Skip to content

Mark Quad9's unfiltered upstream as validating DNSSEC - #3284

Merged
DL6ER merged 1 commit into
developmentfrom
fix/quad9-dnssec
Oct 23, 2026
Merged

DL6ER merged 1 commit into
developmentfrom
fix/quad9-dnssec

Conversation

@DL6ER

@DL6ER DL6ER commented Oct 23, 2026 •

Copy link
Copy Markdown
Member

What does this implement/fix?

Quad9 validates DNSSEC on all of its service endpoints now, including the unfiltered 9.9.9.10 set (see their service addresses page). The upstream list FTL hands to the web interface still labeled it "no DNSSEC".

The installer list and the docs carry the same label and are fixed in pi-hole/pi-hole#6740 and pi-hole/docs#1442.

How to test the change during review

  1. dig @9.9.9.10 dnssec-failed.org returns SERVFAIL and dig @9.9.9.10 isc.org carries the ad flag. The same holds for 149.112.112.10, 2620:fe::10 and 2620:fe::fe:10.
  2. Settings -> DNS lists "Quad9 (unfiltered, DNSSEC)".

The name is a display label only, nothing matches on it, so there is no test change.

Additional information

Related issue or feature (if applicable): Fixes #3280

Pull request in docs with documentation (if applicable): pi-hole/docs#1442


By submitting this pull request, I confirm the following:

  1. I have read and understood the contributors guide, as well as this entire template. I understand which branch to base my commits and Pull Requests against.
  2. I have commented my proposed changes within the code.
  3. I am willing to help maintain this change if there are issues with it later.
  4. It is compatible with the EUPL 1.2 license
  5. I have squashed any insignificant commits. (git rebase)
  6. My change does not modify src/dnsmasq/. That tree is a verbatim copy of upstream dnsmasq and we do not carry anything in it that deviates from upstream. Fixes have to go through the dnsmasq-discuss mailing list first, we merge them once they are in dnsmasq master.

Checklist:

  • The code change is tested and works locally.
  • I based my code and PRs against the repository's development branch.
  • I signed off all commits. Pi-hole enforces the DCO for all contributions
  • I signed all my commits. Pi-hole requires signatures to verify authorship
  • I have read the above and my PR is ready for review.

Quad9 validates DNSSEC on all of its service endpoints, including the unfiltered `9.9.9.10` set, so the "no DNSSEC" label in the upstream server list is wrong.

Signed-off-by: DL6ER <dl6er@dl6er.de>
@DL6ER
DL6ER requested a review from a team as a code owner October 23, 2026 17:36
Copilot AI balanced review requested due to automatic review settings October 23, 2026 17:36

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

@DL6ER
DL6ER merged commit 6867184 into development Oct 23, 2026
18 checks passed
@DL6ER
DL6ER deleted the fix/quad9-dnssec branch October 23, 2026 18:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants