[ENHANCEMENT] Keep Quad9 in the DNS providers custom list #275

ViperTheRipper commented 2026年04月21日 15:16:58 +02:00

Confirmation Checklist

• I confirm that this feature is not already present on the latest release of Phoenix. You can check what the latest version is on the Releases page.
• I confirm that this feature has NOT already been suggested on the Codeberg issue tracker, the GitLab issue tracker, and/or the GitHub issue tracker.

I’ve noticed in recent commits that future versions of IronFox might switch to Mullvad as the default DNS provider. I would like to request that you keep Quad9 in the custom list or consider reverting the change, based on security performance benchmarks.

According to tests conducted via GRC’s DNS Spoofability tool (grc.com/dns/dns.html), I’ve observed the following:

• Mullvad DNS: Returns a "Moderate" result for Anti-Spoofing Safety.
• Quad9: Consistently achieves an "Excellent" rating.

Quad9’s robust implementation of DNSSEC across all its endpoints (except for the 9.9.9.10 testing service) provides a significant layer of protection against cache poisoning and spoofing. This makes it a highly reliable choice for users prioritizing network integrity. You can find more details on their DNSSEC implementation here: https://quad9.net/news/blog/quad9-enables-dnssec-on-all-service-endpoints/

Given IronFox's focus on privacy and security, I believe providing Quad9 as a prominent option is essential for maintaining high safety standards.

Thank you for your hard work on this project!

### Confirmation Checklist - [x] I confirm that this feature is not already present on the **latest release** of Phoenix. You can check what the latest version is on [the `Releases` page](https://codeberg.org/celenity/Phoenix/releases). - [x] I confirm that this feature has **NOT** already been suggested on [the Codeberg issue tracker](https://codeberg.org/celenity/Phoenix/issues), [the GitLab issue tracker](https://gitlab.com/celenityy/Phoenix/-/issues), **and/or** [the GitHub issue tracker](https://github.com/celenityy/Phoenix/issues). I’ve noticed in recent commits that future versions of IronFox might switch to Mullvad as the default DNS provider. I would like to request that you keep Quad9 in the custom list or consider reverting the change, based on security performance benchmarks. According to tests conducted via GRC’s DNS Spoofability tool (grc.com/dns/dns.html), I’ve observed the following: - Mullvad DNS: Returns a "Moderate" result for Anti-Spoofing Safety. - Quad9: Consistently achieves an "Excellent" rating. Quad9’s robust implementation of DNSSEC across all its endpoints (except for the 9.9.9.10 testing service) provides a significant layer of protection against cache poisoning and spoofing. This makes it a highly reliable choice for users prioritizing network integrity. You can find more details on their DNSSEC implementation here: https://quad9.net/news/blog/quad9-enables-dnssec-on-all-service-endpoints/ Given IronFox's focus on privacy and security, I believe providing Quad9 as a prominent option is essential for maintaining high safety standards. Thank you for your hard work on this project!

celenity commented 2026年04月22日 07:45:42 +02:00

Thank you for your feedback and support!

Our main concern with Quad9 is due to its domain lacking DNSSEC. While they do enforce DNSSEC resolution for sites that support it (which is great!), their address itself lacking DNSSEC is problematic, and my understanding is that weakens a lot of that protection.

So ultimately I think our default providers/resolver have to be reserved for the best of the best/highest quality options available, and I think requiring important privacy and security standards like DNSSEC is an important/necessary step in that direction. But, I can't lie - it is disappointing. Ideally, I'd prefer sticking to Quad9 - and I hope they do implement DNSSEC for their addresses so we can switch back to them in the future.

Thank you for your feedback and support! Our main concern with Quad9 is due to [its domain lacking DNSSEC](https://internet.nl/site/dns.quad9.net/3905982/#sitednssec). While they do enforce DNSSEC resolution for sites that support it *(which is great!)*, their address itself lacking DNSSEC is problematic, and my understanding is that weakens a lot of that protection. So ultimately I think our default providers/resolver have to be reserved for the best of the best/highest quality options available, and I think requiring important privacy and security standards like DNSSEC is an important/necessary step in that direction. But, I can't lie - it is disappointing. Ideally, I'd prefer sticking to Quad9 - and I hope they do implement DNSSEC for their addresses so we can switch back to them in the future.