DNS Censorship Check

Detect DNS poisoning, hijacking, and blocking on your network

DNS Censorship Check

Added in v4.0.0, the censorship check detects if your ISP is manipulating DNS responses — a common technique used in Iran to block websites.

How It Works

The tool resolves each domain through two paths simultaneously:

1. Your system DNS — whatever resolver your ISP provides
2. A trusted DoH resolver — Cloudflare’s 1.1.1.1 over encrypted HTTPS

If the results differ, your DNS is being poisoned. The tool also recognizes known Iranian censorship landing page IPs (e.g., 10.10.34.x).

Results

Each domain is classified as:

Status	Meaning
✅ Clean	Both paths return the same IPs
🔴 Poisoned	ISP returns different IPs than the trusted resolver
🚫 Blocked	Resolution fails entirely or returns a censorship page
⚠️ Error	Could not resolve through either path

Censorship Mechanism Detection

When poisoning or blocking is detected, the tool also identifies the specific censorship technique being used:

Mechanism	Description	Suggestion
DNS Injection	Known censorship IPs returned (e.g., 10.10.34.x)	Use encrypted DNS (DoH/DoT proxy)
DNS Spoofing	Different IPs returned, but not known censorship IPs	Use encrypted DNS with TLS fragmentation
DNS Block	Local resolver dropped or refused the query entirely	Try Smart Proxy with auto-fallback
NXDOMAIN Forgery	Resolver returned “no such host” for an existing domain	Use encrypted DNS

The mechanism and a countermeasure suggestion are shown in the output for each affected domain.

Interactive Mode

From the main menu, select [9] DNS Censorship Check:

• Verify specific domains — Enter a domain to check
• Check common blocked sites — Tests a curated list of commonly censored domains (Twitter, YouTube, Telegram, etc.)

CLI Mode

Check a specific domain

dns-mns verify example.com
dns-mns verify --json example.com     # JSON output

Check commonly censored domains

dns-mns blocked
dns-mns blocked --json                # JSON output

What To Do If Poisoning Is Detected

If you see poisoned or blocked domains, consider:

1. Use the Smart Proxy — dns-mns proxy starts an encrypted DNS proxy
2. Enable TLS fragmentation — dns-mns proxy --fragment sni to bypass DPI
3. Set encrypted DNS — Use DoH/DoT providers from the menu