Website Blocked by ISP: How to Tell If Your ISP Is Blocking a Website (and How to Fix It)
If a website is globally accessible on DownCheck’s independent probes but inaccessible on your network, your ISP, DNS resolver, or local firewall is the blocking point — not a server outage. The blocking mechanism determines which bypass works.
Step 1: Run the URL on DownCheck. If all probes return success → the site is up globally.
Step 2: Switch DNS to 1.1.1.1 (Cloudflare) or 8.8.8.8 (Google). If the site loads → ISP DNS filtering.
Step 3: Switch to mobile data. If the site loads → your ISP (or office network) is blocking it.
Step 4: Connect a VPN. If the site loads → ISP IP block or geo-restriction.
How ISPs Block Websites: DNS Filtering, IP Blocking, and Deep Packet Inspection
ISPs implement website blocking through three distinct network-layer mechanisms, each operating at a different point in the connection path and requiring a different bypass technique. DNS filtering is the most common (cheapest to implement, easiest to bypass). IP-level routing restrictions are more robust but affect all services sharing the blocked IP. Deep packet inspection is the most sophisticated and hardest to bypass because it inspects traffic content regardless of DNS resolution or IP routing.
The ISP’s DNS resolver intercepts queries for blocked domains and returns either NXDOMAIN (no such domain) or a redirect IP pointing to a “This site has been blocked” page. When your browser tries to resolve example.com, the ISP’s resolver returns a lie instead of the real IP address. The web server is perfectly operational — your browser simply cannot find it.
DNS filtering is the most common form of ISP blocking because it is cheap (one rule in the resolver blocks the domain for all customers), easy to maintain (no routing changes required), and produces a user-friendly block page. Government-mandated blocks in the UK (IWF blocklist), Australia, India, and Turkey primarily use DNS filtering. It is also the easiest to bypass because DNS is just a lookup service — switching to a different resolver immediately restores access.
Bypass: Change DNS resolver to 1.1.1.1 (Cloudflare) or 8.8.8.8 (Google) or use DNS-over-HTTPS (DoH) to encrypt DNS queries so ISP cannot intercept them.The ISP adds the target website’s IP addresses (or entire CIDR ranges) to a network-level Access Control List (ACL) or BGP blackhole route. All packets destined for those IPs are dropped before leaving the ISP’s network. Unlike DNS filtering, this blocks access even if you use an alternative DNS resolver — your DNS correctly resolves the domain to the real IP, but the ISP drops packets to that IP. Changing DNS does not help because the problem is routing, not resolution.
IP blocking often has collateral damage: if a blocked website shares an IP with legitimate services (common with CDN-hosted sites where hundreds of domains share a Cloudflare IP), those legitimate sites also become inaccessible. This is why ISP IP blocks occasionally take down unrelated services accidentally. traceroute reveals IP blocking clearly: the path fails at an ISP hop (typically hop 3–7) rather than reaching the destination server.
Bypass: VPN or Tor (routes traffic through an IP not in the blocklist). Changing DNS alone will NOT bypass IP blocking.DPI firewall appliances examine packet payloads beyond IP/TCP headers, reading the application-layer content. For HTTPS traffic, DPI reads the TLS Server Name Indication (SNI) extension — a field in the TLS ClientHello that specifies the target hostname in plaintext, even though the session itself is encrypted. When the DPI appliance sees a blocked hostname in the SNI field, it injects a TCP RST packet to terminate the connection.
DPI bypasses DNS filtering and IP routing: your DNS query was correct, your packets are routing to the right IP, but the ISP is reading your TLS handshake and cutting the connection when it sees the blocked hostname. China’s Great Firewall, Iran’s national internet filter, and Russia’s SORM system all use DPI as their primary blocking mechanism. This is why simple DNS changes or proxies often fail against sophisticated national filtering systems.
Bypass: VPN with obfuscated protocols (WireGuard, Shadowsocks, V2Ray) that disguise traffic patterns; ESNI/ECH (Encrypted Client Hello) hides SNI from DPI — supported by Cloudflare and Firefox.What DPI Sees in an HTTPS Connection
ISP Blocking vs Real Downtime vs Geo-Restriction — The Key Differences
ISP blocking, genuine server downtime, and geo-restriction (geo-blocking) all produce “site inaccessible” from the user’s perspective but are fundamentally different conditions requiring different responses. Misdiagnosing geo-restriction as downtime wastes incident response time; misdiagnosing ISP blocking as a server outage means filing a support ticket with the wrong party. The distinction is always visible in DownCheck’s probe results.
| Signal | Real Downtime | ISP Blocking | Geo-Restriction |
|---|---|---|---|
| DownCheck HTTP probe | ✗ Fails (5xx, timeout) | ✓ Succeeds (200) | Varies (200 from US probe; 403 from EU probe) |
| DownCheck CF Edge probe | ✗ Fails (origin error) | ✓ Succeeds (CDN cache hit) | ✗ May return 403 (CDN enforces geo block) |
| DNS resolution | ✓ Resolves correctly | ✗ NXDOMAIN or block IP (if DNS filtering) | ✓ Resolves correctly |
| Alternative DNS test | No change — server is down | Fixes access if DNS filtering; no change for IP/DPI block | No change — block is server-side, not DNS |
| Mobile data test | ✗ Also inaccessible (global) | ✓ May work (different ISP) | ✗ Inaccessible (same country) |
| VPN test | ✗ Still inaccessible (server is down) | ✓ Usually restores access | ✓ Restores access (if VPN exits in unrestricted country) |
| Implemented by | Origin server / cloud provider | Your ISP’s network infrastructure | The website / CDN itself |
| Who to contact | Website owner / hosting provider | Your ISP (or use bypass methods) | Website owner (request access) or use VPN |
5-Step Diagnosis: Confirming ISP Blocking vs Real Downtime
Confirming ISP blocking vs real downtime requires testing from independent network vantage points and with different DNS resolvers — the combination of these two tests eliminates all ambiguity within 5 minutes. The flowchart below moves from the fastest test (DownCheck external probe) to the most specific (traceroute to the blocking hop).
Run DownCheck on the URL
DownCheck’s probes run from independent networks (Railway infrastructure in US, Cloudflare Edge globally, 4 DNS resolvers). They confirm whether the site is globally accessible from external vantage points completely independent of your ISP.
Switch DNS to Cloudflare 1.1.1.1 or Google 8.8.8.8
Change your device’s DNS resolver to Cloudflare (1.1.1.1 / 1.0.0.1) or Google (8.8.8.8 / 8.8.4.4). On Windows: Network Settings → Adapter Properties → IPv4 → DNS. On macOS: System Settings → Network → DNS. On router: access router admin panel → DNS settings. Flush DNS cache after changing (see flush commands below).
Test on a different network (mobile data)
Disable Wi-Fi on your phone and switch to cellular data (4G/5G), which routes through a different ISP’s network. Try accessing the site on the mobile browser.
Test with a VPN connected
Connect to a VPN server in a different country (one where the site is not blocked) and attempt access. A VPN tunnels all traffic through its own network, bypassing your ISP’s routing and DNS entirely.
Run traceroute to identify the blocking hop
Traceroute shows each network hop between you and the destination. If the path stops at an ISP-owned router (typically hops 3–7, before reaching the destination network’s ASN), the ISP’s infrastructure is dropping packets. If the path reaches the destination server’s network and then fails, the issue is at the server end.
Geo-Restriction vs ISP Blocking — Who Is Doing the Blocking?
Geo-restriction (geo-blocking) is implemented by the website or CDN itself — the server detects your IP country and refuses service, returning HTTP 403 or a redirect. This is fundamentally different from ISP blocking, where your ISP intercepts the request before it reaches the server. The technical distinction: with geo-blocking, your request successfully reaches the server and the server decides to reject it. With ISP blocking, your request never reaches the server because the ISP drops it first.
DownCheck’s multi-probe architecture reveals geo-blocking clearly: if the Railway HTTP probe (US-based) returns 200 but the same URL from a European probe returns 403, the site is geo-blocking non-US visitors. If all probes succeed (global availability confirmed) but you cannot access from your country, the ISP’s network is the blocking layer, not the server.
| Scenario | HTTP Probe (US) | CF Edge Probe | DNS Probe | Diagnosis |
|---|---|---|---|---|
| Real downtime | ✗ Fail/5xx | ✗ Fail | ✗ Fail | Server or infrastructure is down globally |
| ISP blocking (your network) | ✓ 200 | ✓ 200 | ✓ Resolves | Site is up globally; local network block |
| Geo-block (server-side) | ✓ 200 (US) | ✗ 403 (EU) | ✓ Resolves | Site accessible from US, blocked in EU by server |
| DNS filtering (ISP resolver) | ✓ 200 | ✓ 200 | ✗ NXDOMAIN from ISP resolver | Site up globally; ISP DNS lying to you |
| CDN outage (not ISP) | ✗ Fail | ✗ Fail | ✓ Resolves | CDN layer is down; origin may be up |
DNS-over-HTTPS (DoH): Encrypted DNS to Bypass ISP Filtering
DNS-over-HTTPS (DoH) encrypts DNS queries inside standard HTTPS traffic, making ISP DNS filtering ineffective because the ISP cannot distinguish DoH traffic from normal HTTPS and cannot read the query content. Traditional DNS runs over UDP port 53 in plaintext — your ISP can see every domain you query and can inject false responses. DoH sends queries to DoH resolvers (Cloudflare, Google, NextDNS) as HTTPS POST requests on port 443, which appear identical to any other HTTPS traffic to the ISP.
Enable DoH in Firefox
Firefox → Settings → Privacy & Security → scroll to “DNS over HTTPS” → Enable. Select Cloudflare (1.1.1.1) or enter a custom DoH URL.
Firefox DoH bypasses your OS DNS settings entirely — it sends encrypted DNS queries directly to the configured DoH resolver, ignoring your ISP’s resolver.
✓ Bypasses: ISP DNS filtering ✗ Does not bypass: IP blocking, DPIEnable DoH in Chrome / Edge
Chrome: Settings → Privacy and security → Security → “Use secure DNS” → Enable → Select Cloudflare or Google. Chrome upgrades existing DNS settings to DoH if the current resolver supports it, or switches to a specified DoH provider.
✓ Bypasses: ISP DNS filtering ✗ Does not bypass: IP blocking, DPISystem-wide DoH (Windows 11)
Windows 11: Settings → Network & Internet → Wi-Fi or Ethernet → DNS server assignment → Manual → Enter 1.1.1.1 for preferred DNS → DNS over HTTPS: On. This applies DoH to all applications, not just browsers.
✓ Bypasses: ISP DNS filtering (all apps) ✗ Does not bypass: IP blocking, DPICloudflare 1.1.1.1 App (WARP)
Cloudflare’s 1.1.1.1 app (available for iOS, Android, Windows, macOS) configures system-wide DoH and optionally enables WARP — a lightweight VPN-like tunnel that routes all traffic through Cloudflare’s network, providing both DNS encryption and IP-level bypass for most ISP blocks.
✓ Bypasses: DNS filtering + some IP blocks ✗ WARP may not bypass national DPI filteringVPN and Bypass Tools for IP-Level and DPI Blocking
A VPN (Virtual Private Network) routes all your internet traffic through an encrypted tunnel to a VPN server in a different network, bypassing both ISP IP-level blocks (your traffic exits from the VPN server’s IP, not yours) and DNS filtering (VPN uses its own internal DNS resolver). VPN is the most comprehensive bypass tool for ISP blocking because it addresses all three blocking mechanisms simultaneously. The limitation: VPN providers’ own IP ranges are sometimes blocked by ISPs (particularly in countries with strong internet regulation), requiring obfuscated VPN protocols that disguise VPN traffic.
Encrypted Client Hello (ECH) is the emerging protocol-level solution to DPI-based SNI inspection. ECH encrypts the TLS SNI field in the ClientHello, preventing DPI from reading the target hostname. Cloudflare has deployed ECH on all of its edge infrastructure; Firefox has enabled it by default. When ECH is active, DPI appliances see an encrypted SNI field and cannot determine the target hostname without breaking the TLS connection. ECH represents the most promising technical solution to DPI-based blocking because it requires no user-side configuration.
Legal note: This guide describes the technical mechanisms of ISP blocking and how they work. The legality of using VPNs and bypass tools varies by country — in some jurisdictions, bypassing state-mandated internet filtering is illegal regardless of the content accessed. This guide does not constitute legal advice. Understand the laws in your jurisdiction before using bypass techniques to access blocked content.
How DownCheck Distinguishes ISP Blocking from Real Server Downtime
DownCheck’s multi-probe architecture from independent Autonomous Systems is the definitive test for distinguishing ISP blocking from real server downtime because it answers the exact question the user needs answered: “Is this site accessible from outside my network?” If DownCheck’s probes (running from Railway’s infrastructure AS, Cloudflare’s AS13335, and four independent DNS resolvers) all return successful results, the site is globally accessible and your personal access problem is local.
The multi-resolver DNS check is particularly relevant for ISP DNS filtering diagnosis. DownCheck queries the domain against multiple resolvers simultaneously: Cloudflare (1.1.1.1), Google (8.8.8.8), Quad9 (9.9.9.9), and a regional resolver. If your ISP’s resolver is returning NXDOMAIN for a domain that all four DownCheck resolvers resolve correctly, this is direct evidence of ISP DNS filtering. The discrepancy between your ISP resolver’s response and the four independent resolvers’ responses proves DNS manipulation.
Combine DownCheck’s external verification with the local tests in this guide for a complete diagnosis: DownCheck confirms global availability (ruling out real downtime), DNS change test confirms DNS filtering vs IP/DPI blocking, and traceroute identifies the blocking hop if DNS change did not resolve the issue. See the main diagnosis guide for the complete local-vs-global diagnosis workflow, and the DNS guide for how DNS filtering differs from DNS propagation failures.
Corporate network blocks: The same diagnostic logic applies to corporate or school network blocks. If a site loads on your phone’s cellular data but not on the office Wi-Fi, your organization’s firewall or proxy (often implemented with the same DNS filtering or DPI techniques ISPs use) is blocking it. Corporate blocks are typically enforced via a proxy server or filtering gateway — check your browser’s proxy settings and contact your IT department for the block reason and bypass policy.
Frequently Asked Questions
Is the site blocked or actually down?
DownCheck’s independent probes from external networks tell you in seconds whether a site is globally down or only inaccessible from your network.
Check a site now →