The European DNS exists,
it is free, and nobody told you.

DNS4EU is the European Union’s public DNS resolver, born from an initiative co-funded by the EU between 2023 and 2025 (project 101095329) and live as a public service since 9 June 2025. It is run by a consortium of 13 members from 10 countries led by Czech company Whalebone, which specialises in DNS security, with national registries such as CZ.NIC, national CERTs, universities and, for Italy, ABI Lab. Resolution takes place entirely within the European digital space on resolvers distributed across 14 member states, with a data controller subject to the GDPR.

Yes. The public service is free for citizens and businesses, with no registration and no contract: you set the addresses on the firewall, the DNS server or the device and it works. DNS4EU also has commercial offerings for operators, public bodies and large networks, but they are a different thing and an SME does not need them.

The protective variant (86.54.11.1 and 86.54.11.201), if you want the filter on domains already known to be malicious, or the unfiltered one (86.54.11.100 and 86.54.11.200), if you want European jurisdiction and privacy only and leave all filtering to the firewall. The ad-blocking and child-protection variants are designed for families: on a work network they break portals, marketing tools and legitimate applications.

What the market calls “Secure DNS” is a resolver with a list of blocked domains and, sometimes, a console. DNS4EU in its protective variant does exactly that, for free, with the threat intelligence of the consortium and the European CERTs. The extra functions a paid service may offer, such as category blocking, per-site or per-user policies and reports, are functions that a well-configured firewall and Intune policies already provide. Our advice is not to pay twice for the same layer and to invest instead in EDR, multi-factor authentication and backups, which stop the attacks a DNS filter cannot see.

No. In our tests from Italy DNS4EU answers with times equivalent to Google and Cloudflare, which have nodes in Italy too. DNS resolution weighs a few milliseconds on each new connection and is cached by the operating system and the internal DNS server. If a network is slow, the resolver is not the cause.

Because blocks ordered by the courts of the member states apply to every DNS4EU variant, including the unfiltered one, as the service itself states: the up-to-date registry is published in the “Legal information and compliance” section of the DNS4EU website. It is the consequence of European jurisdiction, the same one that provides the data guarantees. In our DIG tool, in comparison mode, a blocked domain appears unresolved on DNS4EU and resolved on Google or Cloudflare.

They are the two European choices by jurisdiction. DNS4EU is a European Union initiative, resolves within the EU digital space and is subject to the GDPR. Quad9 is run by a Swiss non-profit foundation based in Zurich, subject to Swiss data protection law, with Switzerland recognised by the European Commission as an adequate country. Both filter malicious domains and validate DNSSEC. A practical choice: DNS4EU as the primary resolver, Quad9 as the secondary, so the network does not depend on a single operator.

It does not sell the DNS, because it is public and free. On the networks it manages it sets it in the right place, firewall, domain controllers, Intune profiles and browser policies, checks that no device bypasses it and documents it among the security evidence, all within the support and operations contract. For those who are not customers, this page and the DIG tool are enough to do it yourself.