Evidence and risk■Verified evidence/△CautionMaterial claims checked against current sources.; those sources show trade-offs worth reading.
Last reviewedReviewed 25 Aug 2026KYC checked 25 Aug 2026 · verified jurisdiction · Source → official siteHow to cite this pageSource coverageVerified evidenceRecorded riskCaution
Evidence and facts
Evidence and facts
CUNICULA SCORE 4.0
37/100△Limited evidencePrivacy 12/25 · Control 0/20 · Transparency 0/20 · Security 17/25 · Accountability 8/10 · Cap 69 · Method
JURISDICTIONCH
INCIDENTQuad9.net website short outage resolved · low · since 2026-06-29 Quad9's main website was unavailable for four minutes; the official status page says all DNS nodes/services remained unaffected.Quad9 official incident history
AUDITED BYNo audit listed
OPERATOR DATAHosted operator recorded
SOURCE COVERAGE
■Verified evidenceTHIRD-PARTY REPORTED2/7Reviewed 25 Aug 2026 · Source → official site
LAST CHECKED2026-08-25
LAST UPDATED2026-06-22
Specs
DOCUMENT CHECKNone recorded
IDENTITY EXPOSURELevel 0/4
KYC TRIGGERSNo account or identity verification. Quad9 transparency materials state there is no user database and no account-to-query correlation.
FEEFree
CATEGORIESDNS
FEATURESDNS over HTTPS, DNS over TLS, Malware blocking, No IP logging, Swiss nonprofit, DNSSEC validation, No account required
TORNot listed
REGIONSGlobal availability
Review analysis, source material, related services, and history
Analysis
OVERVIEW
Quad9 is a Swiss nonprofit recursive resolver offering DNSSEC validation and malware blocking with no user accounts, and its transparency materials state there is no user database or account-to-query correlation, including by IP address.
LIMITS
Board member Philip Reitinger has a documented career across DHS, DoD and DOJ cyber roles, and IBM, described in the record as a major US national security contractor, donated the 9.9.9.9 address and supplies the X-Force threat intelligence that determines which domains get blocked.
USEFUL FOR
People wanting DNSSEC validation and malware filtering from a no-account Swiss resolver who have weighed its US-government-adjacent governance.
No identity verification is recorded for typical use. No account or identity verification. Quad9 transparency materials state there is no user database and no account-to-query correlation.
Which payment methods are accepted?
Please check the provider site for accepted payment methods.
Where is it available?
Recorded availability: GLOBAL.
Is the operator based in a Five Eyes country?
No. The recorded jurisdiction is CH, which is not a Five Eyes country. This is jurisdiction context and does not by itself establish that a service is safer or less safe.
How are identity, operator, and evidence fields reported?
Identity exposure is level 0 of 4. A hosted operator is recorded. Jurisdiction is shown as context, not a safety verdict. Source coverage is verified evidence, last reviewed 2026-08-25, and recorded risk is caution.
No changes to the document we watch since we started checking on 9 Aug 2026. Last checked 9 Aug 2026.
Evidence basis: Claims on this page are linked to published sources for comparison, not certification, audit, endorsement, or recommendation; read the methodology and coverage map before relying on an entry.
Service history
Latest meaningful changes to the facts shown on this provider page.
Corporate registry information updated
Corporate / Entity type
Corporate registry information updated
Corporate
Provider presentation updated
Best for, Evidence status, Recorded risk, Tagline, and 1 more
Full service history
updated
Reconcile score 4.0 evidence
Score assessment / Control model
hosted-account → unknown
Score assessment / Operator data exposure
moderate → unknown
Score assessment / Source model
closed → unknown
Score review
not set → Outcome: PASS; Checked at: 2026-08-25; Inputs: Operator data exposure: unknown; Control model: unknown; Source model: unknown; Audit: Score eligible: no; Reason: No dated, scoped, current audit citation was normalized in the reviewed packet; legacy auditedBy labels receive no score credit.
Free public recursive DNS from the Swiss Quad9 Foundation with malware blocking, DNSSEC and DoH/DoT/DoQ options. Quad9 says it has no user accounts and does not correlate end users, including by IP address, to resolver queries. → Free recursive DNS from a Swiss foundation with malware blocking, DNSSEC and DoH, DoT and DoQ options.
Free encrypted DNS from a Swiss nonprofit. No IP logging, malware blocking, DNSSEC. DoH and DoT. No account required. (Zero KYC) → Free public recursive DNS from the Swiss Quad9 Foundation with malware blocking, DNSSEC and DoH/DoT/DoQ options. Quad9 says it has no user accounts and does not correlate end users, including by IP address, to resolver queries.
Jurisdiction confidence
inferred → verified
KYC last checked
2026-03-08 → 2026-06-22
Kyc note
Advertises No-KYC, but strictly adhere to OPSEC rules. Access via Tor, pay with XMR. → No account or identity verification. Quad9 transparency materials state there is no user database and no account-to-query correlation.
Last reviewed
2026-03-08 → 2026-06-22
Privacy warning
Founded with IBM (US) funding. Philip Reitinger (GCA co-founder, Quad9 backer) is a former US DHS Deputy Undersecretary for Cybersecurity. Swiss incorporated — legal protection against US data demands. No logging of queries per stated policy. Caution for users with adversarial US government threat models. → Resolver operator still sits in the DNS path. Threat blocking depends on vetted third-party intelligence providers, and the existing IBM/GCA governance caveat remains relevant for adversarial threat models.
Source reviewed
older source, not independently verified → official site
not set → Founded with IBM (US) funding. Philip Reitinger (GCA co-founder, Quad9 backer) is a former US DHS Deputy Undersecretary for Cybersecurity. Swiss incorporated — legal protection against US data demands. No logging of queries per stated policy. Caution for users with adversarial US government threat models.