isitdns? it's always dns  until it isn't

wiki/Public DNS services/Quad9

Public DNS services

Quad9

What it is#

Quad9 is one of the DNS services you can choose instead of your provider's. It answers like any other, except that on 9.9.9.9 it answers "no such name" for names its threat lists mark as dangerous, so the device never connects. It does not block ads or adult sites.

Quad9 is run from Zürich, Switzerland, and was founded by Global Cyber Alliance, IBM and PCH (about Quad9). Its privacy policy says it keeps your address "only in volatile memory and only for the very short time (microseconds to milliseconds) necessary to service that query", and keeps counts per name looked up, with no addresses in them (privacy policy, updated 2026-06-24).

Encrypted DNS (DoH or DoT) wraps your lookups so the network you are on cannot read or change them; plain DNS does not. ECS passes a rough area of your network (not your address) to the site's DNS, so a few large sites can send you to a nearer server.

The addresses#

From Quad9's service page:

blocks threatsIPv4IPv6encrypted hostname (DoT, Android)encrypted URL (DoH)
Recommendedyes9.9.9.9, 149.112.112.1122620:fe::fe, 2620:fe::9dns.quad9.nethttps://dns.quad9.net/dns-query
With ECSyes9.9.9.11, 149.112.112.112620:fe::11, 2620:fe::fe:11dns11.quad9.nethttps://dns11.quad9.net/dns-query
No blockingno9.9.9.10, 149.112.112.102620:fe::10, 2620:fe::fe:10dns10.quad9.nethttps://dns10.quad9.net/dns-query

Set it up#

Windows 11 (Quad9's guide, Microsoft):

  1. Right-click the network icon by the clock, then Network and Internet settings.
  2. For Wi-Fi: Wi-Fi, Manage known networks, then your network. For a cable: Ethernet, then your network. Then Edit next to DNS server assignment.
  3. Choose Manual, turn on IPv4.
  4. Preferred DNS: 9.9.9.9, with DNS over HTTPS set to On (automatic template).
  5. Alternate DNS: 149.112.112.112, the same.
  6. Save.

Mac, plain DNS (Apple):

  1. Apple menu, System Settings, Network.
  2. Click your connection, then Details, then DNS.
  3. Click + under DNS Servers and add 9.9.9.9, then 149.112.112.112.
  4. OK.

For encrypted DNS on a Mac, install Quad9's profile (Quad9's guide).

iPhone and iPad (Quad9's guide):

  1. In Safari (the profile does not install from another browser), open the guide and tap the profile for 9.9.9.9.
  2. Open Settings, tap Profile Downloaded, then Install, enter your passcode, Install again.

Quad9's guide says these profiles expire on January 19th, 2027.

Android 9 and later (Google):

  1. Settings, Network & internet, Private DNS.
  2. Choose Private DNS provider hostname and type dns.quad9.net.
  3. Save.

Home router: in the router's internet (WAN) settings, replace the DNS servers with 9.9.9.9 and 149.112.112.112, and the two IPv6 addresses if it has IPv6 fields. Every device on your network then uses Quad9, as plain DNS. The router's manual names where the setting sits. Quad9 has guides for pfSense, OPNsense, OpenWrt, MikroTik and IPFire (Quad9 FAQ).

Check it works#

The check for every device, encrypted or not, is on.quad9.net in a browser. On Windows, Resolve-DnsName -Type txt proto.on.quad9.net asks the way Windows itself asks, so it runs the first check below for your own setting. The digs below are Quad9's own (Quad9 FAQ), shown asked of 9.9.9.9 directly. Run without the @9.9.9.9, dig asks the plain DNS servers the computer has, so it checks a plain DNS setup (a Mac's DNS list, or the router), not an encrypted profile.

Asks Quad9 which way the question reached it.

 dig @9.9.9.9 proto.on.quad9.net TXT
; <<>> DiG 9.20.11-0ubuntu0.2-Ubuntu <<>> @9.9.9.9 proto.on.quad9.net TXT
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23205
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;proto.on.quad9.net. IN TXT
;; ANSWER SECTION:
proto.on.quad9.net. 60 IN TXT "do53-udp"
;; Query time: 33 msec
;; SERVER: 9.9.9.9#53(9.9.9.9) (UDP)
;; WHEN: Mon Nov 02 12:42:45 CST 2026
;; MSG SIZE rcvd: 68

GO one TXT word: do53-udp or do53-tcp (plain), doh or dot (encrypted)

NO GO NXDOMAIN, which means the question did not reach Quad9

run this query in the dig tool →

what each part of this output means →

Asks Quad9 for its own test name, which its blocking refuses.

 dig @9.9.9.9 isitblocked.org A
; <<>> DiG 9.20.11-0ubuntu0.2-Ubuntu <<>> @9.9.9.9 isitblocked.org A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 46160
;; flags: qr rd ad; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; EDE: 17 (Filtered)
;; QUESTION SECTION:
;isitblocked.org. IN A
;; Query time: 239 msec
;; SERVER: 9.9.9.9#53(9.9.9.9) (UDP)
;; WHEN: Mon Nov 02 12:42:45 CST 2026
;; MSG SIZE rcvd: 50

GO NXDOMAIN with EDE 17 (Filtered): Quad9's block, as 9.9.9.9 answered it here

NO GO an address for the name: no blocking (9.9.9.10), or not Quad9

run this query in the dig tool →

what each part of this output means →

The id, the Query time and the WHEN line move on every run. EDE 17 is the Extended DNS Error code for an answer the resolver filtered (RFC 8914 section 4.18).

One more check: whether something on the path answers plain DNS in Quad9's place. 192.0.2.1 is an address set aside for documentation (RFC 5737), so no DNS server should answer there, and any answer to it came from something between you and the internet that catches DNS: a box on your network, or your provider.

dig @192.0.2.1 example.com A
  • Nothing in the way: no answer, timed out.
  • Something in the way: an answer. Something on the path answers plain DNS itself, so your 9.9.9.9 setting is not what answers. Encrypted DNS (the Windows, iPhone and Android steps above) goes past it.

What isitdns reads from it#

Quad9 is on the isitdns board twice: 9.9.9.9 and 9.9.9.10. Each card shows the live readings: whether it answered, how fast, and from where.

See also#