European Union wants its own DNS resolver that can filter websites

The European Union is investigating the possibility of setting up its own DNS infrastructure for European organizations and citizens. With this, Europe wants to break the market power of a handful of parties. Europe can also directly block unwanted websites.

The working title of the project is DNS4EU. The European Union has now a tender open for. Having your own DNS resolver is part of the EU’s strategy to become more digitally independent from large international parties in the long term. According to the Union, European institutions and citizens are increasingly dependent on non-European DNS resolvers. The DNS4EU rollout is about consolidating DNS solutions in the hands of a handful of large companies. The EU recognizes that there is a lack of investment from the continent, which means that new DNS infrastructures are hardly set up.

In addition to autonomy, the EU also sees its own resolver as a form of ‘cyber security, data protection and privacy according to European rules’. The tender stipulates that the resolver must comply with standards such as https and dnssec, but also dns-over-https and dns-over-tls. Data must be processed within the European Union and companies are not allowed to sell or otherwise monetize personal data. The tender does leave room for the use of aggregated data, for example for security purposes.

The EU wants to use the resolver, among other things, to be able to block websites at European level. For example, it must be possible to filter hostnames of URLs on the basis of ‘legal conditions in the EU or national jurisdictions’. In addition, the resolver must be able to block websites with illegal content such as malware or phishing panels. Data for this would come from European security organizations, such as CERTs or national investigation services. It is striking that the tender specifically states that companies can offer ‘premium and wholesale services’ for the resolver. This concerns opt-in services for ‘extra security’ such as more filtering, monitoring and broader support.

The EU does not write whether the resolver will soon be mandatory for European companies or providers. In any case, the service should be made available to everyone, including citizens, rather than just certain public institutions.