Hello,

Earlier this year we published research on the blocking of Telegram and Instagram during the Iran protests: https://ooni.torproject.org/post/2018-iran-protests/

OONI's Leonid has carried out further analysis of network measurements, based on which he found that Instagram was blocked through the use of DPI which targeted the TLS protocol during the Iran protests.

His findings are available in OONI's latest blog post: https://ooni.torproject.org/post/2018-iran-protests-pt2/ (https://twitter.com/OpenObservatory/status/964054743143321600)

We previously thought that Instagram was blocked by means of DNS tampering, but that turned out to be a false positive (it was in fact blocked by DPI targeting TLS).

This is yet another case that shows the challenges in terms of accurately identifying cases of DNS-based censorship, and distinguishing them from false positives.

There are many other cases that may look like DNS-based censorship, but aren't. Leonid previously published a post identifying cases of DNS misconfiguration: https://ooni.torproject.org/post/not-quite-network-censorship/

We therefore encourage you to please reach out if you'd like to share knowledge/ideas/heuristics that can help improve our methodologies in relation to identifying cases of DNS-based censorship (and distinguishing them from false positives). Our current methodologies are available here: https://ooni.torproject.org/nettest/web-connectivity/ (and here are some of our ideas for future tests: https://github.com/TheTorProject/ooni-probe/issues/647).

Thank you!

~ The OONI team.