Can IPv6 play a role in resisting internet censorship?
BackgroundEarlier this week a user on the Fediverse noticed that a website titled “w-social.eu,” recently went offline. Looking into its records, it appears that w-social.eu was a small typo-squatting website that encouraged visitors to use Mastodon if they wanted a free, trusted, and transparent social media service, instead of the highly controversial and intentionally anti-privacy platform, “W”.
Using historical DNS records, however, I was able to find that the site was actually still alive; it was only the domain name itself that was taken down. In other words, the site still existed, but you couldn’t use the w-social.eu name to get to it.
The most likely explanation here is that whomever registered the w-social domains (there were a handful of tlds) were either asked by the real “W” to sell the domain, or were threatened with some sort of legal action. From a business standpoint, this would make sense; users will be W’s product, so every user who decides to use an alternative service will be money that W doesn’t get.
Importance of DNSThe internet that most people interact with relies on a service known as Domain Name Service (DNS). The service itself is multilayered, but to simplify, DNS connects the dots between (“resolves”) a human-friendly domain name, like Google.com, and its computer friendly IP address, like 142.251.40.238.
As humans, it’s much easier for us to share a word or name than a series of seemingly random numbers, and DNS is the most common way to connect the two. If you’re old enough to remember phone books, DNS is like the phonebook for the internet, matching names to numbers.
DNS is incredibly important; in fact, if you connect to a wifi network on a smartphone but the phone cannot complete a DNS request on the network, it will typically tell you that the network does not have internet access at all. Many times, this can be an outright lie, but because we rely so heavily on DNS, it might as well be true.
Here, a user tried to access w-social.eu and concluded that “the site must be down” because the DNS request failed. This is the response nearly every internet user would have in this situation, but it’s not always an accurate conclusion. In this case, the server was still fully functioning, but because DNS did not resolve the domain name, it might as well have been gone entirely.
DNS and internet censorshipShutting down a server is difficult, even for Law Enforcement. If you have access to the DNS records, though, seizing/poisoning the domain name is much easier and accomplishes nearly the same thing. In the US, this is most frequently seen when federal Law Enforcement seizes a domain which was previously being used for serious illegal activity, like human trafficking or sharing Metallica mp3s. In those cases, the DNS record is updated to point to a server run by a federal agency and anyone who attempts to visit the site is greeted by a page like this:
The original webpage might still be publicly available on a server somewhere, but because the DNS link was broken, the page has, for most practical purposes, ceased to exist.
This same process can theoretically be used to effectively censor any website. In the US, speech (including written expression online) is considered a fundamental human right and is explicitly protected by the constitution. These same protections do not always exist in other areas of the world, however, and many countries utilize censorship for far less ethical reasons. In the EU, European Parliament passed the Digital Services Act in 2022 which requires the censorship of content deemed to be “misinformation”. Germany passed the Netzwerkdurchsetzungsgesetz in 2017 making online insults and, again, “misinformation” potentially illegal. Many middle-eastern countries censors LBGT content or content that displays women as equal to men. The list goes on.
For a large site like Google, instead of relying on DNS, you could bookmark the IP address itself (142.251.40.238) and ignore DNS entirely. For a smaller site, like this blog, however, the same technique won’t work for long. Because there are more servers than there are IPv4 addresses, many of these addresses get recycled and re-used. The DNS record for “blog.k3can.us” actually needs to get periodically updated as the IPv4 address of my server changes (known as “dynamic” DNS). This is done automatically with a small computer script, but it means that accurate DNS records are VERY important. When you try to connect to “blog.k3can.us”, it should always work because you’ll always get the current IP address. On the other hand, if you bookmarked this blog’s IPv4 address, 74.69.228.165, that bookmark would no longer work; that IP address is now assigned to someone else.
This makes smaller sites particularly vulnerable to DNS-based censorship (even accidentally). If the DNS records of k3can.us were tampered with, there would be no practical way for you to reliably reach this site over IPv4.
While IPv4 addresses ran out long ago, IPv6 addresses are expected to last for centuries (granted, the same was assumed about IPv4 40 years ago). Here’s the IPv6 address for this blog: 2601:188:cb7c:5585:be24:11ff:fe84:d47c. While IPv6 is far more difficult for a human to read and parse, it does make address recycling unnecessary1, meaning that IPv6 addresses typically remain static, even for small, self-hosted servers. With IPv6, you could record the IP address of your favorite website and then continue to access it even if the DNS record was out-of-date, removed or re-directed. For example, this command will fetch this blog post without requiring any DNS requests2:
curl --ipv6 -k --header 'Host: blog.k3can.us' \
https://[2601:188:cb7c:5585:be24:11ff:fe84:d47c]:443/posts/2026/may/dns-ipv6-censorship/
Obviously, this is far less convenient than just typing blog.k3can.us into your address bar, but the fact that it can work reliably without DNS is an important distinction.
Of course, direct IP access only helps if users already know the address. DNS remains the internet’s primary discovery mechanism, but once an address is known and shared, it becomes harder to erase access simply by modifying DNS records.
Better, but not immuneThat all said, IPv6 does not make a site immune to censorship, but it does weaken the dependency on DNS, which can help prevent one mechanism of censorship3.
As the internet evolves, governments around the world are working day and night to find new ways to further control and restrict this vast universe of information.
For a more robust solution to the problem of internet censorship, sites should consider making their content available through purpose-built solutions, like I2P and Tor. Both are designed to resist common censorship methods and to protect the identities of their users.
This blog is available on both TOR and I2P, using the links at the top.
You might ask why I host this blog on I2P or TOR, though. I don’t live in an oppressive country or take part in illegal activity, so why should I care about privacy or censorship?
- First, providing another website or blog via these services gives people a reason to use them, and it helps to normalize the idea of a privacy-focused internet.
- Second, “boring” content like this provides “noise” on the network. If the only people using TOR were whistle-blowers, undercover reporters and oppressed peoples, then the presence of TOR traffic would beacon their activity. But, if the majority of TOR users are just reading about why they should use RSS or are looking at photos taken on a Nintendo 3DS, then the presence of TOR traffic becomes scarcely more interesting than any other random internet noise.
- And third, it’s just fun. TOR and I2P are bandwidth restricted, so it feels very much like the early days of the internet. Sites are small and personal, and there’s far fewer ads and data harvesters.
I’d like to stress that the disappearance of w-social.eu likely was not censorship in the political sense, but it does demonstrate how fragile online presence can be when reachability depend entirely on a few centralized services.
IPv6 doesn’t solve that problem completely, but it does restore something the early internet had more naturally: the ability to reach a system directly, even without DNS.
And, if you have a small personal site, yourself, please consider making it available via TOR and I2P, too!
Until next time, netizens.
-
This doesn’t mean that IPv6 aren’t recycled, though. My ISP does not guarantee that my address will remain the same, but there’s little reason for them to change it. ↩︎
-
You might notice that the Host field still shows the human-readable domain name, but that’s only there so that my server knows which site to serve you; i.e. it tells my server that you want my blog, not my homepage.
There is also the matter of SSL/TLS. That command will fetch this post through an encrypted connection, but it does not guarantee that you receive the page exactly how I intended. ↩︎ -
For a great (albeit somewhat dry) summary of known internet censorship mechanisms and how they work, you can see RFC 9505 ↩︎
Thanks for subscribing to my rss feed!