How to Tell a Blocked Domain From a Dead One

A website that fails to load is not automatically censored. It may have no working DNS delegation, an expired registration, a broken web server, an incorrect TLS certificate, or a network path that has been deliberately filtered. The practical question is how to distinguish between a blocked domain and a dead domain without treating every timeout as evidence of interference.

Start with controlled comparisons: check DNS, compare Australian and overseas networks, inspect the returned error, and record when each test occurred. The same domain can fail for different reasons on a home NBN connection, a mobile network and a corporate system. That difference between the “fair go” basic check and a complex investigation is often where the answer becomes clear.

What each failure actually means

A blocked domain remains active but is prevented from reaching the user. Filtering may occur at the DNS resolver, ISP network or application layer. It can produce a sinkhole address, a redirect to an enforcement page, a connection reset or an unexplained timeout. The effect may apply only to particular Australian carriers or locations.

A dead domain has no usable presence in the DNS hierarchy. Its registration may have expired, its nameservers may have been removed, or an authoritative server may no longer respond. A registered domain with working DNS but an unavailable web server is more accurately described as an unavailable service, although it can look dead to an ordinary visitor.

This distinction matters because the two failures produce different evidence. A dead domain usually fails consistently wherever it is tested, while censorship tends to vary with the resolver, carrier or route. Neither result is perfectly uniform, so consistency across several tests is stronger than a single observation.

Start with DNS and compare resolvers

Use dig domain.com.au to see what the current resolver returns, then repeat the query with a public resolver such as dig @1.1.1.1 domain.com.au. An NXDOMAIN response says the queried name does not exist; SERVFAIL means the resolver could not obtain a valid answer; and a timeout can indicate network filtering, an outage or a misconfigured server. NOERROR with no address record is another possibility and does not automatically mean the domain is dead.

Australian fixed-line broadband is usually delivered through NBN Co’s wholesale network and resold by providers such as Telstra, Optus and Vodafone, while many phone and fixed-wireless connections use mobile infrastructure. Their default DNS behaviour may differ. A router supplied by an ISP can also behave differently from the resolver configured on a laptop or phone, making an easy comparison between the two.

When a result seems significant, contributors can compare notes through the community reporting portal. Net Neutrality Monitor is a beta, volunteer-supported project powered by AirVPN, and its blacklist, probe, DNS and statistical data should be treated as indicative research. Users can submit URLs or IP addresses for monitoring and review country-specific censorship results.

Compare network paths and locations

After checking DNS, request the site directly with curl -I https://example.com and, when necessary, curl -v https://example.com. This reveals the HTTP status, redirect chain and TLS details that a browser may hide behind a generic “site cannot be reached” message. It also helps separate a domain failure from an application, certificate or content-delivery problem.

Repeat the request on different Australian connections, such as home broadband and a mobile hotspot, and then compare an overseas network. A domain that works on one carrier but not another may be subject to ISP filtering. A domain that works everywhere except a particular country may instead be using geographic access controls, a web-application firewall or a regional content restriction.

Neumon’s recently blocked site filters can help identify recent filtering campaigns and newly reported domains. Such reports are valuable historical context, but a listing does not prove that the site is blocked now. Search indexes, archived pages and monitoring results may all lag behind the current state of DNS and hosting.

Separate web errors from access controls

An HTTP 404 means the server answered, but the requested resource is missing. It is not evidence of censorship. A 403 can indicate authorisation rules or application security, while 451 commonly represents a legally unavailable resource. Server errors such as 502, 503 and 520 point more strongly towards an upstream or hosting problem, although deliberate filtering can also imitate some of them.

TLS warnings deserve equally careful treatment. A certificate mismatch may indicate an expired certificate, an incomplete CDN configuration or a domain that has moved. Some filtering systems also interfere with connections, but the certificate error alone cannot identify the cause. Comparing the hostname, certificate issuer and valid address with an independent DNS lookup can prevent a technical misconfiguration from being mislabelled.

Australia’s enforcement of illegal online casinos makes this distinction particularly relevant. ACMA can require internet service providers to block access to identified gambling services, so a casino domain that fails in Australia may remain active elsewhere. Neumon’s analysis of high roller casino promotions illustrates the type of recent blocking activity that can otherwise be mistaken for a failed website. The status of the domain itself must still be checked separately.

A practical Australian diagnostic checklist

Before recording a domain as blocked, capture the exact URL, time, Australian city, connection type and ISP. A small Melbourne business checking its .com.au address on fixed-line broadband, for example, should repeat the test on mobile before assuming that its site has disappeared. Under the .com.au registration system managed by auDA, expiry and loss of nameserver delegation can also make an established-looking address unreachable.

Evidence becomes easier to interpret when ordinary users understand which observation supports which conclusion. Community education, including work associated with the Girlforce project, can make these checks more accessible without requiring advanced networking knowledge. A short, repeatable sequence is usually more informative than repeatedly refreshing a browser page.

The sequence should cover these essential checks:

• Record the precise URL, date, time, location, device and Australian carrier or network type.
• Compare the default DNS result with at least one independent public resolver.
• Inspect the HTTP status, redirects, response body and TLS certificate for the requested hostname.
• Repeat the request on a second connection, such as fixed-line broadband and a mobile hotspot.
• Check authoritative nameservers and domain registration status to identify expiry or broken delegation.
• Compare Australian and overseas results, then look for corroborating reports or recent archived activity.
• Classify the evidence separately as a domain failure, server failure, access control or location-specific filtering.

Keep evidence ready for useful reporting

A useful record distinguishes observations from interpretation. Instead of writing “the government blocked it”, note that the authoritative DNS existed, the system resolver returned a sinkhole address, the public resolver returned a valid address and the site loaded from an overseas connection. Clear observations allow later reviewers to revisit the conclusion without repeating the entire investigation.

Operational context also matters. When the affected service supports specialist work, identify it accurately: unmanned-aircraft material published through public safety resources should not be reduced to an unexplained “website failure”. Precise details help separate genuine filtering from domain inactivity and prevent unrelated incidents from being combined.

The strongest diagnosis combines registration data, DNS answers, HTTP behaviour and tests from several networks. Remember that consistent failure across resolvers and locations usually indicates an inactive domain or service, while a failure that changes with Australian carrier, resolver or route is the stronger signal of deliberate interference.