Quad9 DNS Servers: 9.9.9.9 IPs, IPv6 & Setup Guide

What Is Quad9 DNS?

Quad9 DNS is a free public DNS resolver at 9.9.9.9 (secondary 149.112.112.112) that refuses to resolve domains known to spread malware or phishing. You point your router, computer or phone at it instead of your ISP's DNS server, and every lookup is checked against threat lists from more than 20 threat-intelligence partners before you get an answer. There's no account, no app to install and no fee.

It's run by the Quad9 Foundation, a not-for-profit foundation in Zürich, Switzerland, founded by the Global Cyber Alliance, IBM and Packet Clearing House (PCH). IBM gave the project the 9.9.9.9 address. Quad9 has been in production since August 2016, and its about page (read on 26 October 2026) lists 230+ resolver clusters in over 110 countries and an average of 670M+ blocked lookups a day.

Quad9 DNS Server Addresses (IPv4 and IPv6)

These are the addresses of Quad9's recommended service, the one most people want: malware blocking plus DNSSEC validation. Enter every one your device has room for.

All four reach the same service through anycast: your query lands at the nearest Quad9 site. Every Quad9 address we asked was answered by res700.bom2, a resolver in Mumbai (BOM is Mumbai's airport code). Quad9 asks you to add the IPv6 pair even without IPv6, since most systems ignore addresses they can't use. Microsoft's Windows docs list the second one as 2620:fe::fe:9; both answered in our test.

# Ask Quad9 directly (macOS, Linux, or Windows with BIND tools)
dig @9.9.9.9 example.com +short

# Which Quad9 site answered?
dig @9.9.9.9 id.server CH TXT +short
# "res700.bom2"

# Windows built-in equivalent
nslookup example.com 9.9.9.9

Every Quad9 Service: 9.9.9.9 vs 9.9.9.10 vs 9.9.9.11

Quad9 runs the same resolver under four sets of addresses. They differ in two switches: whether malicious domains are blocked, and whether part of your IP address (EDNS Client Subnet, or ECS) is passed on to websites' DNS servers.

9.9.9.12 is listed only on Quad9's documentation site; all four answered in our test. The DoH URL is the hostname plus /dns-query.

ECS trades privacy for speed. CDNs use your subnet to pick a server near you. Quad9 treats it as a privacy leak, so 9.9.9.9 never sends it; its docs suggest 9.9.9.11 if you don't reach a nearby Quad9 site or a site serves you the wrong region's content. Google's echo name shows the difference:

# DNS Robot's test, 26 October 2026 (our real prefix replaced with a documentation one)
dig @9.9.9.9 o-o.myaddr.l.google.com TXT +short
"2620:171:bf:f003:9999::178"           # only Quad9's own server address

dig @9.9.9.11 o-o.myaddr.l.google.com TXT +short
"edns0-client-subnet 203.0.113.0/24"   # our /24 was passed on
"2620:171:bf:f003:9999::178"

Over IPv6, 9.9.9.11 passed on a /48. 9.9.9.9, 9.9.9.10 and Cloudflare's 1.1.1.1 sent no subnet; Google's 8.8.8.8 sent a /24 too.

How Quad9 Blocks Malware (and What It Doesn't Block)

Quad9 doesn't hunt threats itself. It takes lists of malicious domains (malware, phishing, ransomware, spyware, exploit kits) from its threat-intelligence partners and updates them several times a day or in near real time. Look up a listed domain and Quad9 answers as if it doesn't exist, so your device never gets the server's address.

It doesn't block ads, trackers or adult content, has no plans for content filtering, and doesn't count spam as a threat. For an adult filter, use something like Cloudflare's 1.1.1.3.

Quad9 documents a test domain, isitblocked.org, that its blocking services refuse. In DNS Robot's test on 26 October 2026:

A block and a domain that really doesn't exist both return NXDOMAIN. The authority count tells them apart: a block has AUTHORITY: 0, a missing domain AUTHORITY: 1 (the zone's SOA record), as a made-up .com name showed in our test.

dig @9.9.9.9 isitblocked.org | grep -E "status|AUTHORITY"
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 4916
;; flags: qr rd ad; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

# The same name through the unfiltered service
dig @9.9.9.10 isitblocked.org +short
74.208.236.124

Quad9 DNS over HTTPS, TLS and QUIC

Plain DNS on port 53 can be read by anyone on the path, including your ISP. Every Quad9 service also answers over encrypted protocols:

• DNS over TLS (DoT): dns.quad9.net on port 853 (dns10, dns11 or dns12.quad9.net for the other services). This is the hostname Android's Private DNS setting needs.
• DNS over HTTPS (DoH): https://dns.quad9.net/dns-query. Quad9 began switching off HTTP/1.1 for DoH on 15 December 2025, so it needs HTTP/2 or newer; Quad9 names MikroTik RouterOS as a client that lacks it.
• DNS over QUIC (DoQ) and DoH over HTTP/3: on every Quad9 service since 31 March 2026. DoQ uses the same hostnames on port 853; clients such as Chrome upgrade to HTTP/3 on their own. Quad9 also supports DNSCrypt.

# Which protocol did Quad9 receive your query on? (do53-udp, do53-tcp, dot, doh…)
dig +short txt proto.on.quad9.net

# Windows PowerShell
Resolve-DnsName -Type txt proto.on.quad9.net

In DNS Robot's test, DoT connected over TLS 1.3 on port 853 to all four services and over IPv6, with a certificate for dns.quad9.net, and proto.on.quad9.net answered dot over TLS and doh over HTTPS. DoH over HTTP/1.1 got HTTP 505 ("requires HTTP/2"), and the JSON ?name= format that Cloudflare and Google offer returned HTTP 400: Quad9 speaks only the binary format of RFC 8484.

Encryption mostly costs time on the first lookup. A fresh DoH connection to Quad9 took a median 260 ms in total (Cloudflare 87 ms, Google 150 ms); on an open DoT connection, queries to 9.9.9.9 took a median 48 ms, close to plain DNS.

Quad9 Speed and DNSSEC: DNS Robot's Test

We timed each Quad9 address from a Jio home connection in India on 26 October 2026, alongside Cloudflare and Google: five interleaved rounds per server, each with a cached name (example.com) and a brand-new name under our own test zone. The table shows the median of five.

Cloudflare was fastest on both counts, its cached lookups all within 26–31 ms. Quad9's medians were fine but its spread was wide: single cached lookups to 9.9.9.9 and 149.112.112.112 took 316 ms and 563 ms, and one IPv6 query timed out. Google was slowest for brand-new names. Your numbers will differ, so run the DNS Speed Test from your own device before you switch.

DNSSEC: every Quad9 address validates. All of them, including the unfiltered 9.9.9.10 and 9.9.9.12, returned SERVFAIL for the deliberately broken dnssec-failed.org and brokendnssec.net, and set the ad flag on a correctly signed domain. That matches Quad9's service page; its FAQ ("two out of three" services) and its Apple profiles ("No DNSSEC" for 9.9.9.10) don't match what we measured.

Who Runs Quad9, and Is It Private?

Quad9 is operated by the Quad9 Foundation, a public-benefit not-for-profit foundation in Zürich, funded by sponsors and donations. Its privacy policy says:

• IP addresses count as personal data under the strictest of the Swiss (FADP), US and EU (GDPR) definitions, for every user, wherever they live.
• Your IP address is never stored. It stays in memory only for the microseconds to milliseconds needed to answer, and is never linked to the names you look up.
• What it keeps is counters: site, network prefix (no finer than /24 for IPv4 or /56 for IPv6) and AS number, region, query type, protocol and counts per domain name. These may be archived, but the policy says none of them contain personal information.
• Nothing is sold or shared with marketers. Threat-intelligence partners get counts for the domains they supplied, never source IPs.
• Swiss jurisdiction: Quad9 complies only with requests approved by Swiss authorities, and the Swiss surveillance service has confirmed its surveillance law (SPTA) doesn't apply to the resolver, so there's no duty to keep user metadata.

No resolver is anonymous, though: Quad9 still sees each query, and plain DNS stays readable on the path unless you use DoT or DoH.

Quad9 vs Cloudflare vs Google DNS

All three are free and validate DNSSEC. The real differences are blocking, privacy and which law each operator answers to:

Pick Quad9 for malware protection on every device and the strongest privacy terms. Pick Cloudflare if speed matters most (it was fastest from our line) or you need an adult filter. Pick Google for CDN-accurate answers, since it sends ECS. Our Cloudflare DNS and Google DNS guides cover both in the same detail.

How to Set Up Quad9 DNS

Set Quad9 on the router to cover every device on your Wi-Fi at once, or on the device itself for phones and laptops that leave home.

On Android (Private DNS)

• Open Settings and search for Private DNS (on a Pixel it's under Network & internet; on Samsung, Connections → More connection settings).
• Choose Private DNS provider hostname.
• Enter dns.quad9.net (or dns10.quad9.net / dns11.quad9.net for the other services) and tap Save.
• Open on.quad9.net in your browser to confirm it worked.

Private DNS encrypts every lookup with DoT, on mobile data too; our Private DNS guide explains what it hides.

On iPhone and iPad

• Quick, one Wi-Fi network (unencrypted): go to Settings → Wi-Fi, tap (i) next to your network, then Configure DNS → Manual. Delete the old servers, add 9.9.9.9, 149.112.112.112, 2620:fe::fe and 2620:fe::9, and tap Save.
• Encrypted, on every network: open Quad9's iOS setup guide in Safari (other browsers won't work) and download a profile (Quad9 recommends HTTPS). Then go to Settings → Profile Downloaded → Install and enter your passcode.
• Check the result at on.quad9.net.

On Windows 11 and 10

• Windows 11: open Settings → Network & internet, choose Wi-Fi or Ethernet, click Edit next to DNS server assignment and pick Manual.
• Turn on IPv4: preferred 9.9.9.9, alternate 149.112.112.112, each with DNS over HTTPS set to On (automatic template); Windows already knows Quad9's DoH address.
• Turn on IPv6 if you have it (2620:fe::fe and 2620:fe::9, DoH on), then Save. Windows' built-in DoH list has 2620:fe::fe:9 rather than 2620:fe::9, so use that as the alternate if On (automatic template) isn't offered. Laptops that roam onto networks blocking DoH may need Fallback to plaintext.
• Windows 10: press Win + R, run ncpa.cpl, right-click your adapter and open Properties → Internet Protocol Version 4 (TCP/IPv4) → Properties → Use the following DNS server addresses. Repeat for IPv6.

# PowerShell (as administrator): set Quad9 on the active adapter
$if = (Get-NetAdapter | Where-Object Status -eq 'Up' | Select-Object -First 1).Name
Set-DnsClientServerAddress -InterfaceAlias $if -ServerAddresses 9.9.9.9,149.112.112.112,2620:fe::fe,2620:fe::9
ipconfig /flushdns

# "doh" means encrypted, "do53-udp" means plain DNS
Resolve-DnsName -Type txt proto.on.quad9.net

On macOS

• Open System Settings → Network, choose Wi-Fi (or Ethernet) and click Details.
• Open DNS, click + and add 9.9.9.9, 149.112.112.112, 2620:fe::fe and 2620:fe::9. Remove old entries with –, then click OK.
• For encrypted DNS on macOS Big Sur or later, install Quad9's profile instead: download it in Safari, then approve it in System Settings.

# Terminal alternative (use "Ethernet" if wired)
networksetup -setdnsservers Wi-Fi 9.9.9.9 149.112.112.112 2620:fe::fe 2620:fe::9

# Flush the macOS DNS cache
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

On Your Router

• Open the router's admin page (often 192.168.0.1 or 192.168.1.1) and sign in.
• Find the DNS settings, usually under Internet, WAN or DHCP, and switch from automatic to manual.
• Enter 9.9.9.9 and 149.112.112.112, plus 2620:fe::fe and 2620:fe::9 in the IPv6 section if there is one. Save, then reconnect your devices.
• If your router supports encrypted upstream DNS (pfSense and OPNsense do, for example), point it at dns.quad9.net; Quad9's documentation has guides for them.

How to Check You're Using Quad9

Open on.quad9.net in a browser: it answers a plain Yes or No. Two terminal checks go further:

# 1. Did Quad9 get the query, and over which protocol?
dig +short txt proto.on.quad9.net
# "do53-udp" (plain DNS), "dot" or "doh"; no answer = not Quad9

# 2. Is your ISP intercepting queries to 9.9.9.9?
dig +short ch txt id.server @9.9.9.9
# "res700.bom2": a Quad9 resolver name. Nothing, or something else = redirected

Quad9 says some ISPs, most often in Asia, Africa and the Middle East, silently redirect queries for 9.9.9.9 to their own servers. Quad9's docs show names ending in .rrdns.pch.net; ours was the shorter res700.bom2, and proto.on.quad9.net confirmed Quad9 answered. If check 2 returns nothing or an unrelated name, switch to DoT or DoH, which can't be redirected that way. Then run our DNS Leak Test: every resolver it finds should belong to a network Quad9 uses, such as PCH (WoodyNet), Equinix or i3D, and none to your ISP.

Quad9 Not Working? Common Causes

• A site you need is blocked. Search the domain on Quad9's blocked-domain page and report a false positive to Quad9 support. Meanwhile, DNS Lookup shows the domain's real records.
• A VPN or browser overrides it. VPN apps use their own DNS, and Quad9 warns that Firefox uses Cloudflare's DoH by default in some regions. Set Quad9 in the VPN's or browser's own DNS setting.
• Your DoH client is too old. Quad9's DoH needs HTTP/2 now. Use DoT, or a forwarder such as dnscrypt-proxy, AdGuard Home or Unbound.
• Your ISP blocks a port. Quad9 also answers plain DNS on port 9953, which worked from our line. If DoT's port 853 is blocked as well, use DoH, which runs on port 443.
• Videos or downloads come from a far-away server. That can be the missing ECS: try 9.9.9.11, or 9.9.9.12 without blocking.
• Old answers after a change. Quad9 has no public tool to flush its own cache, but you can clear your device's: see how to flush DNS.