Internet censorship in China is not operated by a single, centralized “super firewall.” Instead, it is a multi-layered and distributed system involving different institutions, network operators, and technology vendors.
The National-level GFW is primarily deployed at international gateways and backbone network boundaries, where it applies relatively consistent and coordinated censorship rules to cross-border traffic. Provincial and operator-level censorship systems can operate independently, forming a “firewall behind the firewall.” These systems can be collectively described as Regional Firewalls.
The National-level GFW covers the country as a whole. Its blocking policies are generally stable, persistent, and rarely removed. For overseas websites, DNS pollution is one of its most common blocking methods. Because DNS pollution is relatively inexpensive to implement and has a high blocking success rate, the DNS Pollution Check is the primary and essential method for determining whether a domain is blocked in mainland China.
In addition to DNS pollution, the National-level GFW may use IP address blocking, HTTP Host filtering, SNI/ESNI filtering in the TLS ClientHello, TCP RST injection, active probing of proxy services such as Tor and Shadowsocks, and traffic analysis to identify encrypted proxy protocols. These measures are mainly used to detect and prevent users from accessing overseas websites through proxy technologies.
Regional Firewalls primarily use HTTP Host filtering and SNI/ESNI filtering in the TLS ClientHello. Compared with the National-level GFW, these restrictions generally affect only specific provinces, cities, or network operators. Different operators within the same province may also produce different results, and some regional restrictions may be lifted after a period of time.
The main characteristics of Regional Firewalls are relatively unsophisticated implementation, large blocking lists, rapidly changing rules, and a higher risk of collateral blocking.
For these reasons, DNS pollution detection is a fundamental and necessary first step. HTTP Host Reset and TLS SNI Reset checks provide more comprehensive results and more accurately reflect a domain’s actual blocking status across different regions and network operators in mainland China.
A GFW Full Domain Check combines all major domain-based GFW checks into a single test, providing a more complete view of whether and how a domain is being blocked.
Additional Context
Regional Firewalls have now been confirmed in multiple provinces. Some regions with weaker network infrastructure may even restrict or cut off international Internet egress. As a result, the same domain may show significantly different connectivity results across provinces, cities, and network operators.
China’s international Internet egress resources are also comparatively constrained. Combined with traffic filtering and identification mechanisms, this means that even legitimate cross-border requests that are not blocked may experience increased latency, packet loss, or connection timeouts because of congestion at international gateways or along cross-border routes.
Proxy tools are widely used in China, while proxy protocols and their encryption and obfuscation technologies continue to evolve. At the same time, the National-level GFW continues to upgrade its traffic identification and blocking capabilities.
This has created a long-running technical contest between proxy technologies and censorship systems, making China’s Internet censorship infrastructure one of the largest and most technically complex systems of its kind in the world.