DNSblocking

DNSBlocking refers to techniques that prevent users from resolving certain domain names to IP addresses by manipulating responses in the Domain Name System. It is a form of content or access control implemented at various points in the network, rather than at the application layer.

Common methods include blocking at recursive resolvers or enterprise DNS servers by returning NXDOMAIN (name does not exist) or non-routable addresses, or by redirecting queries to a blocking page. Other approaches involve DNS tampering or poisoning, interception by intermediate devices, and the use of captive portals or filters that preempt or override normal responses. Such blocking can occur at the level of Internet service providers, national networks, universities, or corporate networks.

DNSBlocking is used for a range of purposes, including censorship, copyright enforcement, national security, and safety controls. Proponents argue it enables easier, scalable filtering without inspecting encrypted traffic. Critics point to overreach, potential collateral damage, and the ease with which it can be circumvented. It is also related to privacy concerns, since DNS queries reveal user interests and can be logged by intermediaries.

Limitations include incomplete effectiveness against all methods of access, and the ability of users to circumvent blocking by using alternate DNS resolvers, encrypted DNS (DoH/DoT), VPNs, or anonymizing networks. DNSBlocking can also interfere with legitimate uses of shared infrastructure, such as content delivery networks, and may produce false positives or degraded performance.