The Internet is essential for our everyday lives. We use it to reach out to friends and family, pay our bills, study, work, watch our favorite movies, and do an infinite number of other things. But at the same time, criminal activities are also happening online. Growing concerns about online copyright infringement and child safety have led governments to regulate online services, which sometimes leads to content blocking or even making entire websites and apps unavailable.
The problem is that many countries are increasingly turning to the Domain Name System (DNS) to enforce public policy online, putting the entire Internet in danger and spreading side effects that affect perfectly legal content and services. Increasingly, they are relying on mandated DNS blocking to enforce regulations. But this is not only dangerous to the Internet ecosystem. It’s also ineffective.
What Is the DNS?
Every time you go online, a system works behind the scenes to help you get where you want to go. It’s called the Domain Name System—the DNS. The DNS is like the Internet’s phonebook. We type names like ‘example.com’ on our browsers, but computers use numerical addresses that we know as IP addresses. The DNS translates names into numbers, so we can navigate the Internet easily and don’t need to type long numbers every time we want to visit a website.
To do this translation, your device relies on something called a DNS resolver. It’s a server, usually run by your Internet provider or a public service, that receives your request, finds the correct IP address, and sends it back so your browser or application can connect. For example, when you type a website address in your browser, it passes a request to your DNS resolver, which goes out and finds the right address by contacting a series of servers. This global, layered DNS system keeps the Internet fast and reliable.
What Is DNS Blocking?
Because the DNS sits between the user and the content they are trying to reach, many governments increasingly see it as a point of control. From their view, the logic seems straightforward: block the name, and you block the content. In practice, DNS blocking forces the user’s DNS resolver to interfere with its response. Instead of giving the correct answer, it is forced to return a false or modified answer.
But DNS blocking doesn’t remove content from the Internet; it simply tries to keep people from reaching it. That’s why it’s easily bypassed, breaks legitimate services, and often blocks far more than intended. More critically, DNS blocking can fragment the global naming system, disrupt security tools, and even affect people outside the country issuing the order because DNS isn’t bound by geography.
Part of the appeal of mandating DNS blocking is that its voluntary version of DNS filtering is already widespread. For example, parents use it to control their children’s Internet experience, and organizations use it to block malware. Policymakers sometimes point to these examples as evidence that mandated DNS blocking is simply an extension of existing practices. But the comparison is misleading. Mandated DNS blocking is a fundamentally different practice due to its purpose, implementation, and its effects.
Today, we see the practice of DNS blocking accelerating. Courts and regulators across the world are issuing blocking orders to DNS operators, targeting content ranging from copyright infringement to child exploitation to politically sensitive speech. As these mandates multiply across jurisdictions, so do concerns about their implications for security, the openness of the Internet, and the fragmentation of one of the Internet’s critical functions.
But there are other ways.
What Are the Alternatives?
If online harms need to be addressed, interventions should target the content and the actors responsible, not the intermediary infrastructure that makes the Internet function. That means working with hosting providers to remove illegal material at the source, pursuing those responsible via due process, and strengthening international cooperation.
The Consequences of DNS Blocking
A new report published by the Internet Society sheds light on some of the implications of mandated DNS blocking. It makes a straightforward case: mandated DNS blocking may look like a simple technical fix, but in practice it is blunt, ineffective, costly, and even counterproductive. Here are some of the key takeaways:
DNS blocking doesn’t necessarily achieve the policy objective. It does not remove content from the Internet; it only stops a resolver from completing the lookup. The content stays online and is fully reachable from another resolver, via a VPN, or even a direct connection to the server. Operators of the blocked site can even register a new domain and point it at the same server.
DNS blocking is not effective. Since DNS resolves names, not individual pages, anything hosted under the same domain name is also blocked, including lawful content.
DNS blocking mandates interfere with security protocols designed to protect users. And because the DNS is a global system, DNS blocking effects don’t necessarily stay neatly within borders. For example, a public resolver operated in one country may serve millions of users in many other jurisdictions. When a block is imposed, the effects can spill into jurisdictions where the content could be perfectly legal.
Mandated DNS blocking may look like a straightforward solution, but in practice, it is a costly, counterproductive policy tool. Read the full report to learn more.
Image © David Pupăză on Unsplash