DNS4EU: the European
public DNS, explained

Every time a company computer opens a website, sends an email or updates a program, it first asks someone “where is this name?”. That is DNS, and that someone, on most Italian networks, is Google (8.8.8.8) or Cloudflare (1.1.1.1): two excellent services, almost always chosen out of habit and never by decision. The result is that the complete list of domains the company contacts, thousands of times a day, ends up with a US company without anyone having put it in writing. Since 9 June 2025 there has been a public European alternative, free and GDPR-compliant: it is called DNS4EU.

What DNS4EU is

DNS4EU is a European Union initiative, co-funded between 2023 and 2025 (project 101095329), to give Europe a public DNS resolver of its own instead of depending on American ones. It was built by a consortium of 13 members from 10 countries led by Czech company Whalebone, which specialises in DNS security for operators: it includes national registries such as CZ.NIC, national CERTs, universities and, for Italy, ABI Lab, the research centre of the Italian Banking Association. The public service has been live since 9 June 2025 and is operated by Whalebone on an infrastructure of resolvers distributed across 14 member states.

The promises are three and they are written in the service’s documents: resolution takes place entirely within the European digital space, processing follows the GDPR with a European controller, and the service is free for citizens and businesses. In addition, the protective variants block malicious domains using the threat intelligence shared by the consortium, national CERTs included: an update that comes from an incident in Poland protects an SME in Piacenza the next day.

The five variants, and the two a business needs

DNS4EU offers five profiles, each with IPv4 and IPv6 addresses, DNS over HTTPS (DoH) and DNS over TLS (DoT). These are the addresses:

The IPv6 addresses follow the same pattern (for example 2a13:1001::86:54:11:1 for the protective variant) and the DoH endpoint is always the host name followed by /dns-query. On a business network the sensible choices are two: the protective variant, if you want the filtering layer on known threats, or the unfiltered one, if you want European jurisdiction and privacy only and leave filtering to the firewall. The ad-blocking and child-protection variants should be left to families: on a work network they break portals, marketing tools and legitimate applications, and the first ticket arrives ten minutes later.

DNS4EU, Google, Cloudflare and Quad9: the honest comparison

On speed and reliability it is a draw: Google and Cloudflare have nodes in Italy too, and in our tests DNS4EU answers with equivalent times from Italy. What changes is everything else.

Quad9 deserves an extra line: since 2021 it has been based in Zurich, it is fully subject to Swiss data protection law, and the federal authority has ruled that it is not a telecommunications service, so it has no data retention obligations. It is European by jurisdiction, not by membership of the Union, and it is the natural second choice next to DNS4EU. As we wrote about European data centres and data, the supplier’s origin is a tool to meet concrete requirements, contractual or regulatory, not a flag: if your business has those requirements, DNS is one of the easiest and cheapest places to honour them.

What DNS4EU is not

A DNS resolver is not a security solution, and DNS4EU does not claim to be one. The protective filter stops requests to domains already known to be malicious: it does not see phishing on a domain registered that morning, it does not stop an attachment, it does not block ransomware that talks to its server by IP address. It remains a useful, free layer on top of firewall, EDR and XDR and multi-factor authentication, not in their place. It is the same position we took on DNS as a protection layer: useful, but not to be sold as a product.

Two caveats that DNS4EU states openly. The first: blocks ordered by the courts of the member states apply to every variant, including the unfiltered one, and the registry of domains blocked by court order is published in the “Legal information and compliance” section of the service’s website. It is the flip side of European jurisdiction: the same law that protects the data imposes the blocks. The second: the European co-funding covered development until 2025; since then the public service remains free, but it lives on Whalebone’s commercial model towards operators, public bodies and large networks. That is not a flaw, it is a fact to know before putting it in a contract.

We have already done it: DNS4EU in our DIG

Since 14 October 2026 our online DIG tool has used DNS4EU, in its unfiltered variant, as the default resolver: every query leaves the user’s browser and reaches a European resolver, no longer Google. Alongside it are Quad9, Google and Cloudflare, and the “All (compare)” mode queries all four together. It serves two purposes: seeing whether a record has propagated everywhere, and seeing whether a domain is treated differently by a European resolver. A domain blocked by court order, for example, shows up as unresolved on DNS4EU and resolved on Google: the comparison shows it without needing an explanation. To do it we had to speak the binary DNS format directly in the browser, because DNS4EU and Quad9 do not offer the simplified APIs of Google and Cloudflare: the technical detail that almost every online tool was missing.

AtWorkStudio has operated from Piacenza, Italy, since 2000. We are certified ISO/IEC 27001, 27017, 27018 and ISO 9001, with cloud services qualified by ACN (the Italian National Cybersecurity Agency), members of Clusit (the Italian Association for Information Security) and affiliated with Confindustria Piacenza in the RICT cluster. Configuring a company’s DNS the right way is one of the things we do every week within our support and operations services.

Addresses and variants verified on the official DNS4EU website on 14 October 2026.