DNS filtering blocks a website by making the address lookup fail or point somewhere else, so your browser never reaches the real server.
Explanation
Before your browser can open a site, it asks a DNS resolver, usually your ISP's, for the site's IP address. A filtering resolver answers a blocked name with nothing, with an error such as NXDOMAIN, with the address of a block page, or with an address that leads nowhere. Indonesia relies on it heavily: OONI and Sinar Project found that about 95% of the 414 sites they confirmed blocked between January and June 2022 were blocked by DNS hijacking. In Iran, OONI found ISP resolvers answering blocked names with private addresses such as 10.10.34.35. China does it on the wire instead: OONI documented forged DNS answers injected into lookups for Wikipedia in 2019. DNS filtering is cheap to run and easy to get around. Another resolver, or encrypted DNS, often avoids it, unless the network intercepts DNS traffic or also blocks by IP address or by the site name in the TLS handshake. Through a web proxy, your device only looks up the proxy's own name; the lookup for the site you open happens on the proxy server.
In practice
Where a resolver sits does not decide whether you are filtered; where your query travels does. In our DomainScan scan of 5 October 2026, youtube.com was looked up from 15 public resolvers, including AliDNS (China) and Yandex.DNS (Russia). Queried from outside those countries, every one returned a Google address. Inside China the forged answer is injected on the network path, which is why OONI sees DNS tampering there even for resolvers that answer correctly from abroad.
Sources: OONI / Sinar Project - State of internet censorship in Indonesia 2022 (23 Dec 2022) · OONI - Iran censorship study (2025) · OONI - China blocks all language editions of Wikipedia (2019)
Questions about DNS filtering
Related terms