A decision determines that certain content, service, or operation should no longer be accessible. The order proceeds to those who operate the network. Along the way, a decisive difference emerges: the legal document names one thing; the infrastructure can distinguish another.
A person is not a domain. A video is not an IP address. A service is not a DNS response. Yet these identifiers frequently become the concrete objects of a block.
This does not mean that every target is legitimate or that every restriction is invalid. It means that merits and mechanisms are different questions. Even when a decision is considered legitimate, we must still ask whether the technical rule reaches only what it intends to restrict.
An order can be legally specific and technically indiscriminate.
The order names one thing; the network sees another
Between the decision and the user lies a chain of translation. An authority identifies targets. An operational list collects domains, addresses, or other attributes. Coordinators distribute that list. Providers convert its entries into rules for resolvers, routers, firewalls, or inspection equipment.
Each translation loses or adds meaning.
A URL may name a specific page, but its path is protected inside an HTTPS session. An intermediary may see the domain but not the page. A domain may serve a website, email, and APIs. An IP address may serve thousands of domains, change occupants, or represent a CDN distributed across several regions. A port identifies a probable type of service, not the conduct performed through it.
The network does not magically receive the semantics of the decision. It acts on the attributes made visible by its architectural position.
DNS: preventing a name from finding its destination
DNS translates names used by people and applications into information needed for communication. Interfering at this stage is a relatively simple way to reduce access: a resolver can omit the answer, return an error, provide false data, or redirect the user.
The block targets the name, but its reach is not necessarily limited to the resource that motivated the order. Every service associated with the domain may be affected. Applications may also use another resolver, retain cached data, or discover the destination through another mechanism. The technique affects some users without making the target immobile.
There is also a security cost. DNSSEC enables cryptographic validation of certain DNS data. A response fabricated by an intermediary does not become authentic merely because it was administratively authorized. RFC 7754 observes that blocking mechanisms must also be evaluated for their impact on existing trust infrastructures.
IP: closing the building to prevent access to one room
Blocking an IP address operates at a different layer. A router or firewall can discard traffic addressed to it without knowing which domain, page, or object the user intended to access.
This simplicity explains both the mechanism's usefulness and its imprecision. Shared hosting, reverse proxies, CDNs, clouds, and NAT cause many agents to share addresses. Anycast allows the same address to lead to physically different instances. Infrastructure is allocated, released, and reused.
The target can move. The other occupants do not control the list that retained the previous address.
The result is an asymmetry: those seeking to circumvent the block have an incentive to move quickly; those who suffer collateral damage may not even know that their address appears in a secret or outdated rule.
The deeper the network looks, the more it must observe
A common response to imprecision is to demand greater granularity. If an IP address aggregates too much, an intermediary may try to classify a connection by SNI, certificate, protocol, headers, or content.
But granularity is not free. It requires the network to observe more.
SNI historically exposed the server name at the beginning of a TLS session. TLS 1.3 encrypted the certificate sent by the server, and ECH protects parts of the ClientHello that previously revealed the destination. When an attribute is no longer visible, the response may shift to less precise criteria, more intrusive inspection, or the endpoints themselves.
RFC 9505, which compiles techniques observed across different countries, shows this continuous movement among DNS, IP, SNI, protocol characteristics, and instrumentation of content distributors. RFC 7754 warns that strategies which insert intermediaries into the end-to-end path can break security properties and make an authorized agent difficult to distinguish from an attacker.
Greater precision in blocking can mean greater capacity for surveillance.
Blocking at scale in Brazil
In December 2025, Pedro de Botelho Marcos, Thiago Ayub, and Vinícius Anselmo presented an overview at IX Fórum of the orders received by one Brazilian provider. The corpus contained 304 orders issued between December 2022 and June 2025.
The authors recorded two limitations: there was no guarantee that every ISP had received the same set, and the dataset contained no information about possible revocations. Their methodology compared responses from public and provider DNS resolvers and, for existing domains, also used ping and traceroute to evaluate connectivity.
Results varied substantially across six vantage points—regional, national, mobile, institutional, and satellite networks. Based on shared addresses, the presentation also estimated very large numbers of domains potentially affected by IP blocks.
“Potentially” is the central word. Associating many domains with one IP address demonstrates the surface for collateral damage; it does not prove that every domain was active, reachable, legitimate, and effectively unavailable on each network. Even so, it exposes the category error: an address can aggregate objects that the order never assessed individually. (IX Fórum 19 presentation)
The operational scale continues to grow. In its 2025 inspection report, Brazil's telecommunications regulator, Anatel, declared 110 operations related to TV boxes, involving 28,190 IP addresses and 5,420 URLs. It also reported more than 17,000 domains associated with irregular betting and 1,955 websites and applications related to copyright. These figures describe identifiers processed; by themselves, they do not measure precision, duration, or effectiveness. (Anatel report)
In 2026, the agency announced a public dashboard for administrative blocks of TV boxes. Transparency is part of operational security: adding entries without a verifiable procedure for review and removal turns a temporary measure into a persistent risk. (Anatel dashboard announcement)
Six questions before installing a rule
RFC 7754 separates four criteria that are often conflated:
- scope: which networks, territories, and users receive the block;
- granularity: whether the identifier corresponds to the intended object or
aggregates others;
- effectiveness: for which population, and for how long, the technique
reduces access;
- security: which end-to-end guarantees the intervention weakens.
Two operational questions must accompany them:
- transparency: can the basis, list, executor, and duration be audited;
- reversibility: who removes the rule, and how do they learn that an
address, domain, or occupant has changed.
Without these distinctions, a high count can be presented as effectiveness even when it measures only entries in a list. A target that reappears at another address can coexist with third parties still trapped by the old one.
The capability remains after the case
China and Russia have developed extensive systems for DNS and IP blocking and deep packet inspection. Brazil has different institutions, laws, and controls. Using techniques from the same family does not make political regimes equivalent or demonstrate equal intentions.
But the architectural comparison remains valid: a capability installed for one category remains available for others. Equipment does not know the political legitimacy of its next operator. Processes, lists, and control points mature through use.
The human-rights question posed by RFC 9620 is deliberately architectural: does the protocol create choke points that are easy to use for censorship? Does it expose identifiers that allow traffic to be selected? Does it make clear when and why a resource was restricted?
Technical design does not decide on its own who will govern. It decides which powers a ruler will find ready to use.
The address is not the object
PRP separates identity from location. A verifiable object does not cease to be the same object because it was moved, replicated, or obtained from another host. A relationship does not belong to a server's current address. Discovery, transport, and verification are distinct functions.
This separation does not make PRP immune to coercion. Links can be disrupted, hosts can be seized, and agents can face sanctions. Nor does it make every published object legitimate. Local policies continue to act on verifiable objects and relationships.
What changes is the architectural correspondence. An address ceases to be an identity. Transport does not need to interpret content in order to forward it. Moving an object does not destroy its verifiability, and blocking one location is not equivalent to universally revoking the object or agent.
This reduces the usefulness of treating shared infrastructure as a substitute for the actual target. It also makes the boundary explicit: a restriction on an object, relationship, or agent must name and justify that object, relationship, or agent—not merely the circumstance of where its data happened to be yesterday.
The next article takes another step. If today's Internet mainly knows where to look, how can an architecture verify what it received without giving a central catalog the power to decide what exists?