Here’s a thing about the Great Firewall that took me a while to get my head around: it does not block a censored DNS lookup. It answers it. You type a forbidden domain, your query goes out, and a reply comes back fast — with an IP address in it. The address is a lie. But it’s a well-formed, confidently-delivered lie, and your computer has no way to tell it apart from the truth. The censored lookup didn’t fail. It succeeded, at getting the wrong answer.
That distinction is the whole trick, and it’s why DNS is the layer where the largest censorship systems on earth do their quietest work. A dropped packet is a symptom you can see. A wrong answer that arrives on time looks exactly like a right one.
The race nobody tells you you’re in
DNS over UDP — still the overwhelming default — has no authentication and no session. You send a single packet asking “what’s the address for example.com?” and you accept the first single packet that comes back with a matching transaction ID and question. First answer wins. There’s no second-guessing, no “are you sure,” no signature to check. The protocol was designed in the 1980s for a network where the only thing that answered your question was the server you asked.
A national firewall sits on the path between you and the outside internet, watching queries stream past. It doesn’t have to be the server you asked. It just has to be faster. When it sees a query for a domain on its blocklist, it forges a response and injects it back toward you. Because the injector is physically closer than the real authoritative server — often thousands of miles closer — its forged packet arrives first. Your resolver takes it, caches it, and moves on. The genuine answer shows up a few milliseconds later and gets dropped on the floor as a duplicate.
The elegant, horrible part is that the firewall never touches your original query. It doesn’t need to drop anything or terminate a connection — actions that would be conspicuous and expensive at national scale. It lets your packet sail right through to the real server. It just makes sure a counterfeit gets home first. This is on-path injection, and it’s cheaper and stealthier than actually standing in the road.
The lies point at real servers
You’d think a censor would send blocked lookups to a black hole — 0.0.0.0, or a government “this site is blocked” page. Some do. China’s, for years, mostly didn’t.
The most thorough public measurement of this is GFWatch, a platform that tested 534 million domains between April and December 2020 and catalogued how the Great Firewall answers. It found the forged responses drawing from a pool of 1,781 distinct IPv4 addresses and 1,799 IPv6 addresses — and the striking finding is that the vast majority of those IPv4 addresses are real, routable addresses belonging to real companies, including Facebook, Dropbox, and Twitter.
Sit with that. A user in China looks up a blocked domain and gets handed the address of a Dropbox server. Their browser dutifully opens a connection to a machine that has nothing to do with the site they wanted and no idea why traffic is arriving. Multiply that across a population and you’ve quietly turned a handful of American companies’ servers into the unwitting sinkhole for a nation’s censored DNS — a denial-of-service that nobody ordered and the victims can’t switch off. Whether that’s a deliberate flourish or just what falls out of a system built for volume over precision, the effect is the same.
GFWatch counted 311,000 censored domains in that window. About 270,000 were plausibly the intended targets. The other 41,000 were innocent — swept up because the firewall matches domains with blunt regular expressions. A rule meant to catch torproject.org also catches any domain with that string sitting inside it, so tens of thousands of unrelated sites went dark as collateral. The blocklist isn’t a list. It’s a pattern, and patterns overreach.
The poison doesn’t stay home
If injection only affected people inside the censored country, it would still be worth understanding. It doesn’t stay inside.
Because the firewall poisons any query that crosses its path, and internet paths are not tidy, forged answers routinely leak to people the censor never meant to touch. The canonical incident happened in March 2010, when a DNS administrator at NIC Chile named Mauricio Ereche reported something impossible: users in Chile were looking up facebook.com, twitter.com, and youtube.com — none of them blocked in Chile — and getting back bogus addresses. The censorship was Chinese. The victims were in South America.
The cause was a plumbing accident. Several DNS root server identities (F, I, and J among them) had anycast instances inside China — copies of a root server physically located behind the firewall. One of them was an I-root instance operated by Sweden’s Netnod. A routing misconfiguration at an ISP outside China carried that instance’s route beyond the border, so some queries from Chile were steered to a root server sitting behind the Great Firewall — and the firewall injected its forgeries on the way back. The fix was the only one a leaking anycast node allows: the instance was cut off from international routing.
That was sixteen years ago, and the leakage never fully stopped. GFWatch found that the forged records for 77,000 censored domains had polluted public resolvers used worldwide — including Google, Cloudflare, and OpenDNS. A resolver that happened to route a query through a poisoned path could cache the lie and serve it to its own users, who might be anywhere. The censor’s blocklist became, accidentally, a little bit everyone’s.
Why the obvious fixes mostly don’t fix it
The instinct is to reach for DNSSEC. On paper it’s the exact countermeasure: DNSSEC signs DNS records, so a validating resolver can detect that an injected answer isn’t signed by the real zone and reject it. In practice it does almost nothing here, for two boring reasons. First, most zones still aren’t signed — DNSSEC adoption has crawled for two decades. Second, and worse, the thing that usually asks the question — the stub resolver built into your operating system — doesn’t validate signatures at all. It trusts its upstream resolver to do that, over the same unauthenticated UDP the firewall is already forging. The forgery arrives before any validation could matter.
What actually moves the needle is getting the query off plaintext UDP where the on-path injector can read it. DNS-over-HTTPS and DNS-over-TLS wrap the lookup in an encrypted channel to a resolver you chose, so the firewall can’t see the domain you’re asking about and can’t slip a packet into a conversation it can’t read. That’s real protection — right up to the encrypted resolver, which is now the one party you’re trusting completely, and which the network can still block wholesale or which may sit inside the censored jurisdiction itself. You’ve moved the trust, not eliminated it.
The only defense that survives a lying network
Step back and the shape of the problem is bigger than any one country. A national firewall is just the largest, best-funded example of a general fact: the network between you and an answer can lie to you, cheaply, and the lie can look perfect. DNS hijacking by compromised routers, malicious hotel Wi-Fi, a misconfigured corporate middlebox — same shape, smaller blast radius.
There is exactly one defense that doesn’t depend on trusting the liar, and it’s the oldest idea in intelligence work: don’t believe a single source. If you ask one resolver for an address and it gives you one, you’ve learned what that resolver — and everything on the path to it — wants you to think. If you ask a dozen resolvers from a dozen vantage points and eleven agree while one insists a blocked site lives at a Dropbox IP, you haven’t just found the right answer. You’ve found the injector.
That’s the whole reason distributed observation and cross-verification exist as a discipline. A single lookup is a rumor. A quorum of lookups from independent vantage points is evidence, and disagreement between them is a map of exactly where someone is interfering. The Great Firewall is powerful because it can lie to the people standing next to it. It has never figured out how to lie to everyone, everywhere, at once — and that gap is where the truth still lives.