How ISPs block websites is usually less about "deleting" a page and more about interfering somewhere along the path: domain resolution (DNS), destination IP, the SNI domain name in the TLS handshake, HTTP requests, or routing. Each method creates different symptoms. One may show a server-not-found error, another may time out, and another may affect only one app. Cloudflare explains DNS as the key step that turns human-readable domains into IP addresses, which is why it is such a common control point.［1］

Key Takeaways

DNS blocking can make domain lookup fail or return the wrong address.

IP blocking can affect several unrelated sites hosted on the same server.

SNI/HTTP filtering is more precise, but it depends on clear-text clues in the connection.

A VPN can hide the target domain and content, but it cannot bypass every network or legal restriction.

How ISPs block websites along the access path

Your ISP is your entry point to the internet. Your device connects to a router, then passes through the ISP network, upstream backbone networks, DNS resolution, and the destination server. Any layer that can observe or control traffic can potentially restrict a specific website.

Blocking may be used for legal compliance, copyright, malicious-site protection, school or workplace policy, parental controls, or network management. Users only see "it does not open," but the technical cause can be very different.

If your goal is simply to regain access, start with common ways to unblock websites. This article focuses on the mechanisms.

How does DNS blocking work?

DNS is like the internet's phonebook. After you type a domain, your device asks a DNS resolver for the matching IP address. DNS blocking can make the query fail, return the wrong IP, or send you to a notice page.

The signature of DNS blocking is that it "looks like the domain is broken." You may see DNS_PROBE_FINISHED_NXDOMAIN, a server-not-found error, or a site that starts working after you change DNS. For the basics, see how to change DNS.

But changing DNS is not magic. If IP, SNI, or route-level blocking also exists later in the path, switching resolvers will not be enough.

Why IP blocking causes collateral damage

IP blocking directly blocks a server address. It is simple and cheap to enforce, but it can cause collateral damage because several websites may share the same IP, especially on CDN and cloud infrastructure.

CDNs such as Cloudflare place many sites on shared infrastructure. Blocking one IP can affect unrelated websites. Changing the domain may not help either if the new domain still points to the blocked IP.

What are SNI, HTTPS, and HTTP filtering?

HTTPS encrypts page content, but traditional TLS handshakes include an SNI field that tells the server which domain you want to reach. Without extra protection such as ECH, network middleboxes may identify the target domain from SNI. In March 2026 the IETF published Encrypted Client Hello (ECH) as RFC 9849, which encrypts the ClientHello so the SNI and other sensitive fields are not sent in clear text.［2］

That is why some sites have normal DNS and reachable IPs, but the browser still stalls during the handshake or shows connection resets. The page content is not necessarily visible; the connection metadata is being identified.

Does HTTP filtering and keyword blocking still exist?

Yes, but it mainly applies to unencrypted HTTP or specific clear-text protocols. As HTTPS became common, ISPs became less able to read URL paths and page content directly. Google's Transparency Report shows that HTTPS has long represented a high share of modern web traffic.［3］

Still, unencrypted websites, old apps, clear-text DNS, and clear-text proxies can expose more information. Upgrading sites to HTTPS, using secure DNS, and using a VPN all reduce clear-text exposure.

Why a VPN can bypass some website blocks

A VPN encrypts your traffic to a VPN server first, and then the VPN server accesses the destination site. Your ISP can usually see that you connected to a VPN server, not the specific website inside the tunnel.

This helps with DNS blocking, SNI recognition, and local network policy. But if the VPN server itself is blocked, the platform account restricts VPN usage, or the local network is fully disconnected, a VPN cannot guarantee access.

For the basic VPN path, read what a VPN is. If you care about ISP visibility, see can your ISP see VPN usage?.

How to tell which kind of block you are seeing

Symptom 1: Only the domain fails

If the IP responds to ping and the site works after changing DNS, the issue is likely DNS-related. Direct browser access to an IP still depends on whether the website supports it.

Symptom 2: The connection always times out

This may be IP blocking, route packet loss, a destination server failure, or firewall dropping. Comparing another network and a VPN path is especially useful here.

Symptom 3: HTTPS handshake fails

Possible causes include SNI recognition, certificate problems, man-in-the-middle interception, or old browser compatibility. Check system time and browser version first, then test another network.

Symptom 4: Workplace or school network shows a reason

If you see a page such as "content category restricted" or "violates company policy," it is usually a local gateway rule. Check internal policy before attempting to bypass it.

After distinguishing an outage from a permitted routing problem, match the next step to the layer that failed: a different resolver for DNS-layer failures, the network administrator for a policy page, and a route comparison only where the network rules allow it. Record DNS and connection results separately so a changed route is not mistaken for a fix to every block type. A VPN such as AethoVPN changes only the network path to the site; it cannot bring back an offline connection, and a workplace or school policy still applies while the tunnel is on. To weigh those routes against each other, compare the unblocking options and their risks.

For the inspection boundary, the DPI visibility comparison distinguishes classifying encrypted traffic from reading its protected contents.

Summary

Website blocking can happen at the DNS, IP, TLS, HTTP, or routing layer.
DNS issues often look like server-not-found errors; IP issues often look like timeouts.
HTTPS reduces content exposure, but some connection metadata may still be visible.
A VPN can bypass some local restrictions, but it does not replace legal or policy judgment.

FAQ

Can changing DNS open every blocked website?

No. Changing DNS only helps with resolution-layer problems. If IP, SNI, or routing restrictions also apply, the site may still fail.

Can a VPN stop my ISP from seeing the websites I visit?

A VPN can hide destination websites and content inside the tunnel, but your ISP may still see that you connected to a VPN server. For a fuller explanation, see can your ISP see you using a VPN?.

Why does the same site work on my phone but not my computer?

Possible causes include DNS cache, browser extensions, antivirus software, workplace proxy settings, or IPv6/IPv4 route differences. Test another browser and network first.

If a website is IP-blocked, does changing the domain help?

Not necessarily. If the new domain still points to the same blocked IP, the result will be the same. A CDN or new node may change the path, but it may also remain restricted.

Can HTTPS websites still be blocked?

Yes. HTTPS protects content, but it does not hide every piece of connection metadata. DNS, IP, SNI, and routing can still be used for restrictions.

Can I use a VPN to bypass blocked sites at work?

It may be technically possible, but it is usually a bad idea. Workplace policies may explicitly prohibit bypassing network controls, and violations can create compliance or disciplinary risk.

Does a site failing to open always mean it is blocked?

No. Server outages, expired domains, DNS misconfiguration, browser cache, and local router issues can all create the same symptom.

Disclaimer: This article is for general technical information only and does not constitute legal advice or guidance on bypassing network policy. Follow local laws, terms of service, and your organization's network-use rules when accessing websites.

Sources:

Cloudflare Learning Center - What is DNS? — https://www.cloudflare.com/learning/dns/what-is-dns/
RFC Editor - RFC 9849: TLS Encrypted Client Hello — https://www.rfc-editor.org/rfc/rfc9849
Google Transparency Report - HTTPS encryption on the web — https://transparencyreport.google.com/https/overview

Sources checked 4 October 2026.

Related Articles:

How ISPs Block Websites: DNS, IP, SNI