An investigative report on the blocking of in Vietnam

We first learned about the blocking of - the domain name of our core magazine project - back in early December 2017, three years after we launched the website.

We asked the Swedish technology organization Qurium to investigate the state of the issue. They released an investigative report on June 12, 2018. Below is the report without source code cited by Qurium. Please click here to read the full version.

The following report present our findings of the current Internet blocking of the site inside Vietnam.


During late May 2018, we conducted tests in ten different autonomous systems inside Vietnam, and over more than hundred different name servers.


The main mechanism to block the website is DNS tampering at each of the providers’ infrastructure.

In summary the tampering works as follows:

  • The customers of a given Internet Provider receive a set of predetermined nameservers offered by the provider.
  • This information is pushed to the customer in the configuration of their connection (DHCP, PPPoE…)
  • When the customer places a connection to the site, a DNS request arrives to the predefined name servers.
  • The provider then blocks the connection by sending bogus responses to the customer for that domain name.

During our research we have found three  different types of bogus responses:

  1. The domain name resolves to
  2. The domain name does NOT resolve and timeouts after 10 seconds.
  3. A fake authoritative name server is provided.

Example of Viettel

In the following example, we see that Viettel provides the DNS servers and as part of the PPPoE authentication in their infrastructure. The customer uses the modem TP-Link TL-WR841N.

The blocking is taking place by DNS tampering in the upstream provider. The provider pushes two DNS servers into the customers, namely and

When placing requests for the domain, the company resolvers respond after 10 seconds with a SERVFAIL (timeout).

An interesting behavior of DNS tampering in this provider is that for domains that do not resolve they spoof a response to the IP:

In that IP address we can find the webpage:

[Source code]

Info: Website address does not exist!

Summary of DNS tampering in different providers

The following section provides a summary of the DNS tampering techniques and in which providers we found the three fake responses.

noerror :

This tampering resolves the blocked domain with the IP address We found the NOERROR behavior in the following providers:

AS45903 CMC Telecom Infrastructure Company AS7602 Saigon Postel Corporation

Their DNS servers also forge the SOA record as follows: 86400 IN SOA 2010912201 10800 15 604800 10800 86400 IN SOA 2014040201 28800 7200 1209600 86400

servfail: timeout error

This second form of tampering responds with a SERVFAIL response after 10 seconds. This is a sign that the name server of the provider is trying to reach the name servers of the domain and but the response does not reach the provider’s name server.

We found the SERVFAIL behavior in the following providers:

AS18403 The Corporation for Financing & Promoting Technology
AS24066 Vietnam Internet Network Information Center
AS38731 CHT Compamy Ltd
AS45899 VNPT Corp
AS63734 365 Online technology joint stock company
AS7552 Viettel Corporation

bar: bogus authoritative response

In this type of tampered response the provider’s DNS response provides a bogus authoritative DNS server. An example of this type of response is: 850 IN SOA 2005010501 10800 3600 604800 86400 type A, class IN
[Name Length: 12]
[Label Count: 2]
Type: A (Host Address) (1)
Class: IN (0x0001)
Authoritative nameservers type SOA, class IN, mname
Type: SOA (Start Of a zone of Authority) (6)
Class: IN (0x0001)
Time to live: 474
Data length: 50
Primary name server:
Responsible authority's mailbox:
Serial Number: 2005010501
Refresh Interval: 10800 (3 hours)
Retry Interval: 3600 (1 hour)
Expire limit: 604800 (7 days)
Minimum TTL: 86400 (1 day)

We have seen this behavior in the provider:

AS7643 Vietnam Posts and Telecommunications (VNPT)


The website is blocked in Vietnam by means of DNS tampering. The DNS tampering is implemented by at least three different techniques. DNS tampering can be bypassed by changing the predefined name servers provided by the providers and using alternative ones (open resolvers).

A list of open resolvers is available here.

Great! You’ve successfully signed up.
Welcome back! You've successfully signed in.
You've successfully subscribed to Legal Initiatives for Vietnam.
Your link has expired.
Success! Check your email for magic link to sign-in.
Success! Your billing info has been updated.
Your billing was not updated.