India Disrupts Access to Supabase with Government Blocking Order

What happened

Around February 24, 2026, India's Ministry of Electronics and Information Technology (MeitY) issued a blocking order under Section 69A of the Information Technology Act, 2000. The directive instructed Indian Internet Service Providers to block access to all subdomains under *.supabase.co, the API domain used by every Supabase-powered application.

Within hours, major ISPs began complying. Reliance Jio, Bharti Airtel, ACT Fibernet, and BSNL all started poisoning DNS responses for Supabase's API endpoints. Production applications that relied on Supabase for database queries, authentication, file storage, and realtime connections stopped functioning for Indian users overnight.

Supabase, a $5 billion open-source Firebase alternative, found itself cut off from its 4th largest market. India accounts for approximately 9% of Supabase's global traffic, making this one of the most significant disruptions the platform has faced since its launch.

The scale of disruption

The numbers tell the story of how far-reaching this disruption is. India is not a minor market for Supabase. It is one of the platform's core user bases.

The affected ISPs cover the vast majority of Indian internet users. Between Jio (approximately 500 million subscribers), Airtel, ACT Fibernet, and BSNL, almost every internet connection in the country is subject to the block. BSNL, the government-owned ISP, was already blocking Firebase since August 2025 and is now enforcing the Supabase block as well, leaving developers on BSNL with both major backend platforms unreachable.

Which ISPs are enforcing the block

The blocking order has been confirmed across India's largest internet service providers. Each ISP has implemented the block through DNS poisoning on their resolvers.

How the block works: DNS poisoning explained

The blocking mechanism is DNS poisoning. When your app or browser tries to resolve a *.supabase.co domain, the ISP's DNS resolver returns a fake IP address (a sinkhole) instead of Supabase's real server IP. The connection attempt then times out or fails entirely.

Critically, the block only targets *.supabase.co (the API domain). The marketing website at supabase.com remains fully accessible. This creates a confusing situation: developers can log in to the Supabase dashboard and see everything working normally, but their production apps cannot reach the API.

You can verify the block on your own network with a quick DNS lookup:

If your ISP DNS returns an IP in the 49.44.x.x range while a public DNS resolver like 1.1.1.1 returns a different IP, the block is confirmed on your network. For a more detailed diagnostic, see our ISP block testing guide.

Impact on Indian developers

The blocking order did not come with a warning. Developers discovered their apps were broken only when end users started reporting errors. The fallout has been immediate and widespread.

Supabase's response

Supabase acknowledged the block on their community channels and confirmed they were investigating the situation. On February 26, Supabase posted on X (formerly Twitter) publicly tagging India's IT Minister Ashwini Vaishnaw, asking for clarity on the blocking order.

The post gained significant traction in the Indian developer community. However, it was deleted shortly afterward. No official explanation was provided for the deletion. Supabase has stated that they continue to engage with Indian government authorities through private channels.

Supabase has recommended that developers use a reverse proxy as a workaround. The platform's own documentation now includes guidance on routing traffic through Cloudflare Workers or similar proxy infrastructure to bypass the DNS-level block.

Community response and workarounds

The Indian developer community mobilized quickly, sharing diagnostics and workarounds across X, Reddit, Discord, and developer forums. Several approaches emerged, but not all of them work for production applications.

Why standard fixes fail your end users

When a developer encounters a block, the instinct is to change DNS settings or use a VPN. These approaches might restore access on your own machine, but they do nothing for the people actually using your app.

Consider the problem from the end user's perspective. A customer opens your web app or mobile app on their Jio connection. The app tries to reach yourproject.supabase.co from their browser. Their ISP intercepts the DNS query and returns a sinkhole IP. The connection fails. The user has no idea why. They just see an error or a loading screen that never resolves.

You cannot ask your users to change their DNS settings. You cannot require them to install a VPN. The fix has to be invisible to the end user. That is why a reverse proxy is the correct architectural solution. The user's browser connects to your proxy domain (which is not blocked), and the proxy handles the Supabase communication server-side.

The proxy makes the block invisible to your users. They connect to your proxy domain, which resolves normally on every ISP. The Cloudflare Worker on the edge receives the request and forwards it to Supabase's servers. The ISP block only applies to client-side DNS resolution, which the proxy bypasses entirely.

The real fix: reverse proxy through Cloudflare

JioBase is a managed reverse proxy built on Cloudflare Workers specifically for this situation. It gives you an unblocked proxy URL that routes all Supabase traffic through Cloudflare's global edge network.

The setup requires changing a single URL in your Supabase client initialization. Your anon key, RLS policies, database schema, authentication rules, and everything else stays exactly the same.

import { createClient } from '@supabase/supabase-js'

// Before: blocked by Indian ISPs
// const supabase = createClient('https://abcdefgh.supabase.co', key)

// After: works on every Indian network
const supabase = createClient(
  'https://myapp.jiobase.com',
  'your-anon-key'
)

For step-by-step instructions with framework-specific examples, read the complete fix guide. If you prefer to self-host the proxy, use our Cloudflare Worker Generator to create a deployment-ready worker in seconds. We also have a Next.js integration guide for teams using that framework.

A pattern of blocking developer tools in India

Supabase is not the first developer platform to face a blocking order in India. The pattern of ISP-level blocks disrupting development infrastructure has been recurring:

• GitHub (raw.githubusercontent.com) was intermittently blocked, breaking package downloads and CI/CD pipelines
• Firebase has been blocked on BSNL since August 2025, affecting Firestore, Cloud Functions, and Authentication
• Pastebin has been blocked since 2017 on many ISPs, affecting code snippet sharing
• Medium was temporarily blocked in 2020, taking thousands of programming tutorials offline
• Telegram has faced blocks on multiple ISPs at various times, disrupting developer community channels

This pattern highlights a fundamental problem: platform-level blocks punish thousands of legitimate developers and businesses because of content posted by a small number of users. The blocking order targets the entire *.supabase.co domain rather than specific offending projects. For a deeper analysis, read our history of developer tool blocks in India.

What comes next

There is no confirmed timeline for the block being lifted. Historically, some blocks in India have been temporary (Medium was unblocked after weeks), while others have persisted for years (Pastebin remains blocked since 2017). The confidential nature of Section 69A orders means there is no transparent appeals process.

Supabase has stated they are working with Indian government officials to resolve the situation. Developer advocacy organizations including the Internet Freedom Foundation (IFF) are tracking the block. Community pressure has historically influenced the review process for blocking orders, and developers are encouraged to raise awareness through social media, elected representatives, and industry groups.

Regardless of when the block is lifted, the lesson for production applications is clear: your architecture should not depend on any single domain remaining accessible in every region. A reverse proxy layer ensures your app works regardless of ISP-level DNS restrictions. Build resilient infrastructure now, and you will not be caught off guard by the next blocking order.

Frequently Asked Questions