Quad9, a free DNS service that blocks malicious domains and is designed to dodge surveillance, says it has 27M users, up from 1M at launch in November 2017
Joe Uchill / Axios :
Context & Ripple Effects
Quad9 was launched in November 2017 by Global Cyber Alliance, IBM, and Packet Clearing House as a free resolver that blocks malicious domains using pooled threat intelligence while promising not to log or sell user data. Eighteen months on, it claims 27M users — a 27x jump that lands just weeks after Cloudflare's 1.1.1.1 launch turned privacy-focused consumer DNS into a contested category rather than a niche experiment.
First-order effects
- Quad9's nonprofit consortium model now operates at a scale where its threat-intelligence feeds block malware for tens of millions of endpoints, making it a meaningful distribution channel for the security data IBM and partners contribute.
- Cloudflare's 1.1.1.1 is no longer first-mover alone: it competes head-to-head with Quad9 for the same privacy-conscious consumers choosing a resolver.
Second-order effects
- Commercial DNS-security vendors face a free alternative at consumer scale even as enterprise demand grows — DNSFilter's $30M Series A two years later shows investors funding the paid tier of the same market Quad9 anchors for free.
- The volume of malicious registrations keeps rising — analyses of cybersquatted domains found a majority used for malware or fraud, and Infoblox later traced one actor registering ~75K domains — which sustains demand for blocking resolvers like Quad9 rather than commoditizing them.
Third-order effects
- DNS resolution is consolidating around a handful of large security- and privacy-forward operators, turning the resolver layer into shared infrastructure where threat intelligence pooling and consumer surveillance-avoidance are decided together.
- Quad9's trajectory mirrors DuckDuckGo's climb past 30M daily searches the same year: privacy positioning is proving sufficient to move mainstream users off incumbent defaults, a pattern likely to pressure how default resolvers and search engines are set across devices and ISPs.
The trend: Consumer internet plumbing — DNS first, search alongside it — is shifting from incumbent defaults to privacy-and-security-first alternatives, with nonprofit and commercial providers racing to own the layer.