Национальная Система Доменных Имен (НСДИ) = National Domain Name System (NSDI) #580
Description
I just became aware of the National Domain Name System (NSDI), which in Russian is Национальная Система Доменных Имен (НСДИ). This is a DNS resolver that ISPs in Russia are forced to used as the upstream resolver for their own resolvers. If a DNS name is removed from NSDI, then it also disappears from ISP DNS resolvers. Anyone who wants to resolve such a name must look for an alternative resolver that does not use NSDI.
I learned this information from unic3rn on the Tor bug tracker.
2026-02-12 https://theins.ru/en/news/289338 (archive)
The activists have recorded disruptions in access to YouTube, linking the problem to Russia’s National Domain Name System — better known by its acronym NSDI (НСДИ) — a structure created as part of the Kremlin’s efforts to develop a so-called “sovereign internet.”
The National Domain Name System is a government-backed online infrastructure project created under Russia’s “sovereign internet” law. It mirrors the global Domain Name System (DNS), the mechanism that matches website domain names to their IP addresses, thereby enabling a user’s device to connect to the proper server.
Outside Russia, DNS records are created by domain owners and are distributed through an international system of registries and providers. Under Russian law, however, telecom operators are required to use the NSDI as the source of data on domain names.
That means if a record for a particular site is changed or removed in the NSDI, providers will pass that information on to users, even if it differs from the global DNS system. As a result, a site can “disappear” for users in Russia even if it continues to work in the worldwide DNS system.
In practice, the NSDI gives the regulator the means to exercise centralized control over which addresses “exist” for users inside the country.
The government Public Communications Network Monitoring and Control Center (ЦМУ ССОП) has a page about NSDI:
2022-08-25 https://portal.noc.gov.ru/ru/news/2022/08/25/nsdi/ (archive)
Одна из таких угроз — зависимость от глобальной инфраструктуры Сети, то есть от доступности зарубежных корневых серверов DNS, информации о сетевых адресах и автономных системах. Чтобы ее устранить и обеспечить надежность и стабильность российского Интернета, в 2021 году ввели в эксплуатацию Национальную систему доменных имен.
НСДИ показывает положительную динамику по приросту российских пользователей. Так, с января по июль 2022 года их количество выросло на 200 тыс. (с 800 тыс. до 1 млн в сутки), а всего в сутки поступает около 13 млрд запросов. Это около 6% от общемирового количества запросов к DNS-серверам.
В соответствии с требованиями законодательства к НСДИ обязаны подключаться операторы связи и компании, у которых есть номера автономных систем (ASN — специальный номер, который получают организации для своих автономных сетей в Интернете). Сегодня к НСДИ подключены все российские владельцы автономных систем, из которых 82% подключаются напрямую, а оставшиеся 18% используют DNS-серверы других операторов связи.
One such threat is dependence on the global network infrastructure, i.e., on the availability of foreign root DNS servers, information about network addresses, and autonomous systems. To eliminate this threat and ensure the reliability and stability of the Russian Internet, the National Domain Name System was launched in 2021.
The NSDI shows positive dynamics in terms of the growth of Russian users. From January to July 2022, their number increased by 200,000 (from 800,000 to 1 million per day), and a total of about 13 billion requests are received per day. This is about 6% of the total number of requests to DNS servers worldwide.
In accordance with legal requirements, telecommunications operators and companies that have autonomous system numbers (ASN — a special number that organizations receive for their autonomous networks on the Internet) are required to connect to the NSDI. Today, all Russian owners of autonomous systems are connected to the NSDI, 82% of which are connected directly, while the remaining 18% use the DNS servers of other telecommunications operators.
The NSDI system for coordinating DNS blocking rules across ISPs might be compared with the RPZ (Response Policy Zone) technique used in Indonesia: #316 (comment).