How Fast Do DNS Filters Block Fresh Phishing? A Seven-Day, Three-Vantage Comparison of Quad9, Cloudflare 1.1.1.2, and Public Blocklists

Advice on DNS-level malware blocking often leans on older head-to-head tests that favour Quad9 over Cloudflare. We re-measure the question on current phishing. Every hour a collector on a cloud virtual machine outside our home network pulls newly listed phishing domains from two feeds (OpenPhish and the CERT Polska warning list), and asks Quad9 (9.9.9.9), Cloudflare's malware filter (1.1.1.2) and an unfiltered control (1.1.1.1) whether each domain still resolves, at 0, 1, 6, 24, 72 and 168 hours after first sighting. Four public blocklists used on a home resolver are matched offline against the same domains, and a fixed sample of 3,000 popular domains measures false positives. Domains hosted on shared platforms are analysed separately because DNS can block them only by blocking the platform name. In Atlanta (1,723 own-domain phishing domains first seen 31 October to 3 November, each followed for a week) Cloudflare blocks most at first sighting (17% against 6%), Quad9 overtakes it by six hours (89% against 29%), and the two are within seven points at 24 hours (97% and 91%). Blocklists add little until a day has passed. On shared-hosting phishing Cloudflare blocks 90% and Quad9 23% at 24 hours. Comparing Atlanta with Frankfurt and Singapore shows Quad9's early blocking is location-dependent (18%, 71% and 49% at one hour), while Cloudflare's is not. By 72 hours Quad9's blocks have fallen to 83 to 87% on the same domains while Cloudflare's rise to 92 to 94%. For a home resolver limited to one upstream, neither service dominates: Quad9 is better in the first day and Cloudflare thereafter and on shared hosting. At 168 hours Quad9 has levelled off (82 to 86%) while Cloudflare holds (92 to 94%), and the blocklists, which lag at first, reach 82 to 85%. Code and data: https://doi.org/10.5281/zenodo.24098038