DNS Blocking: Why Removing Content at the Source Should Come First

A public DNS resolver is leaving France rather than blocking domain names based on user’s locations. The case shows how DNS blocking is being pushed ever further from the source of unlawful content. Examples from France, Italy, and Germany, along with findings from ICANN's SSAC, show why removal at the source should come first and why any blocking must be precise, proportionate, and transparent.

On November 24, 2026, the Swiss-based nonprofit Quad9 will withdraw its free public DNS resolver from France. A resolver is a service that translates domain names into IP addresses for Internet users. A French court has ordered Quad9 to block certain domain names for users in France, but Quad9 says it cannot reliably identify which users are located there.

The dispute concerns live sports piracy, which Quad9 says it does not condone. But it shows a problem with DNS blocking that policymakers should take seriously: It reaches far into Internet infrastructure, yet it leaves the unlawful content online. The better approach is to address the problem at its source. 

France: A resolver chooses to leave

In a case brought by the broadcaster beIN, a French court ordered Quad9 to block resolution of certain domain names for users in France. Quad9 has no user accounts and cannot determine which users are located in France. It rejects both global blocking and geoblocking, which restricts access based on user’s location, pointing to a German case in which users bypassed geoblocking by using a VPN, resulting in a fine for Quad9. An appeal in France is pending. Quad9 argues that French users, including public institutions and companies, will lose a protective service, and that illegal content should be addressed at its source. This account follows Quad9's own description of the proceedings.

Live sports piracy puts pressure on timing

A 2026 European Parliament study, "Countering online piracy of sports and broadcast in the EU," examines the legal framework, national enforcement models and technical tools against illegal live streams. Live sports piracy adds a particular challenge: The economic value of a broadcast is concentrated in the event itself, so a measure that takes effect hours or days later may no longer achieve its purpose. This is why rights holders and courts look to every point where access can be cut quickly, including DNS resolvers: Blocking by Internet service providers is already common in many countries, and rights holders argue that resolvers must follow, or users simply switch to one that does not block.

That is the strongest argument for fast blocking, and it deserves a response. Urgency can be met without moving away from the source: The hosting provider can be notified at once, while any block is narrowly scoped, limited in time and reviewed afterward.

What ICANN SSAC says, and what Italy shows

The ICANN Security and Stability Advisory Committee (SSAC) addressed the technical aspects of DNS blocking in May 2025 in SAC127, "DNS Blocking Revisited." Its core finding: DNS blocking does not change or remove the underlying content. It only obstructs access via the usual resolution path. The content can remain reachable at its original IP address or under alternative domain names, and users can bypass blocks with alternative resolvers or VPNs. If problematic content can be controlled directly, SSAC notes, the most effective response may be to remove it at the source, for example, at the hosting provider.

SSAC also examines a case from Italy. Under the Piracy Shield system, domains and IP addresses are blocked automatically to fight illegal streaming. In October 2024, the system also blocked drive.usercontent.google.com, infrastructure used by Google Drive. For several hours, users in Italy had trouble accessing files stored on Google Drive, and according to SSAC, YouTube was affected as well. The reason is structural: Domains, IP addresses, cloud platforms, and content delivery networks are shared by many independent services, so a block drawn too broadly can affect legitimate services alongside the targeted one.

Germany: The host comes first

In 2023, the Higher Regional Court of Dresden set aside rulings of the Regional Courts of Hamburg and Leipzig against Quad9 in the case brought by Sony Music Entertainment Germany, which had demanded that the resolver stop resolving certain domain names. The court classified Quad9 as a neutral intermediary and found that the plaintiff had not made sufficient attempts to proceed against the hosting provider first.

eco supported Quad9 with an expert opinion by board member Klaus Landefeld. Thomas Rickert, eco's Director Names & Numbers, was directly involved, as his law firm rickert.law represented Quad9.

Read together with the France case, a pattern emerges: Outcomes depend on whether a court treats the resolver as a neutral intermediary and whether the hosting provider was approached first.

Transparency is part of responsible blocking

If users cannot see that a DNS query was deliberately blocked, the block can look like an outage, a misconfiguration or even a cyberattack. SSAC therefore recommends Extended DNS Error codes, a standardized way for resolvers to signal that a query was blocked on purpose. It further advises checking beforehand whether a block can achieve its goal, setting up clear review processes, minimizing overblocking, and avoiding effects outside the blocking party's own administrative domain.

What should happen instead

Action should first be taken against the unlawful offer itself, as close to its source as possible. Three concrete steps follow from the cases above:

• Source first: Before a resolver or other intermediary is ordered to block, rights holders should demonstrably exhausted reasonable measures to get the hosting provider to take action.
• Review before and after: A block should be checked for suitability and scope before it is ordered and reviewed regularly afterward. The first check helps prevent cases like Italy, where shared infrastructure was hit; the later review ends measures that no longer serve a purpose.
• Visible blocking: Resolvers should be able to signal deliberate blocks, for example, with Extended DNS Error codes. Users and operators can then tell a block from an outage, and authorities can verify how measures are applied.

To check such steps against practice, eco's topDNS initiative will launch a DNS & IP Blocking Tracker in November 2026, documenting blocking measures and their documented effects across jurisdictions.

The further a measure reaches into general infrastructure, the higher the requirements for proportionality, precision and oversight must be. As Thomas Rickert puts it: "Not every technically possible block is a technically suitable block."

Lars Steffen is Head of International, Digital Infrastructures & Resilience at eco – Association of the Internet Industry (international.eco.de), the largest Internet industry association in Europe. At eco, he coordinates all international, infrastructure and security-related activities of the association and takes care of the members from the domain name industry. He is also the Vice-President of EuroISPA, the umbrella organization of European provider associations.