FINDING · DETECTION
The GFW blocks GitHub by hijacking DNS resolution to incorrect IP addresses, causing browser timeouts ('github.com 响应时间太长'). The poisoning can be confirmed by comparing nslookup results against a clean resolver (8.8.8.8) versus the local ISP resolver — divergent results confirm injection.
From 2026-anon-6-github-dns — 全网最全！6种方法解决 GitHub 国内由于 DNS 污染导致无法访问的问题 | 二毛 · §5 验证 DNS 污染 · 2026 · ermao.net (Chinese-language circumvention blog)
Implications
- Circumvention tools should detect DNS poisoning at startup by comparing authoritative vs. local resolver results and warn users before attempting connections.
- Any tool that relies on DNS for its own infrastructure (bootstrap resolvers, domain-fronting targets) must use out-of-band or hardcoded IPs to avoid being blocked at the DNS layer before the tunnel is established.
Tags
Extracted by claude-sonnet-4-6 — review before relying.