A share of the searches that reach this site ask for a “DNS to open blocked sites”. The short answer is that it sometimes works and sometimes doesn’t, and the difference lies in how your ISP blocks. This is about telling the two apart.
The three ways to block a website
When an ISP has to block a domain, it has three tools, from cheapest to most expensive.
DNS blocking. The ISP configures its own resolver so that, when someone asks for that name, it answers “doesn’t exist” or returns one of its own IPs with a notice page. By far the most common, because it costs nothing and doesn’t touch traffic. It only works if you use the ISP’s DNS, which is what everyone does by default.
IP blocking. The ISP drops traffic to the server’s IP addresses. It no longer matters how you resolve the name: the connection doesn’t arrive. It’s costlier to maintain (IPs change, and blocking a CDN IP can take down hundreds of unrelated sites), so it’s reserved for specific cases.
SNI blocking. In an HTTPS connection, the site name travels in the clear at the start (the SNI), even though the rest is encrypted. Some ISPs inspect that field and drop the connection if it matches the list. It needs traffic inspection equipment and is the method for “serious” blocks.
What DNS gets past and what it doesn’t
Changing resolver gets past only the first. Set 1.1.1.1 or 9.9.9.9 and your device no longer asks the ISP; it gets the real IP. Against the other two it does nothing, because the name is already resolved and the block acts afterwards, on the connection.
One important nuance: many ISPs that block via DNS also intercept conventional DNS traffic (port 53). It doesn’t matter that you set 1.1.1.1: the ISP captures the query and answers it itself. So if you’re changing DNS for this, it has to be encrypted: DoH or DoT. The ISP sees a TLS connection to Cloudflare or Quad9 and can neither read nor replace what’s inside. On Android that’s the “Private DNS” setting; on Windows 11, macOS and iOS it’s enabled in the network settings or with a profile; the configuration guides explain it per system.
How to tell which case you’re in
It takes a minute:
- Set an encrypted public DNS (for example
one.one.one.oneas Private DNS on Android, or 1.1.1.1 with DoH in the browser). - Try to open the site. If it opens, the block was DNS. Done.
- If it doesn’t, check that the name resolves: the DNS lookup tool returns the domain’s real IP. If it does but the site won’t load or times out, the block is by IP or SNI. Changing DNS won’t help you.
In the third case, what gets past the block is a VPN, which encrypts the whole connection and routes it through another country, or a browser that encrypts the SNI (Encrypted Client Hello, which Firefox and Chrome already support when the site does too). That’s another article.
Which DNS to use
For this purpose, an unfiltered resolver that isn’t under the same blocking order:
| Resolver | Name for Private DNS / DoT | IP |
|---|---|---|
| Cloudflare | one.one.one.one | 1.1.1.1 |
| Quad9 (malware only) | dns.quad9.net | 9.9.9.9 |
dns.google | 8.8.8.8 | |
| DNS4EU, unfiltered variant | unfiltered.joindns4.eu | 86.54.11.100 |
Avoid family or ad-filtering resolvers for this: they block on their own, and you’ll struggle to tell an ISP block from a resolver block.
And a special case in Spain: xdp.es does something no other resolver does. When a CDN IP gets blocked by court order (it has happened with Cloudflare during football matches), it answers with another IP from the same CDN that does work. It’s the only DNS-level workaround for an IP block, and only for that case.
What DNS doesn’t do
- It doesn’t change your IP address or your apparent country: sites still know where you are.
- It doesn’t encrypt your browsing, only the name lookups. The ISP still sees which IPs you connect to.
- It doesn’t get past IP or SNI blocks, as we’ve seen.
- It doesn’t open sites that are down or that block your country themselves (the site’s own geoblocking).
For all of that, the tool is a VPN. DNS is the tool when the problem is, specifically, that your ISP won’t resolve a name. Which is the most common problem, and why this article exists.
On legality
Changing the DNS on your own device is generally legal, and public resolvers exist precisely so that everyone can pick their own. The content you access is a separate question and depends on your country: if something is blocked by court order, accessing it may have consequences regardless of the technique. Here we explain how it works; what you do with it is up to you.