Spotting DNS Poisoning Versus Straight Network Blocking

Australians who tinker with their home network or troubleshoot dodgy internet connections often wonder whether their ISP is interfering with lookups or simply refusing to route certain traffic. The difference matters because each form of interference needs a different workaround, and mistaking one for the other can leave you chasing your tail with the wrong fix. ACMA's section 313 blocking orders, court-ordered piracy injunctions, and assorted voluntary filtering arrangements by carriers such as Telstra and Optus all sit behind the scenes, and the way they show up on your screen varies dramatically.

This piece unpacks how to tell DNS manipulation apart from outright IP-level blocking without needing a degree in network engineering. You'll pick up the practical tells that show up on a typical Aussie NBN link, learn which free tools settle the question in minutes, and walk away with a single concrete step you can run tonight.

The Mechanics Behind the Two Approaches

DNS poisoning happens when your ISP's resolver returns a deliberately wrong answer to a lookup. Type thepiratebay.org into your browser and instead of returning the real IP address, the resolver hands back an address that leads nowhere useful, sometimes to an ACMA-style "this site has been blocked" splash page hosted on the carrier's own infrastructure. Because the redirection happens before any connection to the intended server, every app on your device is affected — browsers, email clients, mobile apps that ping home. The hijacking is typically done by an active middlebox that rewrites responses on the fly.

Simple blocking, sometimes called IP-level blocking or null routing, is cruder. The ISP either drops traffic to specific IP addresses using access control lists on its routers, or it blackholes routes so packets have nowhere to go. Your device resolves the domain name correctly — the DNS answer is honest — but the connection to the resulting IP simply times out, hangs, or returns a generic "this site can't be reached" message in Chrome. It's blunt but effective, and it's what you typically see when a court has ordered the carrier to block a piracy site without mandating a fancy redirect.

Both approaches can be layered. A single target might first hit DNS poisoning for casual users, then IP-level blocking for anyone clever enough to swap resolvers, and a properly motivated carrier will use both belts and braces.

Side-by-Side Comparison

A quick reference helps clarify what each technique produces when you test a suspect domain.

Symptom or Test	DNS Poisoning	Simple IP Blocking
Domain resolves to	Wrong IP / sinkhole / local blockpage	Correct IP, but unreachable
Browser message	"Server DNS address could not be found" or a carrier-hosted warning page	"This site can't be reached", long timeout, or ERR_CONNECTION_TIMED_OUT
Apps affected	All apps on the device (browser, mail, games)	Apps using the blocked IP and port; sometimes only HTTP
nslookup / dig result	Returns the ISP's fake IP or 127.0.0.1-style sinkhole	Returns the genuine IP
ping or traceroute	May show success to a nearby fake server, or fail at the first hop	Fails at the ISP's edge router
Bypassed via	Encrypted DNS, DoH, VPN, or alternate resolver	VPN, Tor, or routing around the block
Common in Australia for	ACMA-mandated blocks, gambling sites, piracy injunctions	Specific court orders, large-scale piracy infrastructure

The key insight is what happens when the domain resolves: a poisoned resolver hands you a lie, while simple blocking hands you the truth and then refuses to let you act on it.

What Australian Users See Day to Day

In Sydney, Melbourne, and Brisbane, the most visible interference tends to be DNS-based, since it lets the carrier present a polite notice page rather than a confusing timeout. The big three — Telstra, Optus, and TPG — have hosted ACMA-mandated blockpages on their own infrastructure for years, and smaller providers like Aussie Broadband have generally followed suit on voluntary grounds. If your browser suddenly lands on a page with carrier branding telling you the requested URL has been blocked under Australian law, you've almost certainly hit DNS poisoning.

By contrast, users in regional areas on Sky Muster satellite, or folks running iiNet legacy services, sometimes report that a domain simply stops loading with no splash page at all. That's usually a sign of route filtering — the kind of crude blocking that doesn't bother with explanations. Foreign sites, gambling platforms that hold an .au license, or sites caught up in international sanctions enforcement often get this treatment.

A telling local clue: if switching your device to Google Public DNS (8.8.8.8) makes a previously broken site load correctly, your ISP's own resolver is almost certainly the culprit. Aussies tend to call this "the old switcharoo" when describing it down at the pub.

Gambling-related blocking also brings up interesting jurisdictional questions. When a player looks for new casino Pontoon coverage, the difference between a domain that simply times out and one redirected to a polite notice page can shape what they end up seeing. Travellers using hotel Wi-Fi in Bali or Singapore should also familiarise themselves with public DNS risks abroad before assuming a foreign resolver is being honest with them.

Tools for Detecting Each

The cheapest way to tell the two apart is a combination of three free tools, none of which require installing anything on your typical home laptop. First, open a terminal or Command Prompt and run nslookup example.com using your ISP's default resolver, then again using 8.8.8.8. If the first returns a strange address or a known sinkhole and the second returns the genuine IP, you've caught DNS poisoning red-handed.

If both lookups return the same genuine IP but the site still won't load, move to ping and traceroute. A traceroute which dies at a hop belonging to your carrier — say, somewhere inside Telstra's AS1221 network — without ever reaching the destination indicates the IP is being dropped or blackholed at the carrier's edge. That's classic simple blocking.

A guided walkthrough lets anyone test their ISP's DNS without needing a degree in networking, which is handy if the terminal feels intimidating.

For users who suspect the carrier is silently logging or rewriting their traffic, layering a connection through a reputable encrypted tunnel often resolves the question immediately. Services like the Akoder network provide an additional route that bypasses both DNS and IP-level interference, which is particularly useful for users in the Top End wanting to verify whether their carrier is the bottleneck.

Practical Steps and Implications

Start tonight by opening a terminal on your laptop and running nslookup on three categories of site: a major international news outlet that should always resolve correctly, an Australian site you know is clean, and a site you've previously had trouble reaching. Compare the answers across your default resolver, 8.8.8.8, and 1.1.1.1. If the answers differ, your ISP is interfering with DNS.

If the answers all line up and you still can't reach a site, run traceroute to its IP. Anything that dies inside your carrier's network, rather than across the public internet, points to IP-level blocking. Once you know which technique is at play, you can choose the right bypass: DoH or DoT to outflank DNS poisoning, and a VPN or Tor to dodge IP-level blocking.

The implications stretch beyond a single blocked site. Researchers working to preserve indigenous cultural archives across the Asia-Pacific region rely on these same diagnostic techniques to confirm whether geographic throttling is at fault when material won't load. The same toolkit that lets you check whether your carrier is meddling with a pirate-bay mirror also helps verify whether an educational resource is being silently held back.

Pick the bypass that matches the technique you've identified, and you can sidestep most carrier interference within minutes. Run one nslookup tonight against your ISP's default resolver and compare it against 8.8.8.8 for any domain you've struggled to reach — if the two answers differ, you've confirmed DNS poisoning in under a minute.