European “sovereign” DNS relies on Cloudflare, Google, and routing through Five Eyes

A network engineer, scrutinizing the new European DNS service, found that it relies heavily on services from Cloudflare and Google, and even routes traffic through non‑EU providers, raising questions about sovereignty claims. While DNS4EU has acknowledged certain findings, it clarified that these do not accurately reflect the project's scope.

DNS4EU was presented as an initiative by the European Commission to provide Europeans with a private, safe, and independent European DNS resolver that could compete with Google or Cloudflare.

The service’s website claims that the “EU’s secure-infrastructure project provides a protective, privacy-compliant, and resilient DNS service to strengthen digital sovereignty and security for EU citizens, governments, and critical infrastructure.” ENISA (the EU’s Agency for Cybersecurity) supports it.

However, research by Jens Link, an IT Consultant, reveals that the service’s website relies on Cloudflare, mail servers on Google, and routing data, which also suggests that the actual traffic sometimes flows through non‑EU providers.

The first thing that a computer using the DNS service does is a DNS lookup. This part is actually European because DNS queries go to cloudns.net servers, which are operated by Cloud DNS Ltd, a company in Bulgaria. Even a server with the top-level domain ‘.uk’ resolved to an IP in the EU.

However, the researcher went deeper and analysed the routing data to reveal that part of the traffic doesn’t stay within the EU.

BGP (Border Gateway Protocol) data reveals that when users communicate with the DNS server, the traffic hops through multiple intermediary networks, one of which is based in the UK.

“Last time I checked, GB was not part of the EU. And it’s also a member of the Five Eyes (an intelligence alliance between the US, UK, Canada, Australia, and New Zealand),” Link writes.

When the researcher checked the IP address of the DNS4EU website, it resolved to Cloudflare’s infrastructure. Cloudflare is an American company sometimes compared to the backbone of the internet, operating a major content delivery network.

The researcher also found that DNS4EU uses Google for email servers.

“Europeans can’t do web and mail. There is absolutely no provider here who can do such complicated tasks,” Link said.

And these weren’t the only issues with the service. The author pointed out concerns about the lack of redundancy and potential vulnerability to distributed denial of service (DDoS) attacks

“I would expect such a service to be anycasted, available via multiple providers (all EU-based),” Link said.

Golem.de, a German tech website, also warns that normal DNS traffic is unencrypted, which means the DNS requests are sent to DNS4EU in plain text and can be intercepted by anyone in the middle.

Update: DNS4EU is committed to building a robust European DNS

DNS4EU claims that the findings do not “accurately reflect the scope, objectives, or implementation of the DNS4EU project.”

“The issues raised appear to concern broader topics that fall outside the project's work plan, deliverables, and obligations,” said Magdalena Krucká, Communication Manager at DNS4EU.

The company explains that its website, joindns4.eu, is hosted on HubSpot, which is an American customer relationship management (CRM) and marketing automation company.

“We assume the CMS is hosted on Cloudflare’s cloud infrastructure (or potentially makes use of Cloudflare’s protection services), though this would require further investigation to confirm,” Krucká said.

“We would like to emphasize that the core goal of this project is to provide a European-based public DNS service. Supporting additional tools such as the website or email hosting are internal choices of Whalebone and, to keep things simple, we don't use different tooling for the DNS4EU project. The important thing is that these tools are not involved in the actual DNS service or related functions and were not financially supported through the project.”

DNS4EU confirmed that their ASN (198121) is routed through ASN (60068), which belongs to its infrastructure provider, Datapacket. Autonomous System Number (ASN) is a unique identifier that helps manage routing on the internet.

“This ASN was originally registered in the UK when it was still part of the EU. The provider has chosen to retain this registration due to their global business operations, which is, in our view, an understandable decision,” Krucká said.

“While the ASN falls to the UK, the company behind it is in fact EU-owned and controlled, which was our main requirement when looking for partners for that service.”

DNS4EU is an EU-funded initiative aimed at building a secure, privacy-respecting, and resilient public DNS resolver infrastructure within the European Union.

“The project's core goal is to offer a European alternative to existing DNS services, ensuring data sovereignty, robust cybersecurity, and compliance with EU regulations. It is not intended to replace existing private or commercial DNS services but to offer a trusted public option aligned with EU values and interests.”

Updated on June 20th [08:00 a.m. GMT] with a statement from DNS4EU.