On Wednesday 21 October the Third Chamber of the Paris Judicial Court ordered Quad9, a Swiss non-profit foundation, to stop resolving a set of domain names for users located in France. The applicant was beIN, the Qatari broadcaster, and the underlying complaint was unlicensed tennis streams. The penalty is €1,000 per day, far below the €580,000 per day beIN asked for. The following morning Quad9 announced it is leaving France altogether on 24 November rather than comply.
The coverage has been about whether a resolver should be made to lie. That argument is worth having, and Quad9 makes it well. We were interested in the quieter question underneath it: the order applies to users located in France, so we tried to work out what that phrase costs to implement. France is not one country code, the registries do not agree with each other, and the machine writing this article has its DNS resolved in Paris.
TL;DR
- The order covers metropolitan France, the overseas departments and regions and Saint-Pierre and Miquelon, but explicitly not French Polynesia, New Caledonia or Wallis and Futuna. That is 9 ISO country codes in scope and 3 out.
- Obeying it means classifying 82,288,720 IPv4 addresses correctly while excluding 240,640 that are equally French. 701,952 in-scope addresses (2,742 /24s) and 41 autonomous systems are not coded FR by any registry.
- French address space is administered by all five regional internet registries. APNIC sits on both sides of the line the court drew.
- We asked two of the registries’ own published datasets what country 20 resolver egress addresses are in. They disagreed about 7 of them.
- From a German server, 16 of 16 probes to Cloudflare’s resolver were answered in Paris. Of 20 reachable resolvers, 4 do not validate DNSSEC and one of those sets the Authenticated Data flag anyway.
What the court actually ordered
The ruling is case RG 26/11882, issued 21 October 2026, building on an earlier decision of the same chamber, 26/02207. Quad9 says roughly twenty further actions are pending against it and other resolver operators in France, each demanding blocks on hundreds more names.
Two details matter more than the money. The first is that the territorial scope is enumerated rather than assumed. As reported by heise, it reaches France’s overseas territories, regions and departments and names Saint-Pierre and Miquelon specifically, while excluding French Polynesia, New Caledonia and Wallis and Futuna. Somebody drew a line through the French Republic.
The second is the arithmetic in Quad9’s own notice. The penalty accrues at €1,000 per day until the blocking period concludes on 14 November, which the foundation totals at €24,000. Its departure is set for 24 November. Quad9 is therefore paying the fine in full and leaving ten days after the injunction it refuses to obey has expired. That is not a response to this order. It is a response to the twenty behind it.
We counted France
Every regional internet registry publishes a delegated-extended statistics file listing every allocation it has made, with an ISO 3166-1 country code attached. They are free, unauthenticated and updated daily. We pulled all five, filtered to the thirteen country codes that cover French Republic territory, and sorted them into the court’s two buckets.
| Code | Territory | IPv4 addresses | /24s | ASNs | Registry |
|---|---|---|---|---|---|
| FR | Metropolitan France | 81,586,768 | 318,698 | 1,897 | RIPE NCC, ARIN, APNIC |
| RE | Réunion | 409,856 | 1,601 | 5 | AFRINIC, RIPE NCC |
| MQ | Martinique | 134,656 | 526 | 8 | ARIN, RIPE NCC |
| GP | Guadeloupe | 124,928 | 488 | 10 | ARIN, RIPE NCC |
| GF | French Guiana | 22,528 | 88 | 7 | LACNIC |
| PM | Saint-Pierre and Miquelon | 4,608 | 18 | 1 | ARIN |
| MF | Saint Martin | 3,584 | 14 | 6 | ARIN |
| YT | Mayotte | 1,024 | 4 | 1 | AFRINIC |
| BL | Saint Barthélemy | 768 | 3 | 3 | ARIN |
| In scope, total | 82,288,720 | 321,440 | 1,938 | All five | |
| NC | New Caledonia | 161,536 | 631 | 19 | APNIC |
| PF | French Polynesia | 75,520 | 295 | 6 | APNIC |
| WF | Wallis and Futuna | 3,584 | 14 | 1 | APNIC |
| Out of scope, total | 240,640 | 940 | 26 | APNIC | |
A resolver trying to obey this order cannot look up one country code. It must get 701,952 addresses and 41 autonomous systems right that no query for FR will ever return, spread across four registries other than the one that serves Europe, and it must simultaneously exclude 940 /24s that are just as French. The obvious shortcut, treat APNIC space as out of scope, fails immediately: APNIC also administers 12,288 addresses coded FR. The registry that holds every excluded territory holds in-scope space too.
The thirteenth code, TF for the French Southern Territories, holds no address space at all. A court order can cover territory that the internet has never had a reason to number.
The registries do not agree with each other
That is the easy half. The harder problem is that the data is not consistent with itself, and we found that out by making the mistake first.
We geolocated our twenty resolvers by the country code in the delegated-extended files, and the result said Control D answers from France. The RIPE database record for the same address says Germany, and the network is named CDNEXT-FRA, where FRA is the Frankfurt airport code rather than the country. Our own instrument had made exactly the error the post is about.
So we ran it properly: for each resolver egress address, the country code in the registry’s bulk statistics file, against the country: attribute on the most specific registry object covering the same address. Two published datasets, same registries, same day.
| Resolver | Egress address | Stats file | Registry object | Network name |
|---|---|---|---|---|
| AdGuard (filtering) | 84.17.46.77 | GB | NL | CDN77_AMS_DC1 |
| AdGuard (unfiltered) | 185.229.191.160 | GB | NL | CDN77-AMS-IPv4-x |
| DNS4EU (both) | 2a02:6ea0:c78f::1 | GB | DE | FRA-CDN77-IPv6-1 |
| Control D | 212.11.62.131 | FR | DE | CDNEXT-FRA |
| CleanBrowsing | 95.179.253.118 | US | DE | NET-V4-95-179-128-0-17 |
| DNSPod | 162.62.62.110 | SG | DE | ACEVILLEPTELTD-SG |
Seven of twenty egress addresses got two different countries from two authoritative sources. Four more returned no registry object at all. The DNS4EU case is the one worth sitting with: the European Union’s own sovereign resolver project egresses from an address that the bulk statistics file codes to the United Kingdom, that the registry object codes to Germany, and that is named for Frankfurt.
None of these organisations has done anything wrong. Address space is allocated to a company, the company’s registered country goes on the allocation, and the hardware sits wherever the anycast footprint needs it. That is normal, and it is also the complete answer to whether an IP address tells you which country someone is in. If the registry cannot agree with itself about where a server is, nobody should be ordering a foundation to work out where a user is on pain of a daily fine.
Where your DNS is actually resolved
We ran the panel from a server in Nuremberg, Germany. Cloudflare’s resolver names the instance that answered, via a CHAOS-class query for id.server. We asked sixteen times across 1.1.1.1, 1.1.1.2 and 1.1.1.3.
Every single answer came from Paris: instances cdg01, cdg07, cdg08, cdg09, cdg13, cdg14, cdg15 and cdg17. Sixteen of sixteen, eight distinct Paris machines, zero answers from anywhere else. A German machine’s name resolution is performed in France. Google, measured the same way over fifteen probes using its published egress-to-location map, answered from Frankfurt twelve times and Zürich three times: two countries, no notice, no configuration change.
The second direction is the one that matters legally: if a German query can be served from Paris, a French query can be served from Frankfurt or Madrid. Anycast decides which machine answers you, and that is a property of the internet’s topology on the day, not of your passport. Our twenty resolvers answered from seven different countries, and not one was the country we were sitting in.
What else the twenty disagree about
We probed 23 resolver addresses in total; 20 answered. They differ in ways most teams never check.
DNSSEC validation. We queried two deliberately broken test domains, dnssec-failed.org and brokendnssec.net, three times each. A validating resolver must refuse to answer. Sixteen of twenty returned SERVFAIL every time. Four returned the address: CleanBrowsing, Comodo Secure DNS, DNSPod and Yandex DNS, six times out of six. Three of the four are at least honest about it and leave the Authenticated Data flag clear. Yandex does not: it sets the AD flag on a signed domain while serving answers for three separate domains whose signatures do not verify. If you have signed your zone, as we have argued you should when we looked at certificate authority authorisation records, note that the protection is delivered by your user’s resolver, not by you. For a fifth of these resolvers it is decorative.
Subnet leakage. EDNS Client Subnet is how a resolver tells every authoritative nameserver it queries roughly where you are. Nine of twenty send one, and four of those send our true /24. Cloudflare sends a /24 with the third octet zeroed, disclosing our /16 but not our street. Eleven send nothing at all, Quad9 among them, which is the technical substance of its claim that it cannot locate its users.
Those two findings are the same finding. The resolvers that propagate a client subnet are the ones already in the business of knowing where you are, and a court order of this shape is far easier for them to satisfy. Capability to comply and willingness to leak are the same property. Quad9 has spent nine years engineering the property away, and has now been fined for not having it.
The referral chain now ends in France
When we wrote about who actually chose your DNS resolver in September, the argument was that free public infrastructure fails in ways you find out about late. Three measurements from this week make the point better than the argument did.
dns0.eu, the European non-profit resolver that ran 62 servers across 27 European cities, is not merely closed. The domain is NXDOMAIN at the .eu registry’s own nameservers. Its autonomous system, AS50902, is still registered to “DNS0EU DNS0.EU A.D.” and announces nothing. Its anycast prefix 193.110.81.0/24 was last seen in the global routing table on 14 January 2026 and is visible today to 0 of 164 RIPE routing collectors. When it closed it pointed its users at DNS4EU or NextDNS.
Mullvad announced on 3 September that its public encrypted DNS shuts down on 2 November 2026, and that Mullvad Browser users on the default configuration will be migrated automatically to Quad9, which it will sponsor instead. That is a good decision, made for good reasons.
Put the dates together. A French Mullvad Browser user on defaults is moved onto Quad9 on 2 November. Quad9 stops answering French users on 24 November. The automatic migration buys them twenty-two days. Nobody made a mistake here. Three organisations each made a reasonable decision, and the composition of those decisions leaves a user who chose privacy deliberately with a resolver that will not answer them, and no notification that explains why.
Who is actually affected
Quad9 published a partial list of the French networks it serves. We parsed it: 68 distinct autonomous systems announcing 5,468,416 IPv4 addresses across 479 prefixes. It includes the Prime Minister’s digital directorate, France Travail, the CEA, the Institut Pasteur, fifteen RENATER networks carrying the national research and education community, EDF, SNCF, a Marseille university hospital group, Thales, IDEMIA, and Stormshield, a cybersecurity vendor whose products are ANSSI-qualified.
What to do with this
Stop treating a country code as a location oracle. If anything in your stack makes a legal, billing, tax or access-control decision from an IP-to-country lookup, it is wrong at a rate you have never measured. The registry disagrees with itself about 7 of the 20 addresses we checked, and we have given you the method to check your own.
Resolver choice is a supplier decision with a jurisdiction attached. Name the resolver for each environment: production hosts, container images, CI runners, office network, every client estate you are on the hook for. Then write down which country’s courts can reach it. If the answer for CI is “whatever the provider set in 2021”, that is the finding.
Validate signatures yourself if it matters. Four of twenty popular resolvers will hand your users a forged answer without complaint, and one of them will mark it authenticated. If you have DNSSEC in a compliance document, either run a validating resolver you control or stop claiming the control.
REPTILEHAUS builds and audits infrastructure for teams who would rather find this in a review than in an outage, and the resolver panel in this article took an afternoon. If you cannot name the resolver your production build pipeline uses, or you have a geoIP decision in your stack that nobody has ever tested, get in touch and we will start there.
Method and limits
Measured on 23 October 2026 from one server in Nuremberg, Germany. Address figures come from the delegated-extended statistics files of all five regional internet registries, counting only records marked allocated or assigned. Resolver probes used dig; egress and client-subnet behaviour were read from Akamai’s whoami.ds.akahelp.net record.
Three limits worth stating. First, one vantage point: our Paris and Frankfurt results describe where this machine’s queries land, not where yours do. Second, we initially used a third test domain for DNSSEC and dropped it, because Cloudflare returned SERVFAIL for its valid control name in two of five runs, which makes the domain unreliable rather than Cloudflare broken. Third, the whoami record returns both an ip and an ns field, and only ns is the resolver’s egress; the ip value sits inside the client-subnet prefix and briefly convinced us Cloudflare was answering from our hosting provider’s range. Quad101 refused UDP from our vantage point but answered over TCP, so we report it filtered rather than down.
We have not read the judgment itself. The territorial scope is as reported by heise online from the ruling.
📷 Photo by Annie Spratt on Unsplash
