Website Blocking Methods Explained (DNS, SNI, and IP Blocking)

The same result — "blocked" — can come from very different mechanisms, each with its own difficulty to bypass.

DNS Blocking — Stopping It at the Lookup Stage

A method that deliberately returns a wrong answer, or no answer at all, when a device looks up a domain name through DNS. An ISP or network administrator configures its DNS servers to return a landing/notice page's address instead of the real IP, or simply not respond, for specific domains. It's relatively simple to implement, but easy to bypass — switching to a different public DNS server (like 1.1.1.1 or 8.8.8.8) or using DNS over HTTPS (DoH) gets around it easily.

IP Blocking — Blocking the Destination Address Itself

A firewall or router simply refuses to pass any packet addressed to a specific IP, regardless of domain name. Unlike DNS blocking, it can't be bypassed by switching DNS servers. But because many unrelated sites often share the same IP address (on the same CDN or cloud provider), IP blocking can easily cause "overblocking" — accidentally taking down other, unrelated sites too.

URL and Keyword Filtering

A proxy or firewall inspects the address or content of unencrypted HTTP requests, and cuts the connection or redirects to a notice page if a banned string is found. This approach fundamentally can't be applied the same way to encrypted HTTPS requests, which is a serious limitation now that HTTPS accounts for the vast majority of web traffic.

SNI Blocking — Reading the Domain Name Exposed Before Encryption

Watches for the SNI (Server Name Indication) field, which is sent in plain text during the very start of an HTTPS connection's TLS handshake, even though the actual data that follows is encrypted. HTTPS encrypts the data itself, but the ClientHello message at the start of the handshake includes an unencrypted SNI field identifying which server the client wants to reach. SNI blocking works by watching for this plain-text domain name mid-transit and forcibly cutting the connection if it matches a blocklist — a method that has sparked public debate in several countries. As Encrypted Client Hello (ECH) from TLS 1.3 becomes more widely adopted, SNI blocking is expected to become progressively harder to pull off.

Deep Packet Inspection (DPI) — A More Sophisticated Approach

DPI goes beyond looking at headers, addresses, or ports — it analyzes a packet's actual payload to identify the application or protocol in use, or detect specific file types or traffic patterns. It's used both for national-level internet censorship and for corporate traffic management (QoS). It's expensive and processing-intensive to implement, but it's the most precise way to classify traffic.

Comparing How Hard Each Method Is to Bypass

DNS blocking is generally considered the easiest to bypass, using a different DNS server or an encrypted DNS protocol like DoH or DoT. SNI blocking can be bypassed with Encrypted Client Hello (ECH) or a VPN. IP blocking and DPI, on the other hand, are considerably harder to get around unless a VPN changes where your traffic exits from entirely. In practice, national or institutional blocking systems often layer several of these methods together.

Want to know more about encrypted DNS?

DNS over HTTPS (DoH) and DNS over TLS (DoT) both encrypt the DNS lookup itself, which is exactly what makes them effective at bypassing basic DNS blocking. Rather than sending a plain-text query that an ISP's DNS server, or anyone watching the traffic, can inspect and tamper with, these protocols wrap the request inside an encrypted channel, so only the final result reaches the user unaltered.

How a VPN changes the picture

A VPN reroutes your traffic through an encrypted tunnel to a server elsewhere, so from the local network's point of view, all it sees is encrypted traffic heading to the VPN server's IP address — none of the DNS, SNI, or content details that the blocking methods above rely on are visible anymore. That's why a VPN can bypass most of these techniques at once, though it doesn't change how blocking works at the destination site itself.

Frequently Asked Questions

Is it the same principle when a specific site is blocked on a company firewall?

Yes, the underlying mechanism isn't very different from country-level blocking. Corporate and school network firewalls commonly combine DNS blocking, URL filtering, and SNI blocking to restrict access to specific sites or services.

Why has SNI blocking been controversial?

SNI blocking only inspects a small piece of an HTTPS connection (the domain name), but it has drawn controversy for a few overlapping reasons: concerns about the practice of intercepting communications at all, the risk of affecting unrelated sites that happen to share the same server, and broader public debate in various countries over governments directly restricting access to specific websites.