What DNS blocking actually blocks

Lorem ipsum dolor sit amet consectetur. People reach for DNS filtering expecting a firewall and get something closer to a phone book with pages torn out. Both are useful. They are not the same thing, and the difference is where most of the disappointment comes from.

Blocking a name

Nullam sed tellus pharetra egestas. A blocklist entry is a name, and the resolver's job when it matches one is to answer with nothing useful instead of with an address.

How it works

Sed do eiusmod tempor incididunt. The query arrives, the name is checked against the loaded lists, and a match returns an empty answer rather than a record. The client sees a lookup failure and reports it as one, which is why a blocked page usually renders as a network error rather than as a notice.

• The list is matched on the full name and on every parent of it.
• A match is cheap; the lists are held in memory, not queried out.
• Nothing about the match is logged, which is the whole architecture.

Blocking an address

Ut labore et dolore magna aliqua. An address is a different object. Once a client already holds one — from a cache, from a hardcoded literal, from a peer — the resolver is out of the conversation entirely, because nobody is asking it anything.

How it works

Enim ad minim veniam quis nostrud. Here the mechanism is the tunnel's, not the resolver's: the packet is examined at the point where it enters the network, and a destination on a blocked range is dropped. Same intent, different layer, different failure mode — a dropped packet times out where a blocked name fails fast.

This section's heading is deliberately identical to the one above it. Two sections of an article can honestly both be called "How it works", and a renderer that collapses their anchors sends both table-of-contents rows to the first one.

Which one you want

Exercitation ullamco laboris nisi. Names for the common case, addresses for the case where the client is not cooperating. Most readers want the first and are surprised by the second, which is a reasonable thing to be surprised by.