How a censor blocks is as revealing as what it blocks. Voidly's new per-content-category technique view — /v1/measurement/category-techniques — crosses the blocking method with the content type, and a clear pattern falls out: DNS poisoning is the near-universal tool, but several states escalate to a harder-to-evade method for one category in particular — real-time communication and messaging.

DNS poisoning is the default everywhere

Across every content category, DNS manipulation is the dominant censorship method — 74% to 91% of method-resolved blocking measurements globally. It is cheap and scales: poison the resolver answer and the domain "disappears" for anyone using the default DNS. News, search, social, adult content, hosting — all are blocked overwhelmingly at the DNS layer.

But messaging draws connection-level interference

The exception is communication and messaging tools. Several censors reserve TCP-reset / connection-level interference — a costlier method that requires watching and actively killing the live connection — for comms, while leaving news at the DNS layer. Among the 23 countries with enough categorised comms measurements:

Iran is the cleanest contrast: it reserves connection-level resets for 62% of its comms blocking but only 15% for news — a four-fold escalation aimed squarely at messaging.

Why the method matters

The choice is practical. DNS poisoning is trivially bypassed — switch to DNS-over-HTTPS or a custom resolver and the block evaporates. TCP-reset injection is different: the censor must inspect and tear down the live TCP connection, which is more expensive to operate but far harder for a user to circumvent. Spending that effort specifically on real-time communication suggests these states prioritise un-circumventable blocking of messaging over news — they would rather you could not coordinate than that you could not read.

The instructive outlier: China

China does not fit the pattern — it RST-blocks nearly everything (comms 58%, news 60%). That is the signature of a uniformly heavy, well-resourced apparatus applying its most robust method across the board, rather than the content-targeted escalation seen in Iran, Pakistan and Egypt.

Honest caveats

• domain_category is the Citizen Lab test-list tag, present on ~23% of evidence; this is the composition of method-resolved blocking measurements (signal_level critical/elevated), not per-incident attribution.
• block_generic ("method unresolved") and IODA connectivity outages are excluded — they are not censorship techniques.
• Some country-category cells are thin; always read the per-cell count. The robust contrasts are IR (comms n=72, news n=116) and CN (n=231/394); KH and MM have no categorised news measurements, so there is no within-country comparison there.
• Method tagging skews toward measurements that carry a resolvable OONI signal_type; shares (not raw counts) are reported so categories remain comparable despite differing volume.

Reproduce it live: /v1/measurement/category-techniques (add ?country=IR or ?country=CN). Companion finding on per-country technique fingerprints: Every censor has a fingerprint.