GoodbyeDPI

Russia Starts Blocking Encrypted DNS Protocols DoH and DoT Across Major ISPs

Since mid-August 2026, subscribers of Rostelecom, Dom.ru, Tattelecom, SkyNet and Beeline have reported sudden failures of encrypted DNS services from Google and Cloudflare. The blocking affects both DoT on port 853 and DoH on port 443, but the mechanisms differ: DoT connections receive TCP RST packets while DoH sessions are silently dropped after the TLS ClientHello. Analysis shows the interference originates from TSPU equipment performing DPI on SNI fields and known resolver domains. At the same time, ordinary UDP DNS queries are being intercepted and answered by the NSIDI infrastructure, returning NXDOMAIN for blocked domains. The changes indicate a centrally coordinated rollout of new filtering rules rather than isolated operator actions. Users are advised that encrypted DNS no longer provides reliable privacy or circumvention and that full VPN tunnels remain the only robust option.

Why Simple VPNs No Longer Suffice Against Advanced DPI Blocking Telegram, Reels and Google AI Studio

Over the past year or two, users have observed that free VPNs and Telegram proxies often stop working after a few days, with Reels freezing, YouTube failing to load, Telegram stuck on Connecting, and Google AI Studio or Gemini returning errors. Modern filtering systems now analyze traffic behavior such as packet sizes, timing intervals, and TLS handshake characteristics rather than decrypting content. Techniques like TCP desynchronization via nfqws, MSS clamping with iptables, uTLS fingerprint emulation in sing-box, and ShadowTLS v3 for borrowing legitimate sessions are being deployed to evade detection. Padding is added to encrypted streams to reduce entropy and frustrate statistical shaping by TSPU systems. Commercial and self-hosted options including hynet.cloud, AmneziaWG, Red Shield VPN, GoodbyeDPI, and Cloudflare WARP each present distinct advantages and limitations when facing evolving network restrictions.