France DNS block: 4,349 sites already cut, TikTok was next

Short answer: Yes, France prepared a DNS block of TikTok, Instagram, Snapchat and X for the October 24 protests. Prime Minister Sébastien Lecornu's letter of October 22 told Orange, SFR, Free and Bouygues Telecom to be ready to cut them "sans délai". It was never switched on. But the machine it would have used is already running: we parsed the block list of DNS4EU, the EU-funded public resolver, and found 4,349 domains blocked on French orders, 97.9% of the entries from Paris court cases, and 98.2% of them blocked even when we asked from a US IP.

TL;DR: The same week Lecornu's letter went out, a Paris court pushed Quad9 out of France over sports piracy blocks, and Quad9 says it will stop serving French users on November 24 rather than lie about DNS answers. One football ruling we read named 21 domains; the block list built on it now holds 809, a 38x jump with no new judge. Meanwhile 3,618 of the 4,349 blocked names (83.2%) still resolve on Cloudflare's 1.1.1.1, every public resolver we tested answered TikTok, Instagram, Snapchat and X, and French Wikipedia views of the VPN page ran 2.8x their normal level before the leak even broke.

Key numbers

What	Number	Source, checked Oct 25 2026
Apps Lecornu told the 4 big carriers to be ready to cut	TikTok, Instagram, Snapchat (+ X added later, per Blast)	AlloForfait, letter of Oct 22
Unique domains on the DNS4EU court-order block list	4,349 (4,685 entries)	DNS4EU registry, our parse
Entries that come from Paris court cases	4,589 of 4,685 (97.9%)	DNS4EU registry, our parse
Blocked names sinkholed when we asked from the US	4,271 of 4,349 (98.2%)	Tensorust DNS census, 8,698 queries
Blocked names that still resolve on 1.1.1.1	3,618 (83.2%)	Tensorust DNS census
Blocked names that are already dead (NXDOMAIN)	506 (11.6%)	Tensorust DNS census
LFP football ruling: domains named by the judge vs listed now	21 vs 809	Paris court RG 26/07694
Quad9 daily penalty, before and after the court cut it	EUR 580,000 to EUR 1,000	Quad9, Oct 22
French Wikipedia VPN page, daily views Oct 1-16 vs Oct 22-24	89.5 vs 251.7 (2.8x)	Wikimedia pageviews API

Lecornu's letter asked for a TikTok kill switch with no law attached

The letter is dated October 22 and went to four CEOs: Christel Heydemann (Orange), Benoît Torloting (Bouygues Telecom), Thomas Reynaud (Iliad, which owns Free) and Arthur Dreyfuss (Altice France, which owns SFR). Blast published it on the evening of October 24.

It asks the carriers to "anticiper dès aujourd'hui" the technical work so they can suspend Snapchat, TikTok and Instagram "sans délai" and "pour une durée de quelques heures" if Matignon gives the word. The method was spelled out: filter the apps' domain names in DNS, mobile first, home fibre spared "dans la mesure du possible". Blast says X was added after the letter went out.

DNS (the internet's phone book) is the step where your phone asks "what address is tiktok.com?". Your carrier runs the default phone book. Delete the line there and the app cannot find its servers, while the rest of the web keeps working.

The letter cites no legal basis. According to the meeting notes Blast saw, carrier lawyers spent a 70-minute video call on October 23 telling the government they could not do zone-by-zone mobile blocks on short notice, that a VPN or another messaging app would get around it, and that they could not promise it would work. The government's answer, per AlloForfait: an individual instruction to each carrier would do, no Journal officiel. Clubic confirms nothing was actually switched off.

Read that again. A prime minister asked for a secret, lawless, few-hours shutdown of four of the biggest social apps in France, during a protest. The only reason it did not happen is that the protest stayed calm. That is not a safeguard. That is luck.

The kill switch is not new. It has been running on football for months

Here is the part nobody is connecting. France did not need to invent DNS blocking for TikTok. Its courts have been ordering DNS providers to block sites all year, mostly for sports rights holders, and the list only grows.

The cleanest place to see it is DNS4EU, the EU-backed public resolver (EU project 101095329) that Whalebone, a Czech company, operates. DNS4EU publishes its full court-order registry, and its setup page says plainly that "court-ordered domain blocks apply to every variant", including the one it sells as "unfiltered". We parsed every entry.

The registry holds 9 orders and 4,685 entries covering 4,349 unique domains. Seven of those orders are Paris Judicial Court cases, and they account for 4,589 entries, or 97.9%. The rest is 79 Russian state media domains under the EU sanctions regulations and 17 porn sites under ARCOM's age-verification decree. The single biggest order, Paris case 25/13713 from December 18 2025, alone accounts for 1,675 entries.

So when people say "France would never block social media", the infrastructure says otherwise. The pipes, the lists, the court habit and the carrier compliance teams all exist. Lecornu just asked to point them at TikTok.

21 names in the ruling, 809 on the list: who keeps adding them?

We read one of the rulings in full. Case RG 26/07694, decided July 8 2026, was brought by the Ligue de Football Professionnel (LFP) and its commercial arm LFP 1 against two defendants: Quad9 and Whalebone. Neither showed up. The judge ordered both to block access from metropolitan France to 21 listed domains for the whole 2026/27 Ligue 1 season, through June 6 2027.

The ruling also covers "sites non encore identifiés", sites not yet identified on the day of the ruling, with updates going through ARCOM. On DNS4EU's registry, that same case number now lists 809 domains.

That is a 38x expansion of a court order with no new hearing we can find. A judge signed off on 21 names. A private football league, through the regulator, has kept feeding the list ever since. Dynamic injunctions are legal in France and the ruling says so out loud. But call it what it is: a block list a private party can extend.

Now picture Lecornu's version. Same plumbing, same carriers, a list of four apps, no judge at all.

The EU's own resolver blocks France's list for the whole planet

We queried all 4,349 blocked names on DNS4EU's unfiltered address (86.54.11.100) from a machine in the United States. 4,271 of them, 98.2%, came back pointing at the same sinkhole address, 51.15.69.11, instead of the real site. French court orders, applied to a user in America.

This is exactly what Quad9 refused to do. In its October 22 goodbye post, Quad9 says it could satisfy the court by adding the names to its global block list, but that would mean "applying French legal decisions to every internet user worldwide... for the commercial benefit of a single private, foreign-owned company". Its case was brought by beIN, the Qatari sports broadcaster. Geo-blocking does not save you either: in a 2021-2023 German case, Quad9 says, Sony Music used a VPN to test its geo-block and Quad9 was fined for contempt.

So the Swiss nonprofit leaves France on November 24, and the EU-funded resolver stays and blocks for everyone. Funny how "European digital sovereignty" ended up meaning French football and Qatari TV rights get enforced on a US IP.

The enforcement is not even tight. 13 listed names still resolved normally on DNS4EU when we checked, including 3 of the 17 ARCOM porn domains (youjizz.com, darknessporn.com, amateurdoporn.com). And 506 listed names, 11.6%, no longer exist at all. The LFP ruling itself asks the league to report dead domains "afin d'éviter les coûts de blocage inutiles". The list keeps them anyway.

Follow the money: who wins, who loses

Rights holders win cheap. The LFP ruling says costs get split under an ARCOM-brokered agreement, and each side pays its own legal fees. The league gets a self-extending block list without paying for the resolvers' compliance work.

Quad9 loses France. The court cut the daily penalty from EUR 580,000 to EUR 1,000, so the money in this one case is small: Quad9 puts it at EUR 24,000 if it refuses through November 14. The problem is the roughly 20 other lawsuits pending against it and other resolvers, demanding blocks on "hundreds of different names". A nonprofit cannot outlast that many lawyers.

Users lose the clean option. Quad9 is the resolver people pick for malware blocking without content filtering. After November 24, French users who used it move to something else, and Quad9 itself warns some will land on resolvers "with less-than-honorable intentions".

The state wins a precedent. Every blocked football stream normalizes the idea that the DNS answer you get in France is whatever a court, a regulator or now Matignon says it is. That is the real asset, and it is worth far more than any Ligue 1 TV deal.

Our test: a TikTok DNS block would fail in one settings tap

Lecornu's plan targets carrier resolvers only. We tested whether the four apps resolve everywhere else. On Oct 25 we asked six public resolvers over plain DNS (Cloudflare, Google, Quad9, OpenDNS, AdGuard unfiltered and DNS4EU unfiltered) for 11 hostnames the four apps load on their own homepages: www.tiktok.com, im-api.tiktok.com, a TikTok CDN host, www.instagram.com, static.cdninstagram.com, two Snapchat hosts, x.com, api.x.com, pbs.twimg.com and video.twimg.com. Every resolver answered all 11, a 66 of 66 score.

We also asked Cloudflare, Google and AdGuard over DNS-over-HTTPS, the encrypted version that rides inside normal web traffic on port 443 where a carrier cannot see the question. All three answered TikTok, Instagram, Snapchat and X. Android calls this "Private DNS" and it is one hostname in the settings. The EU's own DNS4EU, unfiltered, resolves TikTok just fine too, because nobody has put TikTok on its list. Yet.

One more detail from X's homepage HTML, which we pulled: it links its own Tor .onion address. Tor skips DNS completely. A DNS block of X stops exactly the people who do not know what DNS is.

The French already know where the exit is

You do not need a leak to see people getting ready. The French Wikipedia page for VPN (Réseau privé virtuel) averaged 89.5 views a day from October 1 to 16. After the October 17-18 riots and Gabriel Attal's public call to cut social networks, it climbed, and from October 22 to 24 it averaged 251.7 a day, 2.8x the baseline. Blast's leak did not even land until the evening of October 24.

The App Store tells the same story. In Apple's France top 100 free iPhone apps at 11:00 UTC on October 25, Proton VPN sat at #54 and another VPN app at #95. In the US and German top 100 at the same moment: zero VPN apps. Quad9's French Wikipedia page, meanwhile, jumped from 17 to 37 views a day (Oct 10-21) to 231 on October 23, the day after its exit post (which hit 1,367 points on Hacker News).

Our bet: France tries this for real before the 2027 presidential race is over, and the first try leaks within hours because carriers hate it. The bigger bet is that once DNS blocks get laughed off, the pressure moves to the places you cannot route around with a settings tap: Apple and Google app stores, and the VPN apps in them. Nobody has proven that is the plan. But the pattern says each failed block buys a bigger one, and the October 22 letter is the receipt.

For more on who can switch off Europe's internet, read our scan of Europe's kill switch dependencies and our check of India's government sites on revoked certificates. More in News and the tech industry hub.

What this means for you

If you are in France: set an encrypted DNS resolver now, before you need it (Android: Settings, Network, Private DNS; iPhone and Mac: a DNS profile from your resolver of choice), and if you use Quad9, switch before November 24. Install a VPN you trust before a protest weekend, not during it, because app stores are the next choke point.

If you run an app or site: know which resolvers, CDNs and single domains you depend on, because a block list hits names, and one blocked hostname can break your login or your images. Download our data below and check whether anything you rely on shares infrastructure with a listed name.

Want someone to do that check for you? Our $49 Launch Check reviews your app end to end, including DNS setup, which providers you depend on and what breaks if one name gets blocked, and we keep fixing the report at no extra cost until it does what it promises.

Sources

• Blast (Yanis Mhamdi), "Le premier ministre a préparé la coupure des réseaux sociaux pour le 24 octobre", Oct 24 2026
• AlloForfait (Simon Chevalier), "Les opérateurs préparés par Matignon à couper les réseaux sociaux ce 24 octobre", Oct 24 2026
• Clubic (Alexandre Boero), "Le gouvernement voulait pouvoir couper les réseaux sociaux pendant la manifestation du 24 octobre", Oct 25 2026
• Quad9, "Farewell, France", Oct 22 2026
• Tribunal judiciaire de Paris, RG 26/07694, LFP and LFP 1 v. Quad9 and Whalebone, Jul 8 2026
• DNS4EU, Legal information and compliance (court-order registry), updated Sep 11 2026, read Oct 25 2026
• DNS4EU, public resolver setup and variants, read Oct 25 2026
• Wikimedia pageviews API, fr.wikipedia "Réseau privé virtuel" and "Quad9", pulled Oct 25 2026
• Apple top free apps feeds, France, US and Germany, Oct 25 2026 11:00 UTC
• Hacker News, "Quad9 to exit France", Oct 22 2026
• Tensorust DNS census: 4,349 domains x DNS4EU unfiltered and Cloudflare 1.1.1.1 from a US IP, plus 6 plain and 3 encrypted resolvers for the four apps, Oct 25 2026 (data below)