What are DNS over HTTPS (DoH) and DNS over TLS (DoT)?

DoH and DoT are protocols that encrypt your device's DNS queries. A DNS query is a request asking which IP address belongs to a given website. Without encryption, your ISP sees every such query and knows which sites you visit. DoH wraps the DNS query in HTTPS, while DoT uses TLS, making the content unreadable to third parties.

Can my ISP see which websites I visit even if I use HTTPS?

Your ISP cannot read the content of HTTPS pages — they are encrypted. But with standard (unencrypted) DNS, your ISP sees all DNS queries and learns which domains you visit, even without seeing what is on the pages. This is why DNS encryption matters for privacy independently of page-level HTTPS.

Does a VPN protect against DNS surveillance?

Yes, this is one of a VPN's core functions. The VPN client intercepts the device's DNS queries and routes them through an encrypted tunnel. Your ISP sees only an encrypted connection to the VPN server — it cannot see the domains being queried. Unlike DoH/DoT, which protect only DNS, a VPN encrypts all device traffic.

← All news

August 27, 2026

Russian ISPs Block Encrypted DNS: What Users Lose

Daniel ReedSecurity Engineer

Russian ISPs Block Encrypted DNS: What Users Lose

In short: Since August 21, 2026, several major Russian ISPs — Rostelecom, Dom.ru, Tattelekom, Beeline, and SkyNet — have begun blocking DNS over HTTPS (DoH) and DNS over TLS (DoT) from Google and Cloudflare. These protocols encrypted DNS queries and hid which websites users visited from their ISP. After the block, DNS traffic is once again readable by the provider.

What Happened and Who Is Affected

On August 26, 2026, Anti-Malware.ru reported that several major Russian ISPs started blocking encrypted DNS services from Google (8.8.8.8, dns.google) and Cloudflare (1.1.1.1, 1.0.0.1). According to the Telegram channel bypassblock, which first documented the issue on August 21, the blocks affect subscribers of Rostelecom, Dom.ru, Tattelekom, Beeline, and St. Petersburg's SkyNet.

The symptoms vary by ISP and region: some subscribers lose only DoT access, others lose only DoH, while some lose both simultaneously. Tattelekom's technical support reportedly advised affected customers to disable DoH and DoT — essentially asking users to reduce their own privacy protection. No official regulatory explanation has been provided.

What DoH and DoT Are — and Why They Matter

Every time you type an address into a browser, your device sends a DNS query: "what IP address corresponds to this domain?" Traditional DNS sends this query in plaintext — your ISP can see the full list of domains you request in real time.

DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt that query: the ISP sees only that you contacted a DNS server, but cannot read which domain you looked up. This is precisely what makes them a blocking target — when DoH/DoT is used, the ISP loses passive visibility into DNS traffic.

How the Blocking Works Technically

The blocking is more sophisticated than a simple IP ban. Here is what measurements reveal:

Cloudflare DoT (port 853): The TCP connection establishes successfully, but the session is forcibly reset with ECONNRESET before TLS authentication completes. The encrypted tunnel never opens.
Google DNS over HTTPS (dns.google, port 443): After the browser sends a TLS ClientHello packet, the connection hangs without response or terminates with an EOF error. Intermediate equipment (DPI) recognises the traffic type by signature and drops the session.

The key point: this is not a random technical failure. A pattern where TCP succeeds but the TLS tunnel does not is characteristic of deep packet inspection (DPI) deliberately targeting encryption — not the server itself.

What This Means for Your Privacy

With DoH/DoT disabled, every DNS query from your device is once again readable by your ISP. This means:

Full list of visited domains — your provider can see which sites you request, at what time, and how often.
Behavioural profiling — DNS data is used by data brokers for ad targeting and can be sold to third parties.
DNS-hijacking risk — if you use your ISP's own DNS server, queries can be not just observed but redirected to different IP addresses.

It is important to note that this concerns DNS queries specifically, not the content of your traffic. An HTTPS connection to a website remains encrypted. But a DNS query reveals the fact that you contacted a given domain — and that alone is enough to build a detailed behavioural profile of your online activity.

How to Protect Your DNS Privacy

1. VPN with DNS tunnelling. A VPN client intercepts all DNS queries from the device and routes them through an encrypted tunnel to the VPN server — your ISP sees only encrypted traffic to the VPN, not DNS queries or visited domains. The LiMP VPN features page describes how our DNS protection mode works. This is the most complete solution as it covers all device traffic, not just the browser.

2. Browser-level DoH via alternative servers. Chrome, Firefox, and Edge allow you to set a custom DoH server in settings. If Google and Cloudflare are blocked, alternative DoH providers may work until they are filtered: AdGuard DNS (https://dns.adguard-dns.com/dns-query) or Quad9 (https://dns.quad9.net/dns-query). Availability depends on your ISP and region.

3. System DNS over VPN. Even when individual DoH/DoT servers are blocked, a VPN tunnel still bypasses the ISP's DPI — because its encrypted traffic cannot be inspected at the DNS signature level. The LiMP VPN app is available for iOS and Android and includes built-in DNS protection.

Sources

← All news