service is run by a Swiss non-profit. That jurisdictional choice matters because Swiss privacy law is stricter than the alternatives. Cloudflare runs 1.1.1.1, Google runs 8.8.8.8, both are faster in most benchmarks. Quad9 trades a few milliseconds of latency for threat blocking.
The threat feeds come from sources like IBM X-Force and Abuse.ch. Domains get added to the blocklist when multiple feeds agree. False positives happen but the threshold is conservative. If you hit a blocked domain, the resolver returns NXDOMAIN and logs the block event without identifying you.
I like this model because it does not require installing an agent or changing how you browse. It works for every device on the network if you set it at the router level. The trade-off is you trust Quad9’s feed curation. If a domain is wrongly flagged, you see a DNS failure with no obvious cause.
Worth testing if you manage a home network or a small office. The setup is two IP addresses in your DNS config. The filtering happens transparently after that.
Source: An open DNS recursive service for free security and high privacy
