Encrypted DNS in Russia is now a reachability problem, not a privacy win
Cloudflare and Google DoH/DoT endpoints are failing on Russian networks, but the largest public measurement found no protocol-wide block. That makes the breakage messier, not milder.
The Watch · Security desk
What happened
- Russian users reported failures reaching encrypted DNS resolvers, with Cloudflare's 1.1.1.1 and Google's 8.8.8.8 named as the targets.
- Comparable complaints followed from Rostelecom subscribers in Arkhangelsk and from Dom.ru and SkyNet customers in St Petersburg.
- Plain unencrypted queries to the same Google and Cloudflare addresses kept working in some cases where encrypted sessions would not establish.
Why it matters
- Who's exposed exposure Anything reachable from Russian networks that pins itself to an encrypted resolver now depends on a filter someone else operates, and the fault presents to the user as your service being broken.
- What it limits constraint Failure rates in the teens rather than the nineties remove the clean engineering answer of treating encrypted DNS as either available or blocked, and push the cost into retry and fallback logic.
- What doesn't add up contradiction One publisher reports blocking under way while the measurement's own author says no protocol-level block was found; read as per-address filtering, the mitigation and the forecast both change.
- What it sets up precedent A March trial on one telco that the ISP denied, followed by regional failures nobody has confirmed, suggests further resolvers get added quietly rather than gazetted.
Next story · Build · 1h ago
Cloudflare's Deno deal gives the runtime one more year of monthly fixesConfirmed2 publishers
The number worth pulling out of the ZaTelecom sample is not 3186. Participants ran 124 tests across 66 autonomous systems against 29 DoH servers on 22 and 23 August, according to Digital Report's account [16], which tops out at 3596 individual checks. The tally is 410 short of that, so the average run reached roughly 26 of the 29 endpoints, and the write-up does not account for the gap [27].
Headline success was 55%, rising to 73% once dead control addresses and errors from an outdated curl were removed [17]. That leaves 27% failure in aggregate, while Cloudflare's two endpoints failed 16 to 17% of the time and dns.google, Mozilla's Cloudflare address and several others sat between 4 and 9% [19][28]. The aggregate is being carried by cases like AdGuard's retired domain, which answered nothing in 90% of checks and was unreachable in 61 of 66 networks, against 8% failure for the current address of the same service [18].
Partial is the operationally awkward outcome. On Beeline's mobile network, Techora reported TLS connections to 1.1.1.1 and 1.0.0.1 on port 853 being reset while Google's dns.google timed out [9], and in some cases the same providers still answered plain unencrypted queries [11]. A reset comes back fast and a client can fall back; a timeout burns the full DNS timeout first, and a device pinned to DoT with no plaintext path simply stops resolving. Variance makes it harder to plan around: at Rostelecom, MTS, MGTS and SkyNet, between two and 17 services failed within the same network depending on the run, for reasons the measurement could not establish [21], while at Kompanon, NECSTEL and TeleMaks encrypted DNS was effectively absent [20].
Risky Business dated its bulletin 26 August 2026 and described blocking as under way [1]. The author of the Russian measurement concluded the opposite, that no sign of DoH being blocked as a protocol had turned up [13], and pointed out that the widely shared line about three thousand checks confirming a block inverts his own finding [23]. Both readings survive, because filtering particular resolver addresses and ports on particular networks is not a protocol ban, and 51 of the 66 networks were sampled once, leaving seven operators, about 11% of the set, with enough runs to support anything durable [22][29].
Roskomnadzor has confirmed nothing [5], the operators have not commented [12], and the March test on Beeline was denied by the ISP while outside experts documented it [6]. Set against the regulator's 2021 statement that it intended to block protocols hiding a user's destination, with DoH named [7], the pattern to design for is quiet, address-level filtering rather than an announced ban. Note what that filtering never needed to defeat: the ISP already saw which resolver was chosen and the connections that followed [24], and SNI stays in the clear without Encrypted Client Hello [26]. Confidentiality was not the pressure point. Reachability is cheaper to break.
What to watch
- Any on-record statement from Roskomnadzor, Beeline, Rostelecom or MTS, which would move this from inference about filtering to stated policy.
- Repeat runs on the handful of networks sampled more than once: failure rates that harden instead of fluctuating would indicate a standing rule.
- Whether DoH providers other than Cloudflare and Google start showing the same reset-and-timeout pattern.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption34
- Hype gap+42
- Incentives62
- Confidence61
Perspective Coverage
3 publishers- Builder
- Builder 30%
- Operator
- Operator 53%
- Investor
- Investor 17%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Risky Business published a Risky Bulletin podcast dated August 26, 2026, headlined "Russia starts blocking DoH and DoT", presented by news editor Catalin Cimpanu.
- [2]
Russian internet users began reporting problems connecting to DNS-over-HTTPS and DNS-over-TLS servers, suggesting a government crackdown on the two protocols.
- [3]
The reported bans cover Cloudflare's 1.1.1.1 and Google's 8.8.8.8 DNS servers.
- [4]
DoH and DoT hide a user's DNS queries and intended destination from ISPs and other parties on the wire.
- [5]
Blocks have been reported across several Russian regions, but Roskomnadzor has not confirmed an official block.
- [6]
Roskomnadzor appears to have tested the block in March on the network of Beeline, one of Russia's largest telcos; the ISP denied the block while technical experts caught and documented it.
- [7]
In 2021 Roskomnadzor said it planned to block any protocols that hid a user's intended destination, naming DoH as a prime candidate.
- [8]
Users of several Russian operators hit failures with Google and Cloudflare encrypted DNS services; available measurements confirm neither a Russia-wide DoH ban nor the regulator's direct involvement.
- [9]
According to Techora, on Beeline's mobile network Cloudflare's DNS-over-TLS stopped working reliably, with connections to 1.1.1.1 and 1.0.0.1 on port 853 being reset, while users simultaneously reported timeouts reaching Google's DoH endpoint dns.google.
- [10]
Similar complaints later came from Rostelecom customers in Arkhangelsk and from Dom.ru and SkyNet users in St Petersburg.
- [11]
In some cases, ordinary unencrypted queries to Google and Cloudflare DNS servers continued to work while encrypted connections could not be established.
- [12]
The reports contain no official comment from Roskomnadzor or the operators; they rest on user observations and self-run tests.
- [13]
The author of the measurement stated the outcome directly: no signs of DoH being blocked as a protocol have been found so far.
- [14]
DoH carries a DNS query inside an ordinary HTTPS connection and is described in RFC 8484; DoT solves a similar problem using a separate TLS connection on port 853, per RFC 7858.
- [15]
In Russia, DoH and DoT are typically used together with a VPN client to bypass state internet censorship and reach Western websites.
- [16]
The largest available measurement was run by the telecom channel ZaTelecom: on 22-23 August its participants performed 3186 checks, comprising 124 test runs in 66 autonomous systems against 29 DoH servers.
- [17]
Only 55% of requests succeeded at first glance; after excluding known-dead control addresses and errors caused by an outdated version of curl, the figure rose to 73%.
- [18]
AdGuard's old domain dns.adguard.com did not answer in 90% of checks and was unavailable in 61 of 66 networks, while another address for the same service, dns.adguard-dns.com, showed only 8% failed connections.
- [19]
The two Cloudflare services tested failed in 16-17% of cases, while dns.google, Mozilla's dedicated Cloudflare address and several other DoH servers were among the most available, with failure rates of 4 to 9%.
- [20]
Encrypted DNS was almost entirely unavailable at three small providers: Kompanon, NECSTEL and TeleMaks.
- [21]
At Rostelecom, MTS, MGTS and SkyNet, results changed from run to run: within the same network, between two and 17 services could fail to respond, and the cause of the fluctuation was not established.
- [22]
51 of the 66 networks were checked only once; more or less stable conclusions are possible only for seven operators where at least three runs took place.
- [23]
Digital Report notes that the widely circulated claim that "more than three thousand checks confirmed the block" contradicts the researcher's own conclusion; the checks confirmed uneven failures of individual servers and networks, not a nationwide ban.
- [24]
Encryption does not make the user invisible: the provider cannot see the query contents but knows the address of the chosen DNS server and still observes subsequent connections to site IP addresses.
- [25]
The DoH operator itself, for example Google or Cloudflare, receives the user's queries, so the technology moves trust from the ISP to an external DNS service.
- [26]
DoH by itself does not conceal SNI, the server name that can be sent when establishing an HTTPS connection; protecting it requires Encrypted Client Hello.
- [27]
124 runs against 29 servers would yield up to 3596 checks, so the reported 3186 is 410 short, an average of about 26 of the 29 endpoints reached per run.
- [28]
A 73% success rate implies 27% aggregate failure, above Cloudflare's 16-17% and well above the 4-9% band that included dns.google.
- [29]
Seven of 66 networks, about 11%, had enough repeat runs for durable conclusions, while 51 of 66, about 77%, were sampled once.
Sources
2 independent publishers whose own reporting we read for this story.
- Digital Report
digital-report.ru
1 article · August 25, 2026
- news.risky.bizRisky Bulletin: Russia starts blocking DoH and DoT
1 article · August 25, 2026
- risky.bizRisky Bulletin: Russia starts blocking DoH and DoT
2 articles · August 25, 2026
Topics and entities
Topics
- Resolver resilience and fallback
- Network measurement and methodology
- Encrypted DNS (DoH/DoT)
- Internet censorship and filtering