In short
- A DNS resolver turns a site's name into an IP address. A substituted answer sends the browser to the wrong address or says the site doesn't exist.
- Since February 10, 2026, Russia's National Domain Name System (NSDI) answers that youtube.com doesn't exist.
- In measurements by Teplitsa of Social Technologies in August 2026, Yandex DNS and the NSDI returned an address unrelated to blocked domains.
- Since late August 2026, plain DNS lookups to 8.8.8.8 and 1.1.1.1 stopped getting answers at some providers.
- A lookup sent to a resolver in Russia is a leak: your provider sees which sites you open, and the answer may be substituted.
How DNS works
Sites on the internet are reached by IP addresses, while people type names — youtube.com, masknet.online. A DNS resolver turns the name into an address. Usually it is your provider's server, which the device gets automatically when it joins the network.
The resolver takes the lookup, finds the address and sends the answer back. The device trusts it: plain DNS has no way to check whether the address is correct. If the resolver returns a different address or says the name doesn't exist, the browser accepts that.
Plain DNS lookups travel across the network unencrypted, on port 53. Your provider sees them, and equipment on the way to the resolver can intercept them.
What DNS substitution is
DNS substitution is a resolver answer that doesn't match the real one. There are three variants:
- "The domain doesn't exist". The resolver answers with NXDOMAIN, as if there were no such site. The browser shows a "This site can't be reached" error.
- Someone else's address. The resolver returns an address that doesn't belong to the site. The connection fails, the browser warns about the certificate, or the page loads forever.
- An intercepted lookup. You chose a foreign resolver, but the lookup is redirected to another server on the way, and the answer comes from that server.
In all three cases you see the same thing: a site or app doesn't work, even though the internet is up.
What is happening to DNS in Russia in 2026
NSDI. The National Domain Name System was created under the "sovereign Runet" law. On the evening of February 10, 2026, youtube.com disappeared from its records: devices that resolve through the NSDI stopped getting the service's addresses. In measurements by Teplitsa of Social Technologies in August 2026, the NSDI answers "the domain doesn't exist" for youtube.com and whatsapp.com and returns other addresses for five more domains out of the 27 tested.
Russian and public resolvers. In the same measurements, Yandex DNS and the NSDI returned one and the same address, unrelated to the sites, for blocked domains — from every test point, Russian and foreign. Google Public DNS and Cloudflare answered that way only to lookups from Russia. The authors consider this substitution on the resolver side but call the conclusion not final.
Interception of lookups to foreign resolvers. Since August 26, 2026, users have reported that plain lookups to 8.8.8.8 and 1.1.1.1 are redirected to the NSDI. On August 29, Teplitsa recorded on a home connection in Saint Petersburg that these servers stopped answering plain UDP lookups, while encrypted DoH and DoT still worked. In the same days, subscribers of several providers complained about DoH and DoT failures.
Providers. Censored Planet researchers showed back in 2022 that Russian providers' resolvers return the address of a block page for blocked domains. Behaviour differs between providers and regions.
There are no official statements about DNS substitution. Some of the information comes from researchers' measurements, some from user reports; links are in the "Sources" section.
What substitution looks like for you
- A page or video loads forever, while other sites open.
- The browser says "This site can't be reached" or
DNS_PROBE_FINISHED_NXDOMAIN. - The browser warns about an insecure connection or an invalid certificate on a well-known site.
- An app can't reach its server, yet works on another connection — mobile data instead of Wi-Fi, for example.
The same signs can come from other problems. To see whether DNS is the cause, check where your lookups go.
How to check where your DNS lookups go
Open the leak test and run the DNS check. It shows which resolvers handled the lookup, their network and country.
| Result | What it means |
|---|---|
| A resolver in Russia — your provider's, Yandex's, the NSDI or any other | A leak. Your provider sees which sites you open, and answers may be substituted |
| Resolvers outside Russia with MaskNet connected | No leak — MaskNet resolvers handle your lookups |
| The resolver's country could not be determined | Check your browser and system settings |
If a resolver in Russia shows up while the VPN is connected, the browser is usually the cause: its "Use secure DNS" setting points to a Russian server. Step-by-step checks are in the help article Why the leak test warns you.
What to do
- Don't set Russian resolvers by hand — not in the system, on the router or in the browser. That includes Yandex DNS.
- Check "Use secure DNS" in your browser. In Chrome and Edge it is in the security settings. If a Russian server is selected, switch it off or choose "Use your current service provider".
- Use encrypted DNS through a server outside Russia. Plain DNS on port 53 gets intercepted; encrypted DoH and DoT have also started failing at some providers.
- Run the leak test again after every change.
How MaskNet handles DNS
With MaskNet connected, DNS lookups for foreign sites are encrypted and travel through the tunnel to MaskNet servers outside Russia. MaskNet's own resolvers handle them there, getting answers from Quad9 and Cloudflare over encrypted DoH. Your provider sees only an encrypted connection to a MaskNet server, and Russian resolvers never receive these lookups.
Smart routing sends the traffic of Russian services — Gosuslugi, banks, marketplaces — outside the VPN tunnel: they see your Russian IP, and you don't need to turn MaskNet off.
Frequently asked questions
What is DNS substitution?
A DNS resolver answer that doesn't match the real one: "the domain doesn't exist", someone else's address, or an answer from another server your lookup was redirected to. The browser accepts it and goes to the wrong place.
Why does Yandex DNS count as a leak?
It is a resolver in Russia. In the August 2026 measurements, Yandex DNS returned an address unrelated to blocked domains. The MaskNet leak test treats any resolver in Russia as a leak.
What is the NSDI?
The National Domain Name System — Russia's DNS infrastructure created under the "sovereign Runet" law. Since February 10, 2026, it answers that youtube.com doesn't exist.
Does setting 8.8.8.8 or 1.1.1.1 help?
Not always. Since late August 2026, plain lookups to these servers stopped getting through at some providers or, according to user reports, are redirected to the NSDI. Plain DNS on port 53 is not protected from interception.
Does DoH protect against substitution?
DoH and DoT encrypt the lookup, so the answer can't be swapped on the way. But if the resolver itself is in Russia, it can still answer untruthfully. On top of that, DoH and DoT fail at some providers in 2026.
How do I find out where my DNS lookups go?
Run the leak test. It shows the resolvers, their network and country. A resolver in Russia is a reason to check your settings.
Sources
- Kommersant, February 10, 2026: YouTube unavailable in Russia because of the NSDI (in Russian).
- Teplitsa of Social Technologies, August 7, 2026, updated August 31: What is happening to DNS in Russia? Review #26 (in Russian).
- VGTimes, August 31, 2026: lookups to Google and Cloudflare started being redirected to the NSDI (in Russian).
- Censored Planet, IMC 2022: TSPU: Russia's Decentralized Censorship System.