EU's DNS4EU: Collecting Pirate Blocklists It Never Uses — What Developers Need to Know

The DNS4EU Situation: Data Hoarding Without Action

When the European Union launched DNS4EU as an alternative to commercial DNS resolvers like Google Public DNS and Cloudflare's 1.1.1.1, many applauded the move toward digital sovereignty. The promise was clear: a European-owned DNS service that respects privacy regulations and keeps user queries within EU jurisdiction.

Then researchers discovered something interesting.

DNS4EU has been systematically collecting piracy blocklists from multiple EU member states—lists that courts have ordered ISPs to implement to prevent access to copyright-infringing websites. The resolver maintains these lists internally. But here's the twist: DNS4EU doesn't actually use them to block anything.

Why This Matters for Your Privacy

Let me break down why developers and privacy-conscious users should pay attention to this.

You're Being Listed Without Consent

When you use DNS4EU, the service knows you've queried domains that appear on these blocklists. Even if no blocking occurs, a record exists showing your IP address attempted to access a potentially pirated website. This data trail raises a fundamental question: Why collect information you're not going to act on?

For businesses and developers building applications, this sets a concerning precedent. Government-backed services collecting behavioral data "just in case" contradicts the privacy-first positioning that made DNS4EU attractive.

The Infrastructure Trust Problem

As developers, we often make trust decisions about infrastructure dependencies. We choose DNS providers based on reliability, speed, and privacy policies. DNS4EU positioned itself as a privacy-respecting alternative.

Discovering that this EU-backed resolver maintains lists of "undesirable" websites—even unblocked ones—fundamentally changes the trust calculus. What else might be on those lists? Entertainment sites? News outlets? Political content?

The Technical Reality

From a technical perspective, DNS resolvers have three choices when encountering blocked domains:

1. Return the real IP (allowing access)
2. Return NXDOMAIN (domain doesn't exist)
3. Return a sinkhole IP (redirect to a warning/block page)

DNS4EU appears to be doing option one. Your queries aren't being blocked, but the metadata about your queries is still being collected.

What Should You Use Instead?

This doesn't mean abandoning privacy-focused DNS entirely. Several options remain solid choices for developers and businesses:

• Cloudflare (1.1.1.1) — Industry leader with strong privacy policies
• Quad9 — Non-profit with malware blocking and no logging
• NextDNS — Customizable filtering with transparent logging policies

The key is reading privacy policies carefully and understanding what data your DNS provider collects—even if they never use it.

The Bigger Picture

DNS4EU's blocklist collection reveals a troubling pattern in "sovereign" internet infrastructure: the assumption that collecting more data equals more control, regardless of whether that data serves any legitimate purpose.

For developers building applications that serve European users, this serves as a reminder that privacy isn't just about where data is stored—it's about what data is collected in the first place.

The EU positioned DNS4EU as a privacy-preserving alternative to American DNS services. But hoarding blocklists without using them suggests a different agenda: surveillance capability without accountability.

If you're building for the European market and considering DNS infrastructure, make informed choices. Understand what your providers collect. Question why they collect it. And remember: data you don't share can still be data that's retained.

The irony isn't lost on anyone: a privacy-focused DNS resolver collecting lists of websites just to... have them. Sometimes the most interesting thing about a technology isn't what it does, but what it chooses not to do while still gathering the information anyway.