Cloudflare Radar shows Iran's internet connectivity recovering after disruption
Cloudflare's traffic monitoring reveals a partial return of Iranian internet activity after an apparent shutdown, underscoring the role of encrypted DNS in resisting censorship.
Cloudflare's global network has observed a partial restoration of internet connectivity in Iran, according to a blog post published on May 27, 2026 by Cloudflare analysts Lai Yi Ohlsen and Sabina Zejnilovic. The finding comes from Cloudflare Radar, a free public tool that tracks internet traffic patterns worldwide using data from Cloudflare's infrastructure, including billions of DNS queries and HTTP requests. When a country's internet is disrupted, these measurements drop sharply, and a partial recovery indicates that some users are regaining the ability to access online services.
To understand what this means, it helps to know a little about how the internet works. Every time you visit a website, your device first sends a request to a DNS resolver, a special server that translates a human-friendly domain name like example.com into a numeric IP address that computers use to find each other. Cloudflare operates one of the world's largest public DNS resolvers at 1.1.1.1, and it can see how many DNS queries come from each country. In a full internet shutdown, DNS query volumes from a country collapse to near zero. In a partial shutdown or restoration, traffic levels fluctuate but do not return to normal. Cloudflare Radar uses this and other signals, such as HTTP request volumes, to detect and quantify outages and disruptions.
Iran has a history of imposing internet restrictions during times of political or social unrest, and international monitoring groups often report on these events using data from companies like Cloudflare. The latest Cloudflare data suggests that after a period of significant disruption, some connectivity is returning, though not to pre-disruption levels. This partial restoration could mean that certain services are becoming reachable again while others remain blocked, or that mobile and fixed-line networks are recovering at different rates. Cloudflare Radar does not reveal the cause of the shutdown, only that traffic patterns indicate a recovery is underway.
For users inside Iran or any country where internet access is restricted, the type of DNS resolver you use can make a real difference. When a government blocks websites by ordering local internet providers to block DNS lookups, those providers simply refuse to resolve certain domain names. However, if you configure your device to use an encrypted DNS service outside the country, such as AEU DNS, your DNS queries travel over an encrypted HTTPS, TLS, or QUIC connection that your internet provider cannot read or tamper with. This often bypasses DNS-level censorship because the blocking happens at the local resolver, not at your encrypted connection. It is important to note that encrypted DNS cannot defeat all forms of internet shutdown, such as when a government cuts off all IP traffic to a region or blocks entire networks at the routing level. But for DNS-based filtering, which is one of the most common censorship techniques, a private, no-logs encrypted DNS service is a powerful and easy protection.
As internet disruptions continue to occur around the world, tools like Cloudflare Radar provide valuable public evidence of what is happening, while services like AEU DNS give ordinary people a way to protect their privacy and resist some forms of online censorship. If you are in a region where access is unstable, consider configuring encrypted DNS on your devices, keeping a trusted VPN as a backup, and monitoring trusted internet observatories for status updates. These steps do not guarantee full connectivity under a government-mandated blackout, but they do harden your connection against the most common technical controls used to restrict access.
Terms explained
- DNS
- Domain Name System, the internet's phonebook that translates website names into numeric addresses computers use.
- resolver
- A server that receives your DNS queries and returns the IP address for the website you want to visit.
- IP address
- A unique number assigned to every device on the internet that lets other devices find and communicate with it.
- encrypted DNS
- A way of sending DNS queries over a secure, scrambled connection so your internet provider cannot see or alter them.
- DoH
- DNS over HTTPS, a method that sends DNS queries through the same encrypted channel used for secure websites.
- DoT
- DNS over TLS, a method that wraps DNS queries in an encrypted layer to protect them from eavesdropping.
- internet shutdown
- A government-ordered or technical failure that cuts off some or all internet access in a region or country.
How to protect yourself
- Set up encrypted DNS on your phone or computer by changing your network settings to use a trusted encrypted DNS service such as AEU DNS or Cloudflare 1.1.1.1.
- Learn how to manually change DNS settings on your device so you can switch away from your internet provider's default resolver if it starts blocking websites.
- Install and test a reputable virtual private network (VPN) app before you actually need it, because some networks may block access to VPN websites during a shutdown.
- Enable DNSSEC validation in your router or device settings if that option is available, which helps confirm DNS responses are genuine and not tampered with.
Source: blog.cloudflare.com
