Why Uncensored DNS Matters

DNS censorship is invisible — and that's what makes it dangerous

When a website is blocked via DNS, you don’t get an explanation. You get an error. “Server not found.” “This site can’t be reached.” Your browser has no way to distinguish between a site that doesn’t exist and a site that’s been silently blocked by your resolver. That ambiguity is a design choice — and not an innocent one.

DNS censorship works by having your resolver return incorrect answers. Instead of the real IP address for a domain, it returns NXDOMAIN (as if the domain doesn’t exist) or redirects you to a block page. From the outside, a blocked domain looks identical to a broken one.

How DNS Filtering Gets Applied

Most Internet users connect through a resolver provided by their ISP. That resolver sits between your device and the authoritative DNS servers that hold the actual records — and it can intercept and modify responses before they reach you.

The ISP has full control over what answers it returns. If your government mandates that certain domains be unreachable, the ISP implements this in their resolver. No warning. No appeal. The domain simply stops working.

This is the mechanism behind most national internet filtering systems. It’s also the mechanism behind commercial filtering products and some “family-friendly” resolvers. The underlying technical approach is the same; only the blocklist differs.

The Problems With Resolver-Level Filtering

False positives are common. Blocklists are imperfect. Sites get added by mistake, by category (blocking an entire hosting provider because one subdomain hosted problematic content), or because someone with a legitimate grievance knows how to file the right form. The blocked site owner often has no practical recourse.

Blocklists are opaque. Who decides what goes on the list? Under what criteria? With what oversight? In most cases, these questions have no public answer. You’re subject to censorship implemented by an entity that doesn’t need to explain itself to you.

Scope creep is systematic. DNS filtering systems that start with narrow mandates tend to expand over time. “We only block CSAM” becomes “we also block terrorist content” becomes “we also block piracy sites” becomes “we also block gambling” — and each expansion happens with less public scrutiny than the last. The infrastructure built for one purpose is trivially repurposed for another.

You can’t opt out. If your ISP implements filtering, you can’t choose to receive accurate DNS answers — except by switching to a different resolver. Which is exactly what encrypted, uncensored DNS enables. Operators who don’t like that users can route around their filtering tend to respond by blocking encrypted DNS protocols at the network level, completing the circle.

One size fits nobody. A site that’s appropriate for adults isn’t appropriate for children. A site that’s legal in your country might be blocked due to a court order obtained in a different country. A security researcher needs to resolve domains that would trigger a malware filter. Blanket, undifferentiated filtering applied at the resolver level can’t accommodate any of this nuance.

The French Context

In France, ISPs are required by law to block certain domains. The mechanism varies: some court orders (LCEN, ARCOM) compel blocking of specific sites related to copyright infringement, gambling, or terrorism. More recently, administrative blocking orders can be issued without a court decision in certain categories.

French ISPs implement this through DNS filtering, BGP null-routing, or HTTP blocking — often all three at once. When a domain is added to the mandatory blocklist, French ISPs have no choice. It’s a legal obligation, not a policy decision.

le_dns is not an ISP. We are a DNS service. We are not subject to the same legal obligations that apply to internet access providers under French law. We do maintain an RPZ (Response Policy Zone) to implement blocks that courts have specifically ordered against DNS resolvers, but we are transparent about the existence of this mechanism and limit its scope to genuine legal requirements. We are not in the business of filtering the internet on behalf of anyone’s preferences.

On Malware Blocking

A common question: “If you don’t filter, what about malware domains?”

It’s a fair point. Filtering known malware domains at the resolver level does provide real security value. Services like Quad9 do this well — they maintain high-quality threat intelligence feeds and block malicious domains with low false-positive rates.

But there’s a meaningful difference between filtering as a service you explicitly choose and filtering imposed by default without your knowledge or consent. le_dns believes filtering should be opt-in and user-controlled, not a resolver-level default.

If you specifically want DNS-based malware protection, Quad9 (9.9.9.9) is an honest, well-run service and a reasonable choice. We won’t pretend otherwise.

Our position is that the default should be accurate, unmodified DNS responses — and that users who want additional filtering should choose a resolver that provides it, knowingly and voluntarily.

What le_dns Does (and Doesn’t Do)

We resolve DNS queries accurately. We return the correct answer for every domain that has one, regardless of its content, its country of origin, or anyone’s opinion about it.

We apply no commercial filtering. No “safe search” enforcement. No ad-blocking (though we also do no ad injection). No parental controls. No content categories.

We maintain an RPZ for court-ordered blocks affecting DNS resolvers specifically. This is a narrow, legally-defined category. We don’t expand it beyond what’s required.

We use DNSSEC validation — this means we reject responses that have been cryptographically tampered with at the infrastructure level, protecting against DNS spoofing attacks. This is not censorship; it’s integrity checking.

Want to compare us to other resolvers? See our comparison page. Ready to switch? Our setup guides get you running in minutes.