What Is Internet Censorship?
Censorship is not one thing. It is DNS, ports, TLS names, packet inspection and active probing. Five layers, each answering a different question about your traffic.
Internet censorship is the deliberate prevention of communication across a network. That definition sounds abstract until you notice that it is achieved in practice by a stack of techniques, each aimed at a different layer, and that understanding which one is in play tells you which problem you actually have.
The most useful thing to know is that censorship is not one switch. It is a stack, and it is defeated or worked around one layer at a time.
Short answer#
Censorship operates at five layers, and they can be used independently:
- DNS — control which names resolve at all
- Transport — block the addresses and ports that carry traffic
- Session — read the hostname inside the TLS handshake and drop the connection
- Payload — inspect the shape of the encrypted traffic and classify what tool produced it
- Active — send your own probe to a server and see how it answers
Each layer is cheaper and more effective than the one above it. An operator who can block your server’s address does not need to inspect anything. An operator who cannot block your address can often still read the hostname. Only the last two layers require actually looking at your traffic, and they are the most expensive to run.
The five layers#
DNS#
The first and oldest layer. The network answers name lookups itself, and answers them with something false, or refuses to answer. You do not need to see inside anything to do this, because the name is already in the clear.
Because it is the cheapest layer, it is also the most common, and because it fails soft, it produces the confusing experience of “the site is down” when in fact the name is being lied about. Switching to encrypted DNS defeats this layer specifically, and only this layer, while moving the observation to whoever operates the resolver.
Transport#
IP and port blocking: refuse to carry traffic to a given address, or to a given address and port combination. No inspection at all, and it works against a known server address immediately.
This is the layer that makes IP addresses precious. A server that is discovered, reported, and blocked is gone, and the operational answer is rotation: many addresses, changing. That dynamic is the reason address management has become a discipline of its own rather than an afterthought.
Session#
TLS hides the contents of a connection, but the name of the server is usually still sent in cleartext in the handshake. Filtering on it requires no decryption at all.
This is why encrypted DNS alone is not enough, and why the hostname keeps appearing even after everything else is protected. It is also the cheapest layer that still lets an operator make a selective decision rather than an all-or-nothing one, which is what makes it the technique most often described as the modern censorship workhorse.
Payload#
When names and addresses are no longer enough, an operator inspects the traffic itself. Deep packet inspection is the general name for this, and it is the layer where encrypted traffic becomes statistically interesting rather than opaque.
This is the most computationally expensive layer, because it means classifying traffic that was specifically designed to look like noise.
Active#
The layer that changes the character of the problem. Instead of waiting for you to send traffic, the operator sends its own to your server, deliberately, to see how it answers.
Research published at ACM Internet Measurement Conference described this against Tor, SSH, and VPN protocols, and found something operationally surprising: the systems triggering active probes appeared to be distinct from the main censorship infrastructure, and blocked by address and port together rather than by address alone. A single blocking layer cannot neutralise it, because the probes arrive from directions you have no reason to expect.
Why it is built this way#
The layers are ordered by cost, and that ordering is the design. Blocking an address costs nothing and catches most users. Reading hostnames costs very little and catches users with new addresses. Classifying encrypted traffic is expensive. Probing servers actively is expensive and exposes the censor’s own infrastructure.
A mature censorship apparatus deploys all five, and the pressure it applies grows with each layer. This is the reason a tool can work for months and then stop working with no change to the tool: something moved down the stack.
How much of it there is#
Censorship is not only a matter of national infrastructure. Two independent bodies document its extent, and both make the point that the number is large and the trend is upward.
Access Now and the #KeepItOn coalition maintain the Shutdowns Tracker Optimization Project dataset, the most complete record of deliberate internet shutdowns since 2016. Their 2025 report, published on 31 March 2026, recorded at least 313 shutdowns in 52 countries, the highest annual total since the dataset began, and revised the 2024 figure upward from 296 to 304. Those totals are kept current, so an earlier figure will usually differ from the one a later report prints.
Shutdowns are the crude end of the spectrum: connectivity removed entirely. The subtler end is filtering, and here measurement research has found more than intuition suggests. The GFWeb study presented at USENIX Security 2024 found that a single national filtering apparatus maintains separate blocklists for DNS, HTTP and HTTPS, and averages hundreds of thousands of newly blocked domains per month across those three middleboxes. It also found overblocking, in which matches run wider than the intended target, and documented a case where a rule blocking a specific organisation’s domain also caught everything beneath it.
Freedom House’s annual Freedom on the Net assessment covers 72 countries and tracks what it calls key internet controls: obstacles to access, deliberate blocking of applications and technologies, and legal or regulatory pressure on providers.
Censorship vs surveillance#
They are different capabilities, and the difference is practical rather than semantic.
Censorship prevents. It acts on the network, decides whether a connection may exist, and can do so without ever reading the traffic. DNS filtering is censorship with zero content awareness: the operator lies about an address and learns nothing about what you would have fetched.
Surveillance observes. It records what happens, generally with no power to stop it. An encrypted connection that is being watched is still being watched: the observer records addresses, timings and volumes, which is often enough to answer the question they actually had.
The two are routinely combined, because an apparatus built for one sits close to an apparatus for the other. But they fail independently and they fail differently:
| Censorship | Surveillance | |
|---|---|---|
| Acts on | connections | records |
| Needs content access | no | not for metadata-level answers |
| Typical failure | overblocking, protocol drift | volume limits, legal limits, blind spots |
| What addresses it | censorship-resistant protocols | encrypted DNS, metadata hygiene, Tor |
The practical consequence: a censorship-resistant protocol protects you from being stopped. It does nothing about being recorded. Confusing the two is how people end up with a tunnel and no privacy, or with strong metadata hygiene and a connection that will not open.
What it means for someone using a tunnel#
Blocking differs from detection. A network can know you are tunnelling and be unable to stop it. It can also stop a specific protocol without knowing what it is. Both happen.
The failure you experience is specific. A connection that times out on port 443, a name that resolves to the wrong address, and a server that works until it does not, are three different problems with three different fixes. Naming the layer is most of the diagnosis.
Encryption is necessary and not sufficient. Every layer above the first is defeated by encryption, and every layer below it, the DNS layer in particular, is defeated by not encrypting DNS. A tool that handles the first without the second is a tool with a hole in it.
Rotation is infrastructure. For anyone operating a server, the pattern above means that address management decides whether an incident is an outage or a Tuesday.
Common misconceptions#
“Blocked means deleted.” Usually it means hidden, not removed. A domain blocked at DNS still exists, and may be reachable by address if you already know it, which is why the first thing to try with a blocked name is a different way to resolve it.
“Encryption defeats censorship.” It defeats the payload and session layers, and does nothing at all for name resolution or address blocking.
“If a site loads, censorship is not happening.” The interesting filtering is selective and cheap. You cannot infer the absence of censorship from one working page.
“Censorship is only about politics.” Filtering decisions are made constantly and mostly automatically, including against content nobody decided to target. Overblocking is a documented and measurable effect, not a rare edge case.
“Censorship and surveillance are the same thing.” They are different capabilities, and conflating them leads to tools chosen for the wrong job. The next section separates them.
Related#
- What Is Deep Packet Inspection? — the payload layer, in detail
- What Does Your ISP See? — what your network knows before anyone blocks anything
- What Is a VPN Protocol? — and why protocol choice is a censorship question
- Why a VPN Can Work Today and Fail Tomorrow — the five-layer model read against a documented failure record
- What Makes a VPN Resistant to Censorship? — the six-layer stack, from protocol to operations
Sources
- #KeepItOn: fighting internet shutdowns around the world Access Now
- Freedom on the Net Freedom House
- GFWeb: Measuring the Great Firewall's Web Censorship at Scale (USENIX Security 2024) USENIX
- Examining How the Great Firewall Discovers Hidden Circumvention Servers (IMC 2015) ACM SIGCOMM
- Exposing and Circumventing SNI-based QUIC Censorship of the Great Firewall (USENIX Security 2025) USENIX
Last reviewed October 22, 2026. This article was revised after publication. Corrections and additions are welcome.