PlayInfoBox

Home /Network /Website Blocking Methods Explained (DNS, SNI, and IP Blocking)

Website Blocking Methods Explained (DNS, SNI, and IP Blocking)

The same result, 'this site won't load', can come from very different mechanisms, each with its own telltale symptoms and its own difficulty to bypass. Knowing which layer is doing the blocking also helps you tell a deliberate block from an ordinary outage.

The steps a page load goes through

Loading a website involves several steps, and each one is a place where blocking can happen. First the device asks DNS for the IP address behind a domain name. Then it opens a connection to that IP address. For HTTPS sites, it starts a TLS handshake whose first message names the server it wants. Finally it sends the actual request and receives the page. Blocking methods are best understood as interference at one of these four points.

DNS Blocking: Stopping It at the Lookup Stage

A method that deliberately returns a wrong answer, or no answer at all, when a device looks up a domain name through DNS. An ISP or network administrator configures its DNS servers to return a landing or notice page's address instead of the real IP, or simply not respond, for specific domains. It's relatively simple to implement, but easy to bypass: switching to a different public DNS server (like 1.1.1.1 or 8.8.8.8) or using DNS over HTTPS (DoH) gets around it easily. Typical symptoms are a 'server not found' error or an unexpected notice page, while the same site works on another network.

IP Blocking: Blocking the Destination Address Itself

A firewall or router simply refuses to pass any packet addressed to a specific IP, regardless of domain name. Unlike DNS blocking, it can't be bypassed by switching DNS servers. But because many unrelated sites often share the same IP address (on the same CDN or cloud provider), IP blocking can easily cause 'overblocking', accidentally taking down other, unrelated sites too. The typical symptom is a connection that hangs and times out even when you can resolve the name correctly.

URL and Keyword Filtering

A proxy or firewall inspects the address or content of unencrypted HTTP requests, and cuts the connection or redirects to a notice page if a banned string is found. This approach fundamentally can't be applied the same way to encrypted HTTPS requests, where the path and content are hidden, which is a serious limitation now that HTTPS accounts for the vast majority of web traffic. Where it is used on HTTPS, it generally requires the organization to install its own certificate on managed devices and decrypt traffic.

SNI Blocking: Reading the Domain Name Exposed Before Encryption

Watches for the SNI (Server Name Indication) field, which is sent in plain text during the very start of an HTTPS connection's TLS handshake, even though the actual data that follows is encrypted. The ClientHello message at the start of the handshake includes an unencrypted SNI field identifying which server the client wants to reach. SNI blocking works by watching for this plain-text domain name mid-transit and forcibly cutting the connection if it matches a blocklist, a method that has sparked public debate in several countries. As Encrypted Client Hello (ECH), an extension used with TLS 1.3, becomes more widely adopted, SNI blocking is expected to become progressively harder to pull off. The typical symptom is a connection that resets partway through, while other sites on the same IP still load.

Deep Packet Inspection (DPI): A More Sophisticated Approach

DPI goes beyond looking at headers, addresses, or ports. It analyzes a packet's actual payload or traffic pattern to identify the application or protocol in use, or detect specific file types. It's used both for national-level internet censorship and for corporate traffic management (QoS). It's expensive and processing-intensive to implement, but it's the most precise way to classify traffic. Even encrypted traffic can sometimes be identified by its size and timing patterns, even if its contents can't be read.

Comparing How Hard Each Method Is to Bypass

DNS blocking is generally considered the easiest to bypass, using a different DNS server or an encrypted DNS protocol like DoH or DoT. SNI blocking can be bypassed with Encrypted Client Hello (ECH) or a VPN. IP blocking and DPI, on the other hand, are considerably harder to get around unless a VPN changes where your traffic exits from entirely. In practice, national or institutional blocking systems often layer several of these methods together, so defeating one layer may simply expose the next.

How to tell which method you are facing

A few quick checks narrow it down. If the domain fails to resolve on your network but resolves through a different public DNS server, the block is at the DNS layer. If it resolves to the correct address but the connection times out, suspect IP blocking. If the connection starts and then resets as the secure handshake begins, suspect SNI blocking. If a plain-HTTP page redirects to a notice page, a URL filter is probably involved. Comparing results from a mobile network and a home network is a simple first test.

Want to know more about encrypted DNS?

DNS over HTTPS (DoH) and DNS over TLS (DoT) both encrypt the DNS lookup itself, which is exactly what makes them effective at bypassing basic DNS blocking. Rather than sending a plain-text query that an ISP's DNS server, or anyone watching the traffic, can inspect and tamper with, these protocols wrap the request inside an encrypted channel, so only the final result reaches the user unaltered. DoH travels over the same port as ordinary web traffic, which makes it harder to single out, while DoT uses its own dedicated port and is therefore easier for a network to block.

How a VPN changes the picture

A VPN reroutes your traffic through an encrypted tunnel to a server elsewhere, so from the local network's point of view, all it sees is encrypted traffic heading to the VPN server's IP address. None of the DNS, SNI, or content details that the blocking methods above rely on are visible anymore. That's why a VPN can bypass most of these techniques at once, though it doesn't change how blocking works at the destination site itself, and the VPN provider can see what your local network no longer can. Some networks also block known VPN servers, which brings the problem back to IP blocking.

Blocking for legitimate reasons

Blocking is not only a censorship tool. Schools filter content for students, companies block malware and phishing domains, parents use DNS-based filters on a home router, and courts in many countries order ISPs to block sites that host pirated content or illegal material. The same techniques serve very different purposes, and the debate is about who decides what to block, whether the process is transparent, and whether people can appeal.

A note on bypassing blocks

The laws on circumventing blocks differ widely between countries, workplaces, and schools, and violating an institution's acceptable-use policy can have consequences even where it is legal. This page explains how the technologies work for educational purposes and is not legal advice.

Frequently Asked Questions

Is it the same principle when a specific site is blocked on a company firewall?

Yes, the underlying mechanism isn't very different from country-level blocking. Corporate and school network firewalls commonly combine DNS blocking, URL filtering, and SNI blocking to restrict access to specific sites or services.

Why has SNI blocking been controversial?

SNI blocking only inspects a small piece of an HTTPS connection (the domain name), but it has drawn controversy for a few overlapping reasons: concerns about the practice of intercepting communications at all, the risk of affecting unrelated sites that happen to share the same server, and broader public debate in various countries over governments directly restricting access to specific websites.

Why can a site be blocked on one network but open on another?

Each network operator decides its own filters. A site may be blocked by your ISP's DNS or firewall but reachable through a mobile carrier, a workplace, or a different country, because the blocking happens on the path your traffic takes, not at the site itself.

Does HTTPS prevent a site from being blocked?

No. HTTPS protects the content of your connection from being read or altered, but a network can still see the destination IP address and, in many cases, the domain name through the SNI field, so it can still choose to cut the connection.

Will Encrypted Client Hello end SNI blocking?

It makes it harder, since the server name is hidden, but it is not a complete solution. A network can still block by IP address, or block the encrypted-hello mechanism itself, and adoption depends on browsers, servers, and CDNs supporting it.