Russia Starts Blocking Encrypted DNS Protocols DoH and DoT Across Major ISPs

Since mid-August 2026, subscribers of Rostelecom, Dom.ru, Tattelecom, SkyNet and Beeline have experienced complete loss of connectivity to encrypted DNS resolvers operated by Google and Cloudflare. The outages are not caused by network congestion or resolver failure; instead, connections are actively disrupted at the network level.

DoT traffic to port 853 is terminated with TCP RST packets immediately after the three-way handshake completes. DoH traffic to port 443 passes the TCP handshake but is dropped silently once the TLS ClientHello containing the SNI value dns.google or cloudflare-dns.com is observed. This selective behaviour demonstrates the use of deep packet inspection rather than simple port or IP blocking.

Simultaneously, unencrypted UDP DNS queries on port 53 are being redirected to the national domain-name system infrastructure known as NSIDI. The replacement resolver returns authoritative NXDOMAIN responses for blocked domains while supplying correct answers for all other names, making the manipulation invisible to applications that do not validate DNSSEC signatures.

Technical verification methods include checking the Authoritative Answer flag in responses, sending deliberately low-TTL queries to trigger ICMP Time Exceeded messages, and querying the diagnostic domain whoami.akamai.net to reveal the actual resolver IP address. These tests consistently show that traffic never reaches the intended public resolvers.

Existing circumvention techniques such as DNS over TCP, direct IP connections that avoid SNI inspection, and local tools like GoodbyeDPI or zapret provide only partial relief. The only reliable solution remains routing all traffic, including DNS, through an encrypted VPN tunnel that hides both destination addresses and query contents from the TSPU sensors.