Understanding the Resolved status on a blocked URL report

When someone runs a URL through a network monitoring tool like Net Neutrality Monitor, the report they receive usually includes a short label that condenses a lot of technical information into a single word. One of the most frequently misunderstood labels is "Resolved," and it tends to puzzle people the first time they see it next to a domain they expected to be unreachable. The label has a precise meaning worth unpacking, especially for readers in Australia who often rely on these reports to make sense of behaviour from Telstra, Optus, TPG and other local providers.

The confusion usually starts because Resolved sounds like the opposite of a problem. In a network monitoring context, though, it refers to the lifecycle stage of the report itself rather than to the present accessibility of the site. Once you understand the workflow behind each entry, the term stops being ambiguous and starts to feel like a practical signal you can act on.

What the Resolved label actually indicates

A Resolved entry means the original submission has moved past the open investigation phase. The probe has been run, the result verified against several network vantage points, and a researcher has confirmed the status before closing the case. In practice, somebody checked the URL through multiple DNS and HTTP probes, compared the output against regional blocking data, and concluded that the entry deserves a stable position on the public record rather than a provisional one.

This is different from a Pending entry, which appears when a submission has just arrived and the system has not finished checking it, and from a Confirmed entry that may have been left open for further community input. A Resolved status is, in effect, the final stop on that pipeline. The information is treated as settled enough to publish, and it joins the broader statistics that power country-level censorship overviews.

For Australian readers, this distinction matters because local ISPs sometimes lift or change blocks after the initial publicity has died down. A Resolved entry captures what was actually observed at the time of verification, without claiming anything about future behaviour from the same provider.

How reports move through the review pipeline

Every blocked URL report begins the same way: a user submits a URL or IP address through the website's contribution form. That submission lands in a queue where automated probes reach the target from various locations, including DNS resolvers inside Australian networks and international vantage points. Probe results are then packaged with details about which IP the domain resolved to, how long responses took, and whether the HTTP request returned expected content or got intercepted.

A volunteer reviewer picks the entry up once enough data has come back. Their job is to compare the probe output against known blacklists and to flag anything that does not match an established pattern. When the review supports the original report, the entry is confirmed and then closed as Resolved. If the reviewer cannot reproduce the block or finds evidence the original report was mistaken, the entry is closed instead with a different status that reflects what they actually saw.

This human-in-the-loop step is the reason a Resolved report carries more weight than a raw probe log. It reflects what a person concluded after examining the data, not just whatever the automated checks recorded on their own.

Why a Resolved entry can still appear blocked locally

A common question from Aussie users is why an entry marked Resolved can still look inaccessible on their home connection. There are a few reasons this can happen, and almost all of them come down to the difference between what the central probe saw and what an individual subscriber is seeing.

The first reason is provider-specific behaviour. Telstra, Optus, iiNet and TPG each run different DNS configurations, and they do not all intercept traffic on the same networks or in the same way. A block that registered on one resolver may not trigger on another, especially if the consumer is using a third-party DNS or a VPN that routes around the interception point. Australian DNS filtering pushed through the eSafety scheme and certain court-ordered blocks sit on top of those defaults, which adds another layer of variation between what different households see.

The second reason is timing. A Resolved entry is a snapshot, and an ISP can re-route, re-block or quietly drop a domain at any later point. Users who want to know what is happening right now rather than what the historical record says should re-run the URL through their own tools instead of relying on the closed report.

A useful way to think about it is that the platform publishes a forensic record, not a live status indicator.

Reading the technical details around the status

Each row in a country report sits alongside a small set of technical fields that give the Resolved label its real meaning. The DNS column shows what the domain resolved to under the probe, including the resolved IP address and which authority answered. The blacklist column points to the list or database that was cited when the block was observed. Those columns together tell you whether the verification was based on a generic blocklist, a regulator-supplied feed, or a more targeted configuration seen only in one region.

Probe counts sit next to those fields and indicate how many independent checks supported the conclusion. A higher count generally points to a more robust Resolved entry, since several probes from different vantage points reached the same outcome rather than a single noisy result. The interesting numbers are the ones that vary. If the same URL has been Resolved multiple times with different IPs or blacklists cited, that is often a clue the block has shifted underneath you.

For readers curious about how these lists feed into third-party tools, the project's public blacklist reference is a clean way to compare the entries used by the platform against the lists promoted by consumer DNS providers. It is also handy background for anyone weighing up which filtering posture they actually want on their home network.

What Australian users commonly report after resolution

Across the Australian leg of the project, the most frequent reaction to a Resolved status is a fair amount of head-scratching followed by a quick follow-up test. People tend to assume the label is wrong because their own browser still refuses to load the URL, then they realise the difference is local filtering rather than a contradiction in the report.

Plenty of users in Brisbane and Melbourne have written in to ask whether the Resolved status means a website has been completely unblocked across the country. The short answer is that it does not. All it means is that, at the time of verification, the project's probes saw something stable enough to document. It is not a guarantee about what Optus or Telstra will serve from a particular suburban exchange, nor is it a statement about mobile networks operating under different infrastructure.

A separate pattern shows up among users who lean on private network monitoring, where the project offers additional personal monitoring services for households and small businesses that want a tailored view of their own connection. In those cases the Resolved status on the public feed is treated as background context, while the real signal comes from repeated tests on the specific link being relied on.

How to interpret changes after a case is closed

Once a status has been Resolved, the entry is still subject to change if the underlying behaviour shifts. New submissions matching the same URL reopen the discussion, and substantial changes to the probe results prompt a reviewer to take another look. This is why an entry marked Resolved today can drift back to a Confirmed or even an Active state in the future, especially when an ISP rotates its DNS responses or moves a domain onto a different interception page.

The practical takeaway for anyone tracking censorship in Australia is to treat a Resolved status as the strongest single piece of evidence the system offers, but not a permanent one. Anyone making operational decisions based on the status, whether journalists working on a story, legal teams auditing regulator lists, or researchers comparing year-on-year trends, should pair it with their own recent probe output on the same network they actually care about.

Staying current with monitoring results also benefits from treating every closed report as evidence to interpret, rather than a verdict to memorise. The same instinct shows up in adjacent fields where operator handling matters. Crews who work with data-collecting hardware often use resources such as privacy training for drone operators to keep their handling of intercepted traffic disciplined. That habit translates directly into how Australian households read closed monitoring reports responsibly.

The fastest way to get a feel for how the platform treats each status is to open the country report for Australia today, pick a URL you have already tested on your own connection, and compare what your browser saw with what the platform recorded at its last resolution time. That single comparison tends to clarify the rest of the report faster than any glossary can.