Why DNS Blocks Don't Always Cover IP Address Access

When Australians fire up their laptops in Bondi, Brisbane or Bunbury and a website suddenly refuses to load, the cause is often a silent redirection at the DNS resolver sitting inside the local ISP. Telstra, Optus and TPG all operate recursive resolvers that customers are pushed toward through DHCP, and those resolvers can quietly return a different IP address than the one the domain actually points to. The result feels like censorship, yet the site itself is still happily running on its real IP. Understanding the gap between the two is the first step toward knowing whether you are being filtered or simply experiencing a routing hiccup.

This gap is the whole reason volunteer monitoring projects exist. By probing the same hostname against dozens of resolvers across the country, a measurement platform can show, side by side, that one ISP hands back a blackhole page while another returns the genuine answer. The mismatch is not a glitch in the internet; it is the predictable consequence of choosing a filtering layer that only speaks domain names.

How DNS Filtering Actually Works

Every time you type a URL into your browser, a lookup happens first. The request travels to a recursive resolver, usually operated by your broadband provider, which then walks up the DNS hierarchy until it finds the authoritative answer. A DNS filter intervenes at that first hop. If the hostname matches a list, such as the ACMA-mandated block list applied under the Broadcasting Services Act, the resolver returns a forged record, often pointing at an IP that hosts a warning page run by the eSafety Commissioner or the ISP itself.

Because the filter only ever sees the domain name, it has no idea what is happening at the IP layer. It cannot know whether your machine has a cached copy of the genuine record from a previous session, whether you have hard-coded a hosts file entry, or whether you have decided to bypass the ISP resolver entirely and talk straight to a public resolver like 1.1.1.1 or 8.8.8.8. The filter is, in effect, a doorman who checks the sign on your invitation but never the contents of your pockets.

Why IP-Based Blocking Is a Different Beast

An IP block operates on a completely different network layer. Instead of intercepting a domain name lookup, the ISP, or an upstream carrier, installs an Access Control List on a router that drops or reroutes packets destined for a specific address. The Australian Internet Exchange in Sydney, where many carriers peer, is one of the few places where such a list would have to be written to catch all paths to a target. This is why IP blocks are rare: they are expensive, blunt, and prone to collateral damage.

Blocking one virtual host on a shared IP would take down every other site hosted on the same machine. Many small Australian businesses, community organisations, and local footy clubs run on multi-tenant hosting with a single address, so an IP-level block would knock over a Ballarat bake-shop's website along with whatever else shares that server. Operators know it, which is why DNS filtering has become the path of least resistance for compliance teams.

Where Australians Run Into the Discrepancy

Anyone who has travelled between capital cities and noticed a website mysteriously working at a Melbourne café but failing on a mate's home NBN connection in Perth has witnessed the gap. The likely explanation is not geography but resolver configuration. Different ISPs hand out different DNS servers, and some smaller providers even run their own resolvers with bespoke block lists. A Geelong gaming lounge running a custom Pi-hole setup, for instance, may resolve a site perfectly while the customer's home Telstra line filters it.

The same lookup can also give different answers depending on whether you are at work, at university, or tethered to your phone. Enterprise networks, university campuses, and mobile carriers each maintain independent resolvers, and each may subscribe to different filtering feeds. The discrepancy between DNS blocking and IP reachability therefore shows up as an everyday annoyance long before it becomes a political issue.

Filtering Method	What It Inspects	Ease of Bypass	Collateral Damage	Transparency
DNS resolver block	Hostname string	Trivial: switch resolver, edit hosts, use DoH	None on the IP itself	Hidden inside resolver responses
IP ACL on router	Destination address	Harder: needs VPN or proxy	High: affects co-hosted sites	Slightly more visible in traceroutes
SNI inspection	TLS handshake field	Moderate: ESNI/ECH or VPN	Medium: can catch whole providers	Often invisible to end user
Deep packet inspection	Payload patterns	Difficult: requires encryption or obfuscation	Variable	Effectively opaque

The asymmetry on display here is plain. As you move down from DNS to IP and beyond, the cost of operating the block rises, while the cost of circumventing it depends on the technique. DNS is the cheapest filter, so it is the one most often deployed, and it is the one most often defeated.

The Australian Regulatory Context

The Australian government has, over the years, flirted with both styles of filtering. The now-defunct mandatory internet filtering proposal floated around 2012 would have relied heavily on DNS-level and URL-level blocking, while leaving IP-based blocking as a fallback for repeat offenders. More recent obligations under the Online Safety Act have continued to lean on the domain-name layer because it remains the most legally straightforward instrument to mandate at the resolver level.

ACMA's register of prohibited content, the eSafety Commissioner's takedown notices, and the various court orders handed down over the past decade almost always name a domain rather than an IP. The legal instrument is written in the language of the resolver, and the resolver is the layer that gets configured to comply. Because the order rarely specifies an IP, the IP stays accessible, and the gap exists by design as much as by accident.

Resolver Choices and Local Filters

A handful of recursive resolvers dominate the Australian market. Cloudflare's 1.1.1.1, Google's 8.8.8.8, and Quad9's 9.9.9.9 are widely advertised, but the reality on the ground is that most households never configure anything; they accept whatever DHCP hands them. That default is where the filter lives, and it is also where it ends the moment a user types a custom address into their network settings or enables DNS-over-HTTPS in their browser.

Some Australian ISPs go further than mere compliance. They layer commercial parental-control feeds on top of the legal minimum and occasionally block entire categories of site for their own business reasons. Smaller ISPs and the not-for-profit community networks that serve parts of regional Australia sometimes take the opposite approach and refuse to filter anything beyond what the law requires. The variation is part of why a national picture of censorship can only be built from many independent probes.

How to Tell What Your Resolver Is Doing

If you suspect your ISP is rewriting DNS answers, the easiest diagnostic is to compare results from two independent resolvers. Ask your ISP's resolver for the record, then ask a public one, and see whether the answers match. A plain-language walkthrough for testing your ISP's DNS walks through the whole process without any command-line tools, which is useful for anyone who would rather not open a terminal.

For those who do not mind a terminal, dig +short example.com @1.1.1.1 against a known target gives a baseline, and the same command pointed at your ISP's resolver shows whether the answer has been tampered with. Tools like traceroute and mtr will then reveal whether the IP itself is reachable even when the resolver lies. If packets arrive, the filter is purely nominal; if they do not, something else is going on at a deeper layer of the network.

Workarounds and Trade-offs

The standard answer to a stubborn DNS block is to change resolvers, but that only works until the next layer of the stack decides to interfere. DoH and DoT encrypt the lookup so the ISP cannot see the hostname, which removes the easiest signal to filter on. A more durable fix is to route the entire connection through private DNS services that combine encrypted resolution with traffic obfuscation, so the ISP sees neither the lookup nor the destination.

The trade-off is moving trust from your ISP to a third party, so it pays to pick a provider that publishes transparency reports and accepts independent audits. Fair dinkum accountability is the only filter that cannot be bypassed with a single resolver swap, and it is what separates a privacy tool from a surveillance tool in sheep's clothing.

Knowing that DNS blocks do not equal IP blocks gives you two practical levers as an everyday user. The first is awareness: when a site stops loading, try a public resolver, an alternative browser, or simply a different network before assuming the site itself has gone down. The second is recourse: if you believe the block is unwarranted, you can contact the project with the URL or IP you tested, and your report will help build a more accurate map of what Australian resolvers are actually doing.