DNS Resolution and Access to Umbrella servers
Using Umbrella for DNS resolution in China works, and is expected to work in the future. There are no recorded incidents of China blocking access to Umbrella's DNS service (or OpenDNS).
DNSCrypt is the method by which Umbrella encrypts DNS queries destined for our Anycast resolvers. When using the Umbrella Roaming Client, DNS queries are encrypted and sent over UDP/443, while the Umbrella Virtual Appliance sends its encrypted DNS queries over UDP/53. Encrypted DNS queries destined for Umbrella resolvers should not be negatively impacted when originating from China networks.
Latency, Routing, and Peering
Due to limited peering arrangements with China Unicom and China Telecom, the RTT (Round Trip Time) to the closest Umbrella (OpenDNS) datacenter depends on geographic location and connection type. We find that most customers within China are routed to our Tokyo, Hong Kong, or Singapore locations. See our global network of datacenters for more information.
If you are noticing unusual, strange or suboptimal routing from China to Umbrella, we recommend contacting the appropriate Chinese ISP and encouraging them to peer with Umbrella. You may also open a ticket with Umbrella support, but in many cases we will unable to resolve the issue as it extends to regions and peering relationships beyond the scope of our global network.
Anycast and edns-client-subnet
Since many of our customers in China will end up utilizing our Tokyo and Singapore locations due to routing and peering, DNS lookups of domain names utilizing Anycast and edns-client-subnet technologies might return an IP address or domain name which resolves outside of China, even if a server in China is normally available for resolution. This has the potential to increase the load time of some websites and services which would be significantly faster if accessed within China. However, Cisco Umbrella does participate in the Faster Internet Initiative, so if you see domains with a suboptimal IP address response, please open a ticket with Umbrella Support to address this.