I noticed that Quad 9 is not able to respond to the spy.pet query:
$ dig spy.pet @9.9.9.9 +short
;; communications error to 9.9.9.9#53: timed out
But Cloudflare DNS is able to do it:
$ dig spy.pet @1.1.1.1 +short
104.26.0.165
104.26.1.165
172.67.74.73
And to be sure, I checked another domain with the same TLD to rule out the option that Quad9 is unable to handle the .pet TLD, but I received a correct answer…
$ dig hello.pet @9.9.9.9 +short
3.64.163.50
Does Quad9 censor DNS queries?
Making a DNS server not respond to queries for a specific name is trivial for any DNS provider to implemen
It might not be that easy, you’re thinking about one single server running some kind of DNS server you’re familiar with. When we’re talking about Quad9, Cloudflare etc. were talking about hundreds of servers across the planet, highly distributed solutions that rely on multicast and other non-trivial techniques. If you’ve to change a system like that to add the ability to block something, trust me, it won’t take a few hours.
It would literally be easier to add that capability to your own custom DNS server software. After all it is literally an “if query.name in blocklist then drop connection”. Even replacing results would be simple as long as DNSSEC is not involved. You wouldn’t have to add it though since all major DNS servers already include it because it is so simple and has legitimate uses, such as blocking malware control server names or ad blocking.
Yes, it is likely that most providers running custom generic or custom stacks already have the functionally built in and also yes, adding an “if” is easy but then once you’ve thousands of servers running the same piece of software across the globe deploying updates and features becomes way slower and way harder. You’ve to consider tests, regressions, a way to properly store and sincronize the blocklists across nodes etc…
