> The screenshot clearly shows a valid HTTPS certificate, so either they don't do DNS blocking but instead implement the block on their loadbalancer side or the

> The screenshot clearly shows a valid HTTPS certificate, so either they don't do DNS blocking but instead implement the block on their loadbalancer side or they mis-issue HTTPS certificates. The former is only possible when the target site is also served by Cloudflare (which leaves the question what Cloudflare does for domains that are targetted by a court order but not using Cloudflare loadbalancing), the latter would be a serious breach of how HTTPS certificates should be issued. Cloudflare's statement in that screenshot: > Given the extraterritorial effect as well as the different global approaches to DNS-based blocking, Cloudflare has pursued legal remedies before complying with requests to block access to domains or content through the 1.1.1.1 Public DNS Resolver or identified alternate mechanisms to comply with relevant court orders. To date, Cloudflare has not blocked content through the 1.1.1.1 Public DNS Resolver. I interpret this part of what Cloudflare said to mean, that so far every domain they've been asked to block has either been appealed successfully or they were using Cloudflare's CDN, DDoS mitigation & WAF services therefore they could just selectively block the visitors with HTTP 451. If they were asked to block a domain that wasn't using Cloudflare, I'm sure that would be the first instance of them having to modify the DNS response - but they would have to, or stop doing business in that jurisdiction like what OpenDNS did. Cloudflare is quite notorious about not policing the content being fronted by their service, and are quite popular with less than legal (but still clearnet) sites. In the example cases, they already had TLS certificates issued and were using them for the legitimate traffic of that domain as it was fronted by Cloudflare.