Users of several major Russian internet providers have reported widespread issues accessing encrypted DNS protocols offered by Google and Cloudflare. The affected services include DNS over HTTPS (DoH) and DNS over TLS (DoT), which encrypt DNS queries and prevent providers from easily monitoring which domains users are visiting.
Measurements indicate that the filtering operates in a sophisticated manner. TCP connections are established successfully, but the secure tunnel is disrupted at the next stage. When connecting to Cloudflare addresses 1.1.1.1 and 1.0.0.1 on port 853, the TCP handshake completes, after which the connection is forcibly reset with an ECONNRESET error before TLS authentication finishes.
Google Public DNS shows a different pattern. Connections to dns.google, 8.8.8.8, and 8.8.4.4 on port 443 are established, yet after the TLS ClientHello is sent, responses stop. Sessions either hang until timeout or end with an "unexpected eof while reading" error. This behavior points to interference by intermediate network equipment using signature-based filtering.
The problems have affected subscribers of Rostelecom, Dom.ru, Tattelecom, and St. Petersburg-based SkyNet. Symptoms vary by operator and region: some users lose only DoT, others lose DoH, and some experience both protocols blocked. Tattelecom technical support reportedly advised one customer to disable both protocols to regain access.
Although no official statement confirming centralized blocking has been released, the simultaneous occurrence of identical issues across multiple providers and both major public DNS services makes random failure highly unlikely.
