Quad9 combines privacy-preserving measurement with threat intelligence from providers around the world to help prevent users from reaching known malicious websites. In an episode of the PING podcast, Principal Engineer Darren Kara discusses how the public DNS service manages that balance.
Quad9 has operated for more than a decade. It began as an initiative involving Packet Clearing House, IBM, the Global Cyber Alliance and Switzerland’s SWITCH Telecom, and is now run by a public-benefit, not-for-profit foundation headquartered in Switzerland.
Unlike measurement projects that may analyze packet samples or full traffic captures, Quad9 keeps information that could identify users at the location where it is collected. The service instead relies on aggregated data and anonymized source addresses.
Threat intelligence feeds help Quad9 identify malicious destinations and block DNS queries that would direct users to them. The service can also share information with intelligence providers to help improve their signals and clarify risks in different regions. That exchange requires safeguards so end-user details are not exposed and one provider’s intelligence is not revealed to another.
Kara also discusses Quad9’s architecture, management and measurement practices. He says the service is interested in building stronger collaboration with threat intelligence organizations in the Asia-Pacific region to improve coverage for the wider community.
Sources: APNIC Blog.