# Analysing Censorship Circumvention with VPNs via DNS Cache Snooping

## TL;DR

This paper investigates how DNS cache snooping can reveal the actual domains accessed via VPNs, shedding light on censorship circumvention and user behavior across different countries.

## Contribution

It introduces and evaluates three DNS cache snooping methods and applies the most reliable one to analyze VPN usage and censorship evasion in several nations.

## Key findings

- Identified which domains are accessed through VPNs.
- Revealed VPN usage patterns for censored and popular sites.
- Demonstrated the effectiveness of DNS cache snooping techniques.

## Abstract

Anecdotal evidence suggests an increasing number of people are turning to VPN services for the properties of privacy, anonymity and free communication over the internet. Despite this, there is little research into what these services are actually being used for. We use DNS cache snooping to determine what domains people are accessing through VPNs. This technique is used to discover whether certain queries have been made against a particular DNS server. Some VPNs operate their own DNS servers, ensuring that any cached queries were made by users of the VPN. We explore 3 methods of DNS cache snooping and briefly discuss their strengths and limitations. Using the most reliable of the methods, we perform a DNS cache snooping scan against the DNS servers of several major VPN providers. With this we discover which domains are actually accessed through VPNs. We run this technique against popular domains, as well as those known to be censored in certain countries; China, Indonesia, Iran, and Turkey. Our work gives a glimpse into what users use VPNs for, and provides a technique for discovering the frequency with which domain records are accessed on a DNS server.