Above the BGP layer: how Iran's 2026 shutdown was enforced, content type by content type — an independent corroboration of arXiv:2603.28753

Iran did not block everything the same way. On Voidly's OONI-grounded measurements, where a blocking method can be resolved, Iran blocks news media overwhelmingly by DNS poisoning (85.3% of 116 method-bearing news measurements) but switches to the more expensive, harder-to-evade TCP-reset/SNI injection for the tools of coordination and circumvention: messaging/Communication 62.5% RST (n=72), Social Networking 53.4% (n=133), VPN/anonymizers 53.3% (n=75). The intent signature: Iran spends its most sophisticated censorship capacity not on news, but on the apps people use to route around censorship and organize. This per-content-type mechanism layer is what NetBlocks (outage %), Access Now #KeepItOn (event counts) and Freedom House (annual scores) structurally do not publish — and it independently corroborates, with separate machine-readable data, the method mix (DNS interception + SNI-based RST injection + QUIC/UDP filtering + a ~25%-traffic allowlist, all above the BGP layer) that Aceto, Persico and Pescapè documented in arXiv:2603.28753 for Iran's Jan–May 2026 shutdown (the longest nationwide internet disruption on record). For the same categories Russia reaches for the opposite weapon — DNS for nearly everything (comms 100% n=96, social 87% n=209) — and China is RST-dominant across the board (social 62% RST n=481); the method-mix is a stable, country-level fingerprint. HONEST CAVEATS: (1) 51.6% of all 4,852 Iran blocking measurements are block_generic = METHOD UNRESOLVED (not 'no block') — shares are computed only among method-bearing measurements, so the claim is 'of news blocks where we resolve a method, 85% are DNS,' NOT 'Iran blocks 85% of news.' (2) Voidly is the analysis layer on top of OONI's raw network — corroboration of an upstream, not an independent network. (3) These shares describe the filternet/allowlist application layer across the measurement window, NOT the deepest wire-cut days (those belong to NetBlocks/Cloudflare/IODA). (4) Per-cell n is 31–133 — solid but modest; n is reported on every cell. (5) This is the Iran case study of Voidly's general method-follows-content-type finding; the novel unit is the event-pegged, arXiv-corroborated framing. Live: /v1/measurement/category-techniques?country=IR.