The 9.9.9.9 address has not changed, but the technology behind Quad9 gained two new paths in 2026. On March 31, the service enabled DNS over HTTP/3 (DoH3) and DNS over QUIC (DoQ) across its global resolver network. On June 15, it completed another change: strict DNSSEC validation became active on every service endpoint.
For anyone looking for the fastest DNS, the announcement raises an obvious question: does QUIC make Quad9 faster than Cloudflare, Google, or an ISP resolver?
The short answer is it may improve specific conditions, but it cannot guarantee a benchmark win on your connection. QUIC reduces parts of secure connection setup, protects more transport metadata, and handles network changes well. It cannot eliminate physical distance, poor peering, a cold cache, or a client that does not support the protocol.
What did Quad9 launch?
Quad9 already provided classic DNS, DNS over TLS, DNS over HTTPS with HTTP/2, and DNSCrypt. Every service variant—threat-blocking, unfiltered, and ECS-enabled—now also supports:
- DoH3: DNS messages inside HTTPS using HTTP/3 over QUIC;
- DoQ: DNS messages directly over QUIC without HTTP.
Both use QUIC as their transport. Unlike TCP, where a connection is established before a separate TLS negotiation, QUIC was designed around mandatory encryption and requires TLS 1.3. A new encrypted session can therefore reach usable state in fewer network round trips.
Classic DNS vs. DoT, DoH, DoH3, and DoQ
| Protocol | Transport | Encrypted | Main characteristic |
|---|---|---|---|
| Classic DNS | UDP or TCP | Not by default | Low overhead and universal support |
| DoT | TLS over TCP | Yes | Dedicated DNS channel on port 853 |
| DoH with HTTP/2 | HTTPS over TCP | Yes | Strong browser and port 443 compatibility |
| DoH3 | HTTP/3 over QUIC | Yes | HTTP compatibility with QUIC transport |
| DoQ | QUIC | Yes | Direct transport purpose-built for DNS |
Encryption and DNSSEC solve different problems. DoH3 and DoQ protect the query between a device and its resolver. DNSSEC lets that resolver authenticate data received through the DNS hierarchy. Since June 2026, Quad9 applies strict validation to every endpoint, including 9.9.9.10 and 9.9.9.12, which previously had exceptions.
Why QUIC can reduce DNS latency
Faster secure-session setup
A new TLS-over-TCP session generally establishes TCP first and negotiates TLS second. QUIC combines parts of those steps, and resumed sessions can require even less work.
The benefit is most visible on the first query over a new connection. Once a session is open, the difference can shrink because DoT and HTTP/2 DoH also reuse connections.
Packet loss does not have to stall every stream
With HTTP/2 over one TCP connection, a lost packet can delay multiple streams sharing that ordered byte stream. QUIC performs delivery control per stream, limiting cross-stream blocking between independent queries.
That matters more on mobile, congested Wi-Fi, and lossy access networks. On stable fiber close to the resolver, the difference may be hard to notice.
Connections can survive network changes
QUIC uses connection identifiers that allow path migration. When a phone moves from Wi-Fi to 4G or 5G, a compatible client may preserve the session instead of rebuilding everything around the previous IP path.
For mobile users, that consistency can be more valuable than shaving one or two milliseconds from an average.
Why Quad9 may not be faster for you
A modern protocol cannot move a data center closer. Real DNS performance still depends on:
- the route and distance to a Quad9 point of presence;
- ISP peering with the resolver network;
- whether the answer is already cached;
- Wi-Fi stability and packet loss;
- actual DoH3 or DoQ support in the client;
- networks that throttle or block UDP;
- CDN mapping influenced by resolver location and ECS behavior.
If a configured DoH client lacks HTTP/3 support, it can keep using HTTP/2 normally. Global server support does not force a device to adopt the new transport.
Do I need a new Quad9 address?
For DoH3, usually not. Quad9 keeps the https://dns.quad9.net/dns-query endpoint. Modern clients can discover HTTP/3 through DDR, SVCB/HTTPS records, or the Alt-Svc header. Quad9 says current Chrome and Chromium-based systems can upgrade automatically.
For DoQ, the client must explicitly support RFC 9250 and use the chosen Quad9 service hostname on port 853. Router and operating-system support varies, so check the device documentation before changing settings.
How to benchmark without misleading yourself
An encrypted DNS test needs to distinguish three costs:
- connection setup, where QUIC may have an advantage;
- queries over a reused session, which represent continuous browsing;
- full resolution, which includes resolver cache and authoritative lookups.
Use DNS Benchmark to establish how the servers available to your device behave, then follow a controlled process:
- Compare Quad9, Cloudflare, Google, and ISP DNS on the same network.
- Run separate tests on Wi-Fi and mobile data.
- Review average, P95, jitter, and availability—not only the single fastest result.
- Repeat at different hours to capture route and congestion changes.
- Confirm which protocol the client actually negotiated before crediting QUIC.
- Test browsing and streaming too, because resolver choice can change the CDN edge returned.
The app measures the resolver experience from the network in use. Protocol-specific tools or client logs complement it when the precise question is “HTTP/2 or HTTP/3?” See how to find the fastest DNS and what DNS jitter means for help interpreting the results.
Does Quad9 now block more queries?
Extending DNSSEC to every endpoint is not the same as enabling malware filtering everywhere. 9.9.9.9 continues to provide threat protection, while other variants keep their filtering and ECS choices.
What changed is that any Quad9 endpoint now returns SERVFAIL when a signed zone fails DNSSEC validation. That is deliberate: serving data whose signature cannot be verified would remove the integrity guarantee. Users who previously treated 9.9.9.10 as a non-validating diagnostic reference should account for the change.
Is Quad9 over QUIC worth using?
It is worth testing if you want encrypted queries, strict DNSSEC, and a globally distributed resolver—especially on mobile or a network with some loss. The launch still does not create one universal winner.
The best choice remains the server that, on your connection, combines low P95 latency, little jitter, high availability, a suitable privacy policy, correct DNSSEC behavior, and support for the protocol your device actually uses.
QUIC improves the available transport. A benchmark tells you whether that improvement reaches you.
