cross-posted from : https://lemmy.zip/post/74401190
Several countries are already ahead of Brussels. In 2025, a Paris court ordered five major VPNs to block more than 200 illegal sports streaming sites, while Italy moved to extend its Piracy Shield system to VPN and DNS providers.
In Spain, a Córdoba court ordered NordVPN and Proton VPN to block IP addresses tied to illegal LaLiga streams in February.
The same court later refused to fine NordVPN for not complying. LaLiga has since asked the Commission to add NordVPN, Proton VPN, ExpressVPN, and Surfshark to its piracy watch list.
Problem is, VPNs can enforce DNS - by blocking any secure (DoH/DoT) methods, forcing the device to fall back to regular insecure DNS, which has to go through the VPN tunnel, where the traffic can be intercepted and forced through their own DNS service.
they can’t block all DoH and DoT service. the former literally looks like web traffic, the latter is even more generic. Basically anyone can spin up services like those
If you can run an instance…
DoT/DoQ is easy to block since it uses a specific port - 853.
DoH, just block traffic to known providers by IP or SNI. There you go, secure DNS defeated.
by default. but they can use different ports.
then a thousand DoH services pop up, or your friend runs one for you, or whatever, and they won’t be able to find all of them. just like streaming companies can’t completely block all VPN providers either.
Encrypted SNI becoming increasingly common as TLS 1.3 adoption grows. As others mentioned in this thread, a lot of the IPs belong to CDNs.