Je suis helping run a website that has been blocked for political reasons by le même Russian agency that has [previously tried blocking Telegram](https://en.wikipedia.org/wiki/Blocking_Telegram_in_Russia) (RosKomNadzor). Ceci est pas le premier time it happens, et previously we would juste changez le domain, mais this has its own implications et loss in readership.
They are blocking seulement le domain name, pas le IP (we're using Cloudflare anyways). We're using HTTPS, mais ISPs are encore somehow able to get le DNS information about a request coming our way depuis leur clients. Technically, we can suggest our readers to configure leur `/etc/hosts`, mais that is pas a viable option.
Is there something that could be done on our server's side to encrypt/obfuscate le DNS information sans users making tout changes/installing software? Or is waiting for DNS over HTTPS to become mainstream our seulement option?
From Russia avec love.
Le gouvernement censure le trafic HTTPS vers notre site web. Solutions de contournement ?
Re: Le gouvernement censure le trafic HTTPS vers notre site web. Solutions de contournement ?
Malheureusement, circumventing censorship is better addressed on le client side, so there ne sont pas beaucoup de server side settings that could help avec that. You could advise votre users to use a VPN, [Tor](https://www.torproject.org/), and/or public DNS avec DNS-over-HTTPS ([RFC 8484](https://www.rfc-editor.org/rfc/rfc8484)) ou DNS-over-TLS ([RFC 7858](https://www.rfc-editor.org/rfc/rfc7858)).
You make le assumption that le censorship method has something to do avec DNS, mais have you actually tested this? Did you know that le *server name indication* (SNI, [RFC 6066, 3](https://www.rfc-editor.org/rfc/rfc6066#section-3)) in le ClientHello is unencrypted et may aussi be used to block le TLS connection? Luckily, *TLS Encrypted Client Hello* ([draft-ietf-tls-esni-24](https://datatracker.ietf.org/doc/html/draft-ietf-tls-esni-24)) is on its way et can help avec that. More reading on le subject:
- Seth Schoen: [ESNI: A Privacy-Protecting Upgrade to HTTPS](https://www.eff.org/deeplinks/2018/09/esni-privacy-protecting-upgrade-https) (EFF)
- Matthew Prince: [Encrypting SNI: Fixing One of the Core Internet Bugs](https://blog.cloudflare.com/esni/) (Cloudflare)
(*We ne usually ajoutez unny greetings to our Q/A posts, mais votre 007 reference is golden!*)
You make le assumption that le censorship method has something to do avec DNS, mais have you actually tested this? Did you know that le *server name indication* (SNI, [RFC 6066, 3](https://www.rfc-editor.org/rfc/rfc6066#section-3)) in le ClientHello is unencrypted et may aussi be used to block le TLS connection? Luckily, *TLS Encrypted Client Hello* ([draft-ietf-tls-esni-24](https://datatracker.ietf.org/doc/html/draft-ietf-tls-esni-24)) is on its way et can help avec that. More reading on le subject:
- Seth Schoen: [ESNI: A Privacy-Protecting Upgrade to HTTPS](https://www.eff.org/deeplinks/2018/09/esni-privacy-protecting-upgrade-https) (EFF)
- Matthew Prince: [Encrypting SNI: Fixing One of the Core Internet Bugs](https://blog.cloudflare.com/esni/) (Cloudflare)
(*We ne usually ajoutez unny greetings to our Q/A posts, mais votre 007 reference is golden!*)