How ISPs block websites is usually less about "deleting" a page and more about interfering somewhere along the path: domain resolution, destination IP, TLS handshake metadata, HTTP requests, or routing. Each method creates different symptoms. One may show a server-not-found error, another may time out, and another may affect only one app. Cloudflare explains DNS as the key step that turns human-readable domains into IP addresses, which is why it is such a common control point.［1］

Key Takeaways

DNS blocking can make domain lookup fail or return the wrong address.

IP blocking can affect several unrelated sites hosted on the same server.

SNI/HTTP filtering is more precise, but it depends on clear-text clues in the connection.

A VPN can hide the target domain and content, but it cannot bypass every network or legal restriction.

How ISPs block websites: start with the access path

Your ISP is your entry point to the internet. Your device connects to a router, then passes through the ISP network, upstream backbone networks, DNS resolution, and the destination server. Any layer that can observe or control traffic can potentially restrict a specific website.

Blocking may be used for legal compliance, copyright, malicious-site protection, school or workplace policy, parental controls, or network management. Users only see "it does not open," but the technical cause can be very different.

If your goal is simply to regain access, start with common ways to unblock websites. This article focuses on the mechanisms.

How DNS blocking works

DNS is like the internet's phonebook. After you type a domain, your device asks a DNS resolver for the matching IP address. DNS blocking can make the query fail, return the wrong IP, or send you to a notice page.

The signature of DNS blocking is that it "looks like the domain is broken." You may see DNS_PROBE_FINISHED_NXDOMAIN, a server-not-found error, or a site that starts working after you change DNS. For the basics, see how to change DNS.

But changing DNS is not magic. If IP, SNI, or route-level blocking also exists later in the path, switching resolvers will not be enough.

Why IP blocking causes collateral damage

IP blocking directly blocks a server address. It is simple and cheap to enforce, but it can cause collateral damage because several websites may share the same IP, especially on CDN and cloud infrastructure.

CDNs such as Cloudflare place many sites on shared infrastructure. Blocking one IP can affect unrelated websites. Changing the domain may not help either if the new domain still points to the blocked IP.

What are SNI, HTTPS, and HTTP filtering?

HTTPS encrypts page content, but traditional TLS handshakes include an SNI field that tells the server which domain you want to reach. Without extra protection such as ECH, network middleboxes may identify the target domain from SNI. The IETF has published Encrypted ClientHello to reduce exposure of sensitive metadata in the TLS ClientHello.［2］

That is why some sites have normal DNS and reachable IPs, but the browser still stalls during the handshake or shows connection resets. The page content is not necessarily visible; the connection metadata is being identified.

Does HTTP filtering and keyword blocking still exist?

Yes, but it mainly applies to unencrypted HTTP or specific clear-text protocols. As HTTPS became common, ISPs became less able to read URL paths and page content directly. Google's Transparency Report shows that HTTPS has long represented a high share of modern web traffic.［3］

Still, unencrypted websites, old apps, clear-text DNS, and clear-text proxies can expose more information. Upgrading sites to HTTPS, using secure DNS, and using a VPN all reduce clear-text exposure.

Why a VPN can bypass some website blocks

A VPN encrypts your traffic to a VPN server first, and then the VPN server accesses the destination site. Your ISP can usually see that you connected to a VPN server, not the specific website inside the tunnel.

This helps with DNS blocking, SNI recognition, and local network policy. But if the VPN server itself is blocked, the platform account restricts VPN usage, or the local network is fully disconnected, a VPN cannot guarantee access.

For the basic VPN path, read what a VPN is. If you care about ISP visibility, see can your ISP see VPN usage?.

How to tell which kind of block you are seeing

Symptom 1: Only the domain fails

If the IP responds to ping and the site works after changing DNS, the issue is likely DNS-related. Direct browser access to an IP still depends on whether the website supports it.

Symptom 2: The connection always times out

This may be IP blocking, route packet loss, a destination server failure, or firewall dropping. Comparing another network and a VPN path is especially useful here.

Symptom 3: HTTPS handshake fails

Possible causes include SNI recognition, certificate problems, man-in-the-middle interception, or old browser compatibility. Check system time and browser version first, then test another network.

Symptom 4: Workplace or school network shows a reason

If you see a page such as "content category restricted" or "violates company policy," it is usually a local gateway rule. Check internal policy before attempting to bypass it.

Summary

Website blocking can happen at the DNS, IP, TLS, HTTP, or routing layer.
DNS issues often look like server-not-found errors; IP issues often look like timeouts.
HTTPS reduces content exposure, but some connection metadata may still be visible.
A VPN can bypass some local restrictions, but it does not replace legal or policy judgment.

FAQ

Can changing DNS open every blocked website?

No. Changing DNS only helps with resolution-layer problems. If IP, SNI, or routing restrictions also apply, the site may still fail.

Can a VPN stop my ISP from seeing the websites I visit?

A VPN can hide destination websites and content inside the tunnel, but your ISP may still see that you connected to a VPN server. For a fuller explanation, see can your ISP see you using a VPN?.

Why does the same site work on my phone but not my computer?

Possible causes include DNS cache, browser extensions, antivirus software, workplace proxy settings, or IPv6/IPv4 route differences. Test another browser and network first.

If a website is IP-blocked, does changing the domain help?

Not necessarily. If the new domain still points to the same blocked IP, the result will be the same. A CDN or new node may change the path, but it may also remain restricted.

Can HTTPS websites still be blocked?

Yes. HTTPS protects content, but it does not hide every piece of connection metadata. DNS, IP, SNI, and routing can still be used for restrictions.

Can I use a VPN to bypass blocked sites at work?

It may be technically possible, but it is usually a bad idea. Workplace policies may explicitly prohibit bypassing network controls, and violations can create compliance or disciplinary risk.

Does a site failing to open always mean it is blocked?

No. Server outages, expired domains, DNS misconfiguration, browser cache, and local router issues can all create the same symptom.

Disclaimer: This article is for general technical information only and does not constitute legal advice or guidance on bypassing network policy. Follow local laws, terms of service, and your organization's network-use rules when accessing websites.

In “How ISPs Block Websites: DNS, IP, SNI”, AethoVPN applies only to the VPN layer and cannot guarantee access.

Sources:

Cloudflare Learning Center - What is DNS? — https://www.cloudflare.com/learning/dns/what-is-dns/
IETF RFC 9337 - TLS Encrypted Client Hello — https://www.rfc-editor.org/rfc/rfc9337
Google Transparency Report - HTTPS encryption on the web — https://transparencyreport.google.com/https/overview

Sources checked 8 May 2026.

Related Articles:

How ISPs Block Websites: DNS, IP, SNI