Quad9 relies on aggregate data, anonymized source addresses, and threat intelligence partnerships to block malicious web queries worldwide. Principal Engineer Darren Kara outlined this operational framework and its unique measurement architecture on the PING podcast. While the foundation shares telemetry back to security partners to evaluate regional cyber risks, it enforces rigid data separation and anonymization. To expand its protective footprint, the platform is actively pursuing new threat intelligence collaborations across the Asia Pacific region.
Key points
Traditional DNS measurement methods like full packet captures are replaced with aggregate…: Traditional DNS measurement methods like full packet captures are replaced with aggregated and locally anonymized data.
Threat intelligence partnerships enable the platform to effectively block malicious domai…: Threat intelligence partnerships enable the platform to effectively block malicious domains without compromising individual user privacy.
Shared risk telemetry is strictly anonymized and separated to prevent leaks between diffe…: Shared risk telemetry is strictly anonymized and separated to prevent leaks between different external intelligence providers.
Sources checked by our analysis pipeline: 1
In this episode of PING, we hear from Darren Kara, a Principal Engineer at Quad9.
If you haven’t heard of Quad9, it is one of the longest-running public Domain Name System (DNS) services, with a history stretching back more than 10 years. It began as an initiative involving Packet Clearing House (PCH), IBM, the Global Cyber Alliance (GCA), and SWITCH Telecom in Switzerland. Quad9 now operates as a public-benefit, not-for-profit foundation headquartered in Switzerland
Among public DNS services from providers such as Google and Cloudflare, Quad9 stands out in two areas: Protecting user privacy and protecting users from malware and phishing.
The first goal gives Quad9 a very different approach to measurement. In other measurement environments, packet samples or complete captures, such as those used for DNS-OARC’s Day in the Life of the Internet (DITL) collection, may be available for analysis. At Quad9, information that could identify an individual user does not leave the location where it is collected. Instead, Quad9 uses aggregate data and anonymizes source addresses.
The second goal, protecting users from malicious destinations, relies on collaboration with…
The tech giant's gaming and personal computing divisions experienced widespread financial downturns during the opening quarter of its 2027 fiscal year. These pullbacks across multiple consumer-facing product categories highlight challenges in both device sales and digital gaming offerings.
An entity calling itself the Department of Peace published sensitive personnel files to limit what it characterized as harm caused by federal agencies. The incident marks the third significant breach of United States government records reported within the past month. The exposure poses acute operational risks by detailing private contact records alongside undercover, surveillance, and special operations assignments.
Researchers and computer scientists now have access to a specialized archive containing tens of thousands of academic abstracts spanning several decades. The curated repository enables precise querying to help users track foundational literature and investigate specific computational theories without manual filtering across disparate archives.