A November ruling from the Higher Regional Court of Cologne has pushed back against efforts to force public DNS resolvers to block allegedly infringing websites. In Universal v. Cloudflare, the court rejected a request to make Cloudflare’s 1.1.1.1 resolver block a domain based on copyright claims. The outcome aligns with long-standing arguments that resolver-level blocking is both ineffective as a remedy and ill-suited for content moderation.

How DNS Resolution Works

DNS converts domain names into IP addresses so Internet traffic can be routed correctly. The system has two essential parts: nameservers (root, TLD, and authoritative) store the mapping of domains to IP addresses, while recursive resolvers query those nameservers to find where a website lives. If nameservers are the telephone book, recursive resolvers are the operator who looks up a number.

Authoritative nameservers are controlled by website operators. Recursive resolvers, by contrast, are chosen by the people browsing. A user might rely on an employer's resolver, an ISP's default, a self-hosted setup, or a public service such as Cloudflare's 1.1.1.1, Google's 8.8.8.8, Cisco's OpenDNS, or Quad9. Cloudflare launched 1.1.1.1 in April 2018 as a fast and private option. Users can switch between resolvers at any time.

What Resolver Blocking Actually Does

A resolver can prevent access to a site by declining to return its IP address — the equivalent of removing a listing from a phone book. But this is not removal of content: the site remains online and reachable through other routes. A user can switch resolvers, operate their own, or type the IP address directly.

Because DNS works at the domain level, blocking via a resolver affects every resource on that domain. There is no way to block a single page, image, or subdomain without making the entire site inaccessible. That poses a problem for sites hosting user-generated content or material from many contributors: a narrow infringement claim could justify blocking the whole domain, including content never identified by a court as unlawful.

DNS blocking is also opaque. When a resolver simply fails to return an address, the user gets no explanation. There is no error message telling them the site was blocked or under what legal authority. Although protocols have been proposed that could return such a notice, none have been implemented.

Public Resolvers Differ From ISP Resolvers

ISPs that serve a particular jurisdiction have used DNS blocking to comply with local court orders. A German ISP, for example, can block a site for its German users. Public resolvers, however, operate worldwide. A block applied through one would take effect in every country where the resolver is used unless geographic filtering is applied.

Attempting to apply geo-targeted blocking requires knowing where individual requests originate. That obligation collides with the design goals of services like 1.1.1.1, which was built to avoid collecting personal information about users' queries. Many DNS operators have historically monetized such data; 1.1.1.1 was intended to prevent that data from ever being gathered. Court-ordered blocking for public resolvers would demand the collection of location data to avoid global overblocking, with clear privacy implications.

The Ineffectiveness of Public Resolver Blocking

If a website is blocked by legal order, three expectations are reasonable: the blocked content is genuinely unlawful, the block targets only that content and not unrelated material; the user is informed of the block and its legal basis; and the measure actually works.

Public resolver blocking misses on all three. A resolver block sweeps in an entire domain, regardless of how much of it was found unlawful. Since the resolver operates globally, an order from one court can determine what users in other jurisdictions can access — absent data collection that itself raises concerns. The user sees no explanation, only a failed lookup, making it difficult for the public to scrutinize overreaching or mistaken blocks.

Most importantly, a DNS block does not reliably suppress content. If a site operator or host takes down the infringing material directly, the material is gone. With a resolver block, the content stays available online, and any user who changes resolvers or types in the IP address can reach it again without difficulty.

What the Cologne Court Decided

Despite these limitations, rightsholders have continued to seek blocking orders against public resolvers. Cloudflare, Quad9, and Google have opposed such requests. The Cologne decision is the first appellate ruling in Europe on public resolver blocking in main proceedings — earlier cases produced only preliminary rulings.

The case originated in 2019, when a copyright holder sought to block a website hosting an allegedly infringing music album. At filing, the site used Cloudflare's pass-through security and CDN services. The Cologne Regional Court issued a preliminary order requiring Cloudflare to block the site both through its CDN and through 1.1.1.1. Cloudflare has no mechanism for blocking websites through its public resolver and has never done so. It did, however, act to block access to the website in Germany through its CDN and security services. The website subsequently went offline entirely. Cloudflare continued to litigate the broader legal questions.

The Higher Regional Court found that public DNS resolvers are not an appropriate mechanism for addressing online infringement. In the court's words, the resolver provides “a tool that is accessible to everyone free of charge, is in the public interest and is approved, and which participates purely passively, automatically and neutrally in the connection of Internet domains.” The court also observed that blocking is ineffective because users can easily change resolvers.

The court further determined that DNS services fall under the EU's Digital Services Act (DSA). Like the earlier e-Commerce Directive, the DSA draws distinctions among service types and applies different obligations to "mere conduit" and "caching" services versus "hosting" services. The DSA explicitly lists DNS and CDN services as non-hosting services, and the court recognized that DNS resolvers should receive the liability protections afforded to mere conduits. The request for DNS blocking was denied.

CDN obligation remains a sticking point

The DNS ruling is not the only part of the decision. The Higher Regional Court also upheld the lower court's order requiring Cloudflare to block access to the infringing website through its CDN and pass-through security service. That portion of the judgment has no immediate practical effect — the site in question is already offline and Cloudflare was already in compliance — but the legal reasoning is what worries us.

If the decision is read to impose a broader obligation on pass-through security and CDN services to police online content, that would contradict both the technical nature of those services and the EU's Digital Services Act, which explicitly treats CDN services as caching services covered by a liability privilege. Because of that, Cloudflare intends to appeal the CDN-related part of the ruling.

What this means for the broader fight

Rightsholders have filed similar blocking lawsuits against other DNS providers and in other jurisdictions, so this decision is one battle in a larger campaign. We will keep pushing back against those efforts publicly and in court, on the grounds that they are bad for the Internet. The court's technical reasoning on DNS should help persuade other judges considering the same question.

We also recognize the effort that went into this case. The judges took the time to understand how the Internet actually works and to weigh that understanding against the public benefits of a secure, reliable, and private network. That approach matters. The goal is to ensure that copyright enforcement remains consistent with the technical reality of different Internet services, and with legal principles of due process, transparency, and proportionality. This decision is progress toward that goal. The fight continues.