Google Public DNS

Russia Starts Blocking Encrypted DNS Protocols DoH and DoT Across Major ISPs

Since mid-August 2026, subscribers of Rostelecom, Dom.ru, Tattelecom, SkyNet and Beeline have reported sudden failures of encrypted DNS services from Google and Cloudflare. The blocking affects both DoT on port 853 and DoH on port 443, but the mechanisms differ: DoT connections receive TCP RST packets while DoH sessions are silently dropped after the TLS ClientHello. Analysis shows the interference originates from TSPU equipment performing DPI on SNI fields and known resolver domains. At the same time, ordinary UDP DNS queries are being intercepted and answered by the NSIDI infrastructure, returning NXDOMAIN for blocked domains. The changes indicate a centrally coordinated rollout of new filtering rules rather than isolated operator actions. Users are advised that encrypted DNS no longer provides reliable privacy or circumvention and that full VPN tunnels remain the only robust option.