Encrypted DNS has attractive anti-blocking properties for circumvention rendezvous, but its constraint of conveying only small amounts of data per message makes it difficult to use as a generic data-exchange channel. Fountain codes offer an uncomplicated way to transmit discrete, bounded-length messages over such channels, including those that are unordered or unreliable.

Fountain codes (rateless erasure codes) break a message into many small, specially encoded pieces that can be reconstructed from any sufficient subset, making them well-suited to covert channels that are lossy, unordered, or bandwidth-constrained — properties common to DNS-based rendezvous channels.

Abstract defense

Drawing on the Collage and Assemblage censorship-circumvention systems — which use fountain codes in conjunction with steganography — this work narrows focus to the rendezvous step alone, treating fountain codes as a standalone design component useful independently of steganographic cover channels.

Abstract defense

A proof-of-concept implementation over UDP demonstrates the essential elements of fountain-code–based rendezvous: breaking a message into pieces, transmitting them over a lossy channel, and reconstructing them at the receiver. The authors also work out a prospective design for rendezvous over encrypted DNS.

Abstract evaluation

The June 2025 Iran shutdown—carried out during the Iran-Israel war beginning ~June 19—did not use BGP route withdrawals as in 2019. Instead, authorities applied service-level restrictions at the national border: DNS poisoning of foreign destinations, protocol whitelisting permitting only pre-approved domestic services, and DPI to block circumvention-tool traffic. Iran's international traffic fell roughly 90% while the country's BGP routes remained advertised, making the shutdown invisible to BGP-based monitoring systems. OONI measurement volume, which totalled 121,333 in June 2025, collapsed to under 200 submissions on June 19-20.

2025-iran-shutdown-measurement Executive Summary / §2 dpidns-poisoningport-blockingip-blocking

Article 19 documents that Iran's National Information Network (NIN / SHOMA) was designed with explicit reference to China's Great Firewall as a model, with institutional mirroring: Iran's Supreme Council of Cyberspace parallels China's Cyberspace Administration of China, and both governments share a "cyber sovereignty" doctrine used to justify domestic content controls and cross-border technology transfer. The report frames Iran's filtering infrastructure as deliberately architected to replicate GFW capabilities, not as an independently developed system.

2026-article19-tightening-the-net §2, §3 dpisni-blockingdns-poisoningip-blockingbgp-hijackthrottling

TCP segmentation (splitting a DNS message into 20-byte TCP fragments) successfully circumvented DNS censorship in China for nearly all resolvers that support TCP. In Iran, TCP segmentation was only partially effective due to the censor's ability to reassemble TCP fragments when system load permits—some runs succeeded completely, others failed entirely across all resolvers. The "Last Response" mode (wait 3 seconds for the final UDP reply) was highly effective against China's on-path GFW injector for all resolvers except the fully IP-blocked Cloudflare 1.1.1.1 resolver. In China the technique worked for 40 of 41 tested resolvers.

2026-lange-towards §4.1, §6.2.1, §6.2.2 dns-poisoningdpi

As of June 2026, Iranian DPI blocking timescales are: CDN-fronted VLESS+WebSocket domains blocked within 24 hours; SSH dynamic port forwarding server IPs blocked within 8 hours; Reality and WireGuard connections blocked immediately (seconds) after handshake completion. This graduated timeline suggests separate fast-path (handshake-pattern) and slow-path (domain reputation / traffic accumulation) detection pipelines operating in parallel.

2026-pooribitwise-iran-advanced-dpi Issue body — combined observations dpisni-blockingip-blockingrst-injectiondns-poisoning

Of 6,915,266 domains extracted from the 572 GiB Geedge Networks Leak (GNL), 298,955 censored domains (93.7% of all GNL-censored domains) appear in neither Tranco top-1M nor CitizenLab test lists. Measurements across China (Guangzhou/Nanjing), Myanmar, Pakistan, and Algeria confirmed censorship via DNS injection and SNI-based TLS connection termination. The GNL covers 25–62% of Tranco-censored domains across countries, showing substantial but incomplete overlap. This vendor-side ground truth reveals a censorship surface roughly two orders of magnitude larger than curated academic test lists.

2026-sheffey-geedge §4.1, Table 2 dpisni-blockingdns-poisoningmeasurement-platform

For non-whitelisted SNIs connecting to allowed Cloudflare IPs, Iran's DPI enforced a strict 6-packet limit per connection, sufficient only to load a webpage but not to sustain any tunnel; connections bearing a whitelisted SNI were unrestricted. Outside DNS providers were blocked within one to two weeks and replaced with a local DNS infrastructure that operated at a maximum of ~100 KB/s with connections dropping at approximately the one-minute mark.

2026-tuleo1-internet-analysis-shutdown Issue body sni-blockingdpithrottlingdns-poisoning