Skip to content
Today
Sign in

Security Independently confirmed2 publishers 3 min read Published

Encrypted DNS in Russia is now a reachability problem, not a privacy win

Cloudflare and Google DoH/DoT endpoints are failing on Russian networks, but the largest public measurement found no protocol-wide block. That makes the breakage messier, not milder.

The Watch · Security desk

How we use AI Send a correction

What happened

  • Russian users reported failures reaching encrypted DNS resolvers, with Cloudflare's 1.1.1.1 and Google's 8.8.8.8 named as the targets.
  • Comparable complaints followed from Rostelecom subscribers in Arkhangelsk and from Dom.ru and SkyNet customers in St Petersburg.
  • Plain unencrypted queries to the same Google and Cloudflare addresses kept working in some cases where encrypted sessions would not establish.

Why it matters

  • exposure Anything reachable from Russian networks that pins itself to an encrypted resolver now depends on a filter someone else operates, and the fault presents to the user as your service being broken.
  • constraint Failure rates in the teens rather than the nineties remove the clean engineering answer of treating encrypted DNS as either available or blocked, and push the cost into retry and fallback logic.
  • contradiction One publisher reports blocking under way while the measurement's own author says no protocol-level block was found; read as per-address filtering, the mitigation and the forecast both change.
  • precedent A March trial on one telco that the ISP denied, followed by regional failures nobody has confirmed, suggests further resolvers get added quietly rather than gazetted.

The number worth pulling out of the ZaTelecom sample is not 3186. Participants ran 124 tests across 66 autonomous systems against 29 DoH servers on 22 and 23 August, according to Digital Report's account [16], which tops out at 3596 individual checks. The tally is 410 short of that, so the average run reached roughly 26 of the 29 endpoints, and the write-up does not account for the gap [27].

Headline success was 55%, rising to 73% once dead control addresses and errors from an outdated curl were removed [17]. That leaves 27% failure in aggregate, while Cloudflare's two endpoints failed 16 to 17% of the time and dns.google, Mozilla's Cloudflare address and several others sat between 4 and 9% [19][28]. The aggregate is being carried by cases like AdGuard's retired domain, which answered nothing in 90% of checks and was unreachable in 61 of 66 networks, against 8% failure for the current address of the same service [18].

Partial is the operationally awkward outcome. On Beeline's mobile network, Techora reported TLS connections to 1.1.1.1 and 1.0.0.1 on port 853 being reset while Google's dns.google timed out [9], and in some cases the same providers still answered plain unencrypted queries [11]. A reset comes back fast and a client can fall back; a timeout burns the full DNS timeout first, and a device pinned to DoT with no plaintext path simply stops resolving. Variance makes it harder to plan around: at Rostelecom, MTS, MGTS and SkyNet, between two and 17 services failed within the same network depending on the run, for reasons the measurement could not establish [21], while at Kompanon, NECSTEL and TeleMaks encrypted DNS was effectively absent [20].

Risky Business dated its bulletin 26 August 2026 and described blocking as under way [1]. The author of the Russian measurement concluded the opposite, that no sign of DoH being blocked as a protocol had turned up [13], and pointed out that the widely shared line about three thousand checks confirming a block inverts his own finding [23]. Both readings survive, because filtering particular resolver addresses and ports on particular networks is not a protocol ban, and 51 of the 66 networks were sampled once, leaving seven operators, about 11% of the set, with enough runs to support anything durable [22][29].

Roskomnadzor has confirmed nothing [5], the operators have not commented [12], and the March test on Beeline was denied by the ISP while outside experts documented it [6]. Set against the regulator's 2021 statement that it intended to block protocols hiding a user's destination, with DoH named [7], the pattern to design for is quiet, address-level filtering rather than an announced ban. Note what that filtering never needed to defeat: the ISP already saw which resolver was chosen and the connections that followed [24], and SNI stays in the clear without Encrypted Client Hello [26]. Confidentiality was not the pressure point. Reachability is cheaper to break.

What to watch

  • Any on-record statement from Roskomnadzor, Beeline, Rostelecom or MTS, which would move this from inference about filtering to stated policy.
  • Repeat runs on the handful of networks sampled more than once: failure rates that harden instead of fluctuating would indicate a standing rule.
  • Whether DoH providers other than Cloudflare and Google start showing the same reset-and-timeout pattern.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence58
Adoption34
Hype gap+42
Incentives62
Confidence61

Perspective Coverage

3 publishers
Builder
Builder 30%
Operator
Operator 53%
Investor
Investor 17%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    Risky Business published a Risky Bulletin podcast dated August 26, 2026, headlined "Russia starts blocking DoH and DoT", presented by news editor Catalin Cimpanu.

    Reported Supported3 sources— create a free account to open themView cited source
  2. [2]

    Russian internet users began reporting problems connecting to DNS-over-HTTPS and DNS-over-TLS servers, suggesting a government crackdown on the two protocols.

    Reported Supported Source: Risky Bulletin, news.risky.biz2 sources— create a free account to open themView cited source
  3. [3]

    The reported bans cover Cloudflare's 1.1.1.1 and Google's 8.8.8.8 DNS servers.

    Reported Supported2 sources— create a free account to open themView cited source

Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.

Add to ChatGPTAdd to Claude

Sources

2 independent publishers whose own reporting we read for this story.

  1. digital-report.ru

    1 article · August 25, 2026

    Digital Report
  2. news.risky.biz

    1 article · August 25, 2026

    Risky Bulletin: Russia starts blocking DoH and DoT
  3. risky.biz

    2 articles · August 25, 2026

    Risky Bulletin: Russia starts blocking DoH and DoT

Share your take

Let Clarity write the post for you.

Signed-in readers get a short post drafted on this story in the register they choose — narrative, analytical, or a direct position — editable to the last word before it goes anywhere. The share buttons at the top of this story work without an account.

Create a free account to composeSign in

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

  • Resolver resilience and fallbackFollow
  • Network measurement and methodologyFollow
  • Encrypted DNS (DoH/DoT)Follow
  • Internet censorship and filteringFollow

Entities

Loading related stories