149.112.112.112: Quad9 secondary

149.112.112.112 is the secondary address of the Quad9 public DNS resolver. It provides the same threat blocking and DNSSEC validation as 9.9.9.9, but the address belongs to Packet Clearing House rather than to the block Quad9 uses for its primary, so the two sit in unrelated prefixes.

Why the address looks nothing like the primary

Most resolver pairs are cosmetically related, because one company holds both blocks. Quad9 was assembled from contributions. IBM Security supplied 9.9.9.0/24 at launch in 2017. Packet Clearing House, the non-profit that runs anycast infrastructure for internet exchange points and for a large share of the world’s ccTLD authoritative servers, supplied both the global server footprint and 149.112.112.0/24.

The result is a pair that no BGP problem is likely to break at the same time. A whois lookup on the two addresses returns different organisations, which surprises people who assume a mismatch means a misconfiguration.

What it does

Behaviour matches 9.9.9.9 exactly:

• Recursive resolution with DNSSEC validation.
• NXDOMAIN for domains on Quad9’s threat intelligence blocklists, with no warning page.
• No EDNS Client Subnet, so authoritative servers do not learn your network prefix.
• No ad, tracker, or adult content filtering.

The parallel unfiltered address is 149.112.112.10, and the client-subnet variant is 149.112.112.11.

When you see it

The address appears wherever Quad9 is configured: the alternate DNS field on router admin pages, the second nameserver line in /etc/resolv.conf, DNS lists in ipconfig /all, and hardening guides from national cyber security centres. Because stub resolvers usually try the first configured address first, sustained traffic to 149.112.112.112 in a firewall log is a hint that 9.9.9.9 is timing out somewhere on the path.

Setting it up

1. Windows and macOS: 9.9.9.9 as preferred, 149.112.112.112 as alternate.
2. Linux: both on separate nameserver lines, or in the DNS= directive of resolved.conf.
3. IPv6: 2620:fe::fe and 2620:fe::9. There is no IPv6 address in the 149.112 range.
4. Encrypted: use the hostname dns.quad9.net for DNS over TLS or https://dns.quad9.net/dns-query for DoH, which covers both IPv4 addresses.

Privacy and policy

The Quad9 privacy policy applies to every address the service runs, including this one. Quad9 states that it does not store client IP addresses, keeps aggregate query data with city-level geography for capacity and threat research, and shares only aggregates with its intelligence partners. The Quad9 Foundation is registered in Zurich and operates under Swiss data protection law.

Packet Clearing House operates the machines in many locations but the policy that governs the data is Quad9’s.

What it is not

149.112.112.112 is not a separate service you can sign up for, and it is not a PCH resolver in its own right. It is also not a fallback that skips blocking: if a domain is blocked on 9.9.9.9, it is blocked here too, so switching between the pair will not get a filtered site to load. Use 9.9.9.10 if you deliberately want an unfiltered Quad9 answer, or compare resolvers side by side in /dns-lookup.