Google Blocks, Cisco Left, Quad9 Leaves: Public DNS Resolvers vs France's Piracy Orders

On October 21, 2026, the Paris Judicial Court ordered Quad9 to pay EUR 1,000 for every day it leaves beIN Sports' 58 pirate streaming domains unblocked, a small fraction of the EUR 580,000 a day beIN had asked for, and capped in practice at about EUR 24,000. One day later, the Swiss non-profit resolver announced it will stop serving users in France on November 24, 2026. The penalty alone does not explain the exit: about 20 similar cases are pending against Quad9 and other resolver operators, and Quad9 says it cannot survive the accumulation.

Quad9 is set to become the second public resolver to leave the country rather than filter it; Cisco's OpenDNS went first in June 2024 and has not come back. Google quietly blocks every domain the court lists. Cloudflare keeps its 1.1.1.1 resolver untouched and blocks through its CDN instead, a choice the same court declined to punish in September and October. Four resolvers, three answers to the same orders, and the split shows what happens when one country's blocking regime meets infrastructure built to serve the whole world: who blocks, who refused, who left. And in the same week the Quad9 ruling landed, according to Blast, the Prime Minister's office asked France's ISPs to be ready to use the same DNS lever against three social networks.

Why are French courts ordering DNS resolvers to block websites?

Article L.333-10 of the French sports code, in force since 2022, lets rightsholders such as Canal+ and beIN Sports ask the Paris Judicial Court for "any measure" against "any person" in a position to help stop the piracy of live sports. The first wave of orders went to French ISPs, whose default DNS servers now block pirate domains each season, with Arcom, the French media regulator, adding new mirrors as they appear. By October 2025, French reporting counted more than 5,000 blockings since January 2025.

ISP blocking has an obvious limit: it lives in the ISP's own DNS resolver. Change your device's DNS settings to a public resolver, and the ISP's list no longer applies, a workaround French sports fans traded openly. So in May 2024 the rightsholders went up the stack and obtained orders directly against the operators of the big public resolvers: Google, Cloudflare and Cisco. In March 2026 the Paris Court of Appeal upheld those orders on appeal, the first appellate validation of DNS-resolver blocking in France. Since May 2025, the same article has produced orders against VPN providers, which we track separately in our ledger of VPN site-blocking orders by country.

A definition is useful here, because the whole dispute turns on it: a public DNS resolver is a free, globally shared address book that turns domain names into IP addresses for anyone who chooses to use it, regardless of country, which is precisely why a national blocking order fits it so badly.

Who blocks, who refused, who left: the resolver table

This is the state of play as of October 29, 2026.

Of the five non-ISP resolvers ordered to block, two comply, one complies somewhere other than where the court pointed, and two chose leaving the country over filtering a global service by nationality, Cisco in 2024 and Quad9 from November 24. The resolvers split three ways, because the orders force a trade each operator weighs differently: comply and filter by nationality, refuse and absorb penalties, or leave and lose the market. Quad9 tried the second path and is now taking the third.

What does each choice look like from a French connection?

The legal filings describe obligations. This is what the choices actually produce on screen.

The second table explains a detail in the first: Google's silence. TorrentFreak's testing found Google blocks with "no notification whatsoever", so French users get no hint a court was involved. Cloudflare's HTTP 451 page, by contrast, names the order. Transparency, it turns out, is not a requirement of the orders; it is another choice each intermediary makes alone.

Why did Cloudflare escape penalties on September 17?

In April 2026, the court ordered Cloudflare to block 21 Formula 1 streaming domains and a parallel MotoGP list "by any effective means", covering the 2026 Formula 1 and MotoGP seasons. Cloudflare chose its CDN as the means and left 1.1.1.1 alone. Canal+ went back to court asking for EUR 50,000 per unblocked site per day plus the same for every new site Arcom notified, a bill French reporting put at a potential EUR 1.55 million per day, arguing that only 3 of the 21 F1 domains were actually blocked.

The court rejected every request as "neither necessary nor proportionate". Following the EU Court of Justice's UPC Telekabel line, it held that an intermediary owes reasonable measures, not a guaranteed result, and the April order had left the choice of means to Cloudflare. The same ruling cites Canal+'s own verification that 72.6 percent of the ordered domains were effectively blocked, a figure that sits unreconciled beside its 3-of-21 count; the court read the higher number as evidence of genuine effort. Sites that hop to another CDN or spin up mirrors are, the court said, for Canal+ to chase with the new intermediary and Arcom. The ruling is first instance and appealable.

The September 17 decision was not a one-off. On October 7, 2026, the same court rejected beIN's penalty requests in two parallel cases on the same reasonable-effort standard, declining to fine Cloudflare, which had blocked 3 of the 4 ordered sites through its CDN, and two VPN providers, which had blocked 6 of the 11 ordered sites through DNS on their French servers, per TorrentFreak's report of the rulings. The obligation-of-means standard protected every intermediary that had done something. Two weeks later, it cut the other way against the one that had done nothing.

Cloudflare's own transparency report, published before the September ruling, states its line plainly: "To date, Cloudflare has not blocked content through the 1.1.1.1 Public DNS Resolver." A resolver block, it argues, applies globally to everyone who uses the resolver, wherever they live. Its 1.1.1.1 for Families product does filter malware and adult content, but that is an opt-in product choice, not a legal block.

Why did Quad9 lose, and why is it leaving France?

Quad9 blocked nothing, and said so in court: its own chief technology officer attested on September 25, 2026 that none of the domains in beIN's order had been blocked at any date. That order, issued May 13, 2026 for WTA tennis streams, started at 6 domains and grew to 58 through Arcom notifications. Google and DNS4EU, the EU-funded resolver run by Whalebone, complied, per French reporting. Quad9 appealed instead, and watched beIN's demanded penalty climb to EUR 10,000 per domain per day, up to EUR 580,000 every day across the list.

Quad9's defense is architectural. Back in December 2024, facing an earlier Canal+ order, the Swiss foundation explained that it keeps no record of where its users are: "We do not have geographic blocking methods to localize the censorship activity", because the system is "designed to treat everyone in every nation identically", and that is "by design for privacy purposes". Its default 9.9.9.9 service does not even forward EDNS Client Subnet data, which it calls "a grey area of personally identifiable information". That left it three options it had named publicly: inaccurate France-only blocking based on third-party IP geolocation, blocking the domains for the entire world, or ceasing service to France the way Cisco did.

The court was unmoved. In its judgment of October 21, 2026, rendered under the accelerated procedure on the merits, the Paris Judicial Court held that Quad9's pending appeal does not suspend the May 13 order, which is provisionally enforceable. It found that Quad9 had not demonstrated that geolocated blocking is impossible, pointing out that Quad9 itself says it applies automated filtering worldwide for cybersecurity purposes, an argument in which, the court said, Quad9 appeared to contradict itself. And it reached the decisive point in one sentence: bound to an obligation of means, Quad9 states that it is implementing none, and that alone justifies a penalty. The judgment also describes Quad9's non-compliance as wilful, an "inexécution volontaire". The exact standard that saved Cloudflare and the VPN providers, reasonable measures rather than guaranteed results, sank the one intermediary that declared it was taking no measures at all.

The number, though, is small. Instead of EUR 10,000 per domain per day, the court set a single provisional penalty of EUR 1,000 per day, running from October 21 until the ordered measures expire with the last match of the 2026 WTA season on November 14, 2026. Quad9 puts the maximum at EUR 24,000. The court awarded no costs to either side and reserved the power to liquidate the penalty later.

Quad9's answer came the next day, in a blog post titled "Au revoir France": starting Tuesday, November 24, 2026, Quad9 will no longer serve users in France. It has not said exactly how it will cut off French users. It rejects blocking the ordered domains globally as "entirely unworkable", considers geoIP-based blocking technically unfit, and refuses to apply a French court order to the rest of the world. On the geoIP point it offers a concrete story from its German litigation: by Quad9's own account, Sony used a VPN to get around the geoIP blocking Quad9 had implemented there, and a German court then found Quad9 in contempt; Quad9 eventually won that case against Sony, by its own account, but the episode is why the foundation treats geographic blocking as a trap rather than a compromise.

Note the dates. The exit takes effect ten days after the penalty window closes, so leaving does not spare Quad9 this EUR 24,000; what it says it cannot survive is the accumulation. As it wrote in its announcement, it "cannot survive the accumulation of penalties yet to be assessed in 20 other pending cases, nor those of future cases similar to the one brought by beIN", and it adds that "this has never been just a financial issue: it is a matter of principle". It hopes the 30 days' notice gives French users time to choose another resolver, and it warns that people hunting for blocked content may turn to resolvers of lower trust, safety and reliability. Its appeal of the May 13 order remains pending before the Paris Court of Appeal, and it says it will keep fighting court-ordered DNS blocking, as it repeated to TorrentFreak.

Could the same DNS blocking be used on social media?

In October, the government at least prepared for it. According to Blast, which obtained the letter, Prime Minister Sébastien Lecornu wrote on October 22, 2026 to the heads of Orange, Bouygues Telecom, Iliad (Free) and Altice France (SFR), asking them to be ready to suspend access to Snapchat, TikTok and Instagram temporarily, for a few hours, ahead of the October 24 mobilization; per Blast, X was added to the list after the letter went out. The stated reason was the platforms' alleged role in the looting of October 17 and 18. Per Clubic's reading of the documents, the letter described the measure as exploratory and meant for use only in case of new riots. The government has not publicly confirmed the letter.

The method, as described in Clubic's account of Blast's documents, is the one this page has been describing all along: DNS filtering by the operators, whose resolvers would simply stop answering for those domains, with priority on mobile 4G and 5G networks. The legal reference Matignon relied on was the Conseil d'État's decision of April 1, 2025, which found the 2024 TikTok block in New Caledonia illegal while setting conditions under which such a block could be lawful.

At a videoconference on October 23, per Clubic citing Blast's minutes, the operators raised serious reservations. They could not build a mobile-only, zone-limited block at short notice; they questioned the necessity and proportionality of the measure and asked for a signed, reasoned, published legal act; and they told Matignon they could not guarantee effectiveness, because a VPN or another app would get around a resolver-level block. That last objection is the entire subject of this article, delivered to the Prime Minister's office by the ISPs themselves: a block that lives in the ISP's resolver stops at the ISP's resolver. Nothing was triggered, and October 24 passed calmly.

The episode matters here because the machinery is shared. The DNS blocking built season by season for sports piracy, with its court orders, Arcom notifications and operator resolvers, is the same lever a government can reach for in a public-order crisis, and according to Blast's reporting, one got ready to.

What does this mean beyond France?

France is the laboratory, and other countries are running similar experiments. Italy's AGCOM fined Cloudflare EUR 14,247,698.56 for keeping 1.1.1.1 out of its Piracy Shield system, and in a judgment published on July 17, 2026 the Regional Administrative Tribunal of Lazio confirmed the fine, calling the non-compliance intentional; Cloudflare says it will take the case to the Council of State. Belgium's DAZN orders pushed OpenDNS out of a second country for three months in 2025, until a Brussels court suspended the order. And the same French article that reached the resolvers reached VPN services the following year: per a Council of Europe summary, Arcom has requested 598 domains from VPN providers since May 2025. The logic of moving up the stack does not stop at any particular layer, which is why resolver operators, VPN services and privacy groups keep making the same argument: each step up blocks more users in more countries with less precision.

For a person in France, none of this makes using a public resolver or a VPN unlawful. The orders bind Google, Cloudflare, Quad9 and their peers, not the public; no French order or statute in this area penalizes a user for their choice of DNS server or for using a VPN in France. What changes is what those services are allowed to answer. Anyone who cares which answers their address book gives them can read our guide to trusted DNS servers for how resolver choice affects privacy, and the country-by-country ledger for where the orders go next.

What changes next

Several dates now frame this page. November 14, 2026, the last match of the 2026 WTA season, ends both the ordered measures and Quad9's penalty window; the court has reserved the power to liquidate the astreinte, so the final bill, at most about EUR 24,000, gets fixed afterwards. November 24 is the day Quad9 stops serving French users. Quad9's appeal of the May 13 blocking order is pending before the Paris Court of Appeal, and about 20 other lawsuits are pending against Quad9 and other resolver operators; those cases, more than any single ruling, will decide whether any non-complying resolver can keep operating in France. Any Canal+ appeal of the September 17 Cloudflare ruling would re-open the obligation-of-means question at the appellate level. In Italy, Cloudflare's announced appeal to the Council of State tests the EUR 14.2 million Piracy Shield fine. And the 2026/27 football season's orders, 14 of them signed on July 17, 2026, run to late May and early June 2027, by which time French reporting expects the current manual rounds to give way to an automated, Arcom-driven blocking pipeline.