Where regional internet exchange points reshape digital borders

The quirks of censorship in countries with regional internet exchange points often begin with a mistaken assumption: that the exchange itself decides what residents can reach. In practice, an IXP is a shared switching fabric where participating networks hand traffic to one another. Filtering may occur inside a participating ISP, at a DNS resolver, or along the route to the origin server; the exchange fabric usually makes none of those decisions.

Local peering changes what a test can reveal. Australian requests for domestic content may stay on a domestic route, while overseas content enters through a handful of transit providers and submarine cable systems. A failure can therefore reflect an ISP edge policy, a resolver response, a congested peering interface, or ordinary service behaviour. Net Neutrality Monitor helps separate these possibilities by publishing blacklists, probes, DNS observations and country-level results, while accepting user-submitted URLs and IP addresses. It is a beta, volunteer-supported project developed and powered by AirVPN, and its figures are best treated as indicative research evidence.

Peering is local, not neutral

Domestic traffic frequently stays on an Australian route when both client and service sit on local networks. Peering removes a long-distance transit hop, but it also allows each ISP to apply its own edge controls before handing packets to another network. A filter that appears country-wide may therefore be implemented by a few providers, with the IXP simply carrying the resulting traffic.

Filtering layer	Typical symptom	Why peering location matters	Useful cross-check
DNS	NXDOMAIN, SERVFAIL or a sinkhole address	The resolver may be operated by the ISP or reached through a different route	Repeat through a second Australian network and record the resolver
Destination IP	Timeout, reset or unreachable host	An address block can affect unrelated domains that share infrastructure	Test the domain and compare IPv4 with IPv6
Domain or SNI	TLS handshake reset or an unusual proxy error	The hostname may be visible only on some paths	Compare with direct access to a known IP address
Application	A block page, failed sign-in or altered content	This can reflect account policy or application logic rather than transport censorship	Reproduce in a clean session on another connection

None of these symptoms identifies the filtering actor on its own. Local caching, anycast routing and stale DNS records can imitate censorship, while a genuine block may be hidden when a resolver substitutes a sinkhole. The useful question is whether independent networks resolve and reach the same target consistently.

Layered evidence is not unusual in safety-critical work. A drone risk matrix illustrates how planners combine assets, pathways and mitigation instead of treating one sensor reading as decisive; the same discipline helps distinguish a national policy from a single provider’s implementation.

DNS filters create moving borders

DNS is a frequent source of strange borders because resolution happens before the browser opens a connection. A user on an Australian NBN line may use the retail ISP’s recursive resolver, while a mobile user may reach the carrier resolver, a cached public answer or a resolver in another jurisdiction. The same hostname can therefore return different addresses or failure codes within one city.

Encrypted DNS adds another variable. DNS over HTTPS and DNS over TLS can bypass an ISP’s transparent interception, but their effect depends on which resolver receives the query and whether the application uses them at all. A change of endpoint—from a carrier resolver to a public resolver or a private service endpoint—can alter the observed result, so a resolver must be recorded rather than assumed.

Routes and protocols expose uneven blocks

Once a hostname resolves, routing and protocol controls decide whether content is delivered. A carrier may block a destination IP, while an edge appliance may inspect the requested domain or TLS Server Name Indicator. CDN anycast can send the same request to different caches in Sydney, Melbourne and overseas, and IPv4 and IPv6 may follow separate policy paths. One blocked route need not represent every route to the service.

Shared hosting creates the opposite quirk: blocking an IP can sweep up unrelated tenants, and an erroneous blacklist entry may look like deliberate censorship when it is collateral damage. Conversely, an ISP can block only DNS for selected names while allowing direct connections to known addresses. Neumon’s country reports can place a failed probe beside comparable observations, but the underlying timestamp, network and error type remain essential.

One blocked address proves little

A measurement becomes stronger when the observer, target and method are all explicit. A useful record names the exact URL or IP, the timestamp and time zone, the country, the access network, the ISP or carrier, the resolver, the IP version and the observed response. Repeated tests across fixed broadband and mobile networks then show whether an interruption is stable or incidental.

Results also have a probabilistic side. Like any game probability calculations, an apparently clean result does not establish the state of every session. A few unexplained failures can be noise, while one consistent pattern across networks is more informative. Reports should label certainty honestly and avoid turning a failed login, a region-locked stream or a slow server into evidence of censorship.

Australian conditions shape the result

Australian conditions make these distinctions particularly visible. Sydney and Melbourne contain major peering points, caches and data-centre ecosystems, so requests for local services often reach an Australian network without leaving the country. A block applied at that domestic edge can affect residents while remaining invisible to an overseas observer. Brisbane, Adelaide and Perth users may encounter different transit paths and ISP enforcement for the same site.

Everyday connectivity changes the result. A commuter tethering from Telstra, Optus or Vodafone mobile may use a different resolver and edge filter from the same person’s NBN connection at home. Public Wi-Fi at a library or café adds another network path, while common habits—video calls during the morning commute, streamed sport in the evening and app updates on suburban broadband—can make selective blocks easy to encounter.

Regulation adds another layer. The Telecommunications Act 1997 and powers held by the Australian Communications and Media Authority allow targeted blocking and enforcement, while the Online Safety Act 2021 and eSafety processes address online harms and illegal material. There is no single universal blocklist applied to all traffic at Australian exchange points; interventions are shaped by legislation, court or regulator action, and individual provider policy. That fragmented model can produce inconsistent results across the local market.

Building a defensible monitoring record

A defensible monitoring record combines the project’s published blacklists, probe logs, DNS observations and statistical summaries with raw observations from users. Each item can reveal a different aspect: a hostname may disappear from DNS, an IP may become unreachable, or several networks may return the same redirect. Comparing layers is more reliable than labelling any one symptom as proof of state censorship.

Country context should accompany the result, including the access technology, carrier, local law and time of observation. This avoids confusing ordinary content restrictions with network-level filtering and preserves the distinction between a policy affecting an entire country and a service that happens to be unavailable in one place. Because Net Neutrality Monitor is a beta project developed and powered by AirVPN, its data supports indicative research rather than a formal legal finding.

The next concrete step is a paired submission: test one identical URL from an Australian NBN connection and an Australian mobile connection, then submit both responses with timestamps to the Net Neutrality Monitor country dataset.