DNS Encryption and Censorship: What DoH and DoT Actually Change

DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt the query layer between a user's device and a recursive resolver, hiding which domains a user attempts to access from their Internet Service Provider and local network observers. This encryption does not, however, prevent DNS-based censorship. It shifts the trust relationship and changes which parties can observe or block access—but does not eliminate blocking itself.

Traditional DNS operates over unencrypted UDP port 53. When a user's device queries a domain name, that query travels in plaintext through the ISP's infrastructure. Governments and ISPs implementing DNS filtering—a blocking method used by authorities in Iran, China, Russia, Egypt, and dozens of other countries—intercept these queries and return bogus answers (NXDOMAIN responses or false IP addresses) for blocked domains. This technique is cheap, easy to implement at scale, and requires no deep packet inspection equipment.

DoH, standardized in RFC 8484 (2018), encapsulates DNS queries inside HTTPS traffic on port 443. DoT, formalized in RFC 7858 (2016), uses TLS encryption on port 853. Both methods hide the queried domain name from the ISP and any middlebox performing network-level packet inspection. A censor observing encrypted traffic cannot see whether a user is querying a news outlet, opposition website, or legitimate service.

However, encrypted DNS introduces a different vulnerability: the resolver operator. When a user sends a DoH or DoT query to a third-party resolver—whether operated by a tech giant, a privacy-focused service, or an ISP—that resolver can observe, log, and comply with blocking orders. The shift from ISP-level blocking to resolver-level blocking is not a technical victory; it is a displacement of surveillance and control.

Moreover, DoH and DoT do not prevent all blocking methods. IP-based filtering—blacklisting the addresses returned by legitimate DNS queries—remains entirely effective against encrypted DNS. China's Great Firewall and Russia's System for Operative Search Activities (SORM) employ this technique alongside DNS interference. A user who resolves a blocked domain's IP address through DoH can still be blocked when attempting to connect to that IP. According to public reports from OONI and GreatFire, both DNS filtering and IP filtering operate concurrently in highly censored networks.

Server Name Indication (SNI) inspection adds another layer. During the TLS handshake, clients send the destination hostname in plaintext within the SNI field. Deep packet inspection equipment can read this field and block connections based on hostname, regardless of whether DNS queries were encrypted. Circumventing SNI blocking requires either Encrypted Client Hello (ECH), a nascent standard not yet widely deployed, or tunneling through a VPN or proxy that terminates the TLS connection on behalf of the user.

Countries implementing robust censorship regimes—including Iran, China, Russia, and others that conduct systematic network blocking—combine multiple techniques: DNS filtering, IP blacklisting, SNI inspection, and active probing. OONI's longitudinal measurements document these layered approaches across multiple countries. No single protocol change resolves this multiplicity.

Where DoH and DoT do matter is in scenarios of passive ISP surveillance and corporate tracking rather than active state censorship. A user in a country with light-touch internet regulation benefits from DoH and DoT by reducing exposure to ISP snooping and advertising tracking. ISPs cannot build profiles of visited websites if they cannot observe DNS queries. This has value—but it is distinct from censorship circumvention.

For users in heavily censored environments, encrypted DNS alone is insufficient. Circumvention requires technologies that change the network path itself: VPN protocols like WireGuard or OpenVPN, which tunnel all traffic through an encrypted connection to an external server; proxy protocols like Shadowsocks or V2Ray, which obfuscate the destination and encrypt payloads; Tor with pluggable transports such as Snowflake or WebTunnel, which disguise Tor traffic as innocuous protocols; or protocol camouflage techniques including REALITY/Vision, which makes encrypted traffic resemble legitimate HTTPS.

These tools bypass both DNS filtering and IP blocking because they do not rely on the standard DNS system or direct IP connections. They operate at a different architectural level—tunneling or proxying rather than encrypting a single protocol layer.

The technical reality is that DoH and DoT represent incremental privacy gains in permissive regulatory environments, not censorship solutions. They address ISP-level observation, not government-directed blocking. Understanding this distinction is essential for anyone advising users in censored regions or evaluating the technical claims made about encryption technologies.