A site won't open, but the internet works. What has happened?

Everything works. Email arrives, videos play, your son’s phone is downloading away happily. Only that one site won’t open. And since everything else is fine, the only explanation that comes to mind is that the site must be broken.

It might be. But there are at least four different causes that produce the same symptom, and you can tell them apart in five minutes without installing anything.

The chain, and where it breaks

When you type an address, your device does not know where to go. It has to ask, and the question passes through a chain of four links.

The first sits inside your computer or phone: a piece of the operating system that can’t resolve names on its own and asks somebody else, keeping recent answers in memory. The second, almost always, is the home router, which forwards the question. The third is your provider’s resolver, the one doing the real work and holding a much larger memory. The fourth is the server belonging to whoever owns the domain, the only one that knows the exact answer.

Every answer has an expiry date, and here there is a subtlety that accounts for half of the mysterious cases: negative answers get kept too. If a domain failed to answer for a few minutes, that “doesn’t exist” stays in memory until it expires, and in the meantime the site is back up but you still can’t see it. That is why sometimes a thing sorts itself out after an hour, with you having done nothing.

Here is where it breaks, and what it looks like:

Where	What you see
Your device’s memory	won’t open on one device, opens on another in the same house
Home router	won’t open from home, opens on mobile data
Provider’s resolver	won’t open with that provider, everything else works
The domain’s server	won’t open for anybody in the world
Routing towards the address	the name translates, but the page sits loading and then times out

The last row deserves attention, because it is the one that sends people off course. If the block is on the address and not on the name, the name carries on translating perfectly well: the connection simply never starts. Changing any DNS setting, there, achieves nothing.

The two checks that cost nothing

First: try it on mobile data. Turn Wi-Fi off on your phone and try again. If the site opens, you have already ruled out its being broken, and you know the problem sits between your house and your fixed-line provider. If it doesn’t open there either, and you have two different providers, that is a strong piece of information.

Second: read what kind of error it is. There is a dividing line here that is worth more than a thousand attempts. If the browser shows you a warning about the security certificate, the DNS worked perfectly: the browser found the address, connected to it and talked to the server. The problem is elsewhere.

The codes you see have precise meanings, and Mozilla’s documentation is the clearest source I have found:

• the certificate has expired: that is the site’s problem, not yours;
• the certificate isn’t valid yet, with a date in the future: almost always it is your own system clock that is wrong, and correcting the date and time fixes it;
• the issuer is unknown: a piece of the chain may be missing on the server, or else there is something in the middle. And here Mozilla does something I appreciate: it names the most frequent culprits, that is antivirus software inspecting encrypted traffic, citing Avast, Bitdefender, ESET and Kaspersky, and notes that the same warning can appear on Windows when family control settings are switched on.

If instead the error says the name won’t resolve, you are at the top of the chain. If the page sits loading and then times out, you are at the bottom.

And if everything else is sluggish and not just that one site, then this isn’t your problem: thirty seconds with How good is my connection? will tell you, and if the numbers are normal you have ruled out the line and can come back here.

The Italian part: blocking

There is one cause that has become frequent in Italy and that practically nobody thinks of, because it doesn’t look like a fault: the site is blocked by order of the authorities.

The basis is law 93 of 14 July 2023, published on 24 July and in force from 8 August, which gave AGCOM, the Italian communications regulator, the power to order the blocking of unlawfully distributed content, with a very fast procedure where live broadcasts are concerned. The platform that carries it out is called Piracy Shield and has handled reports automatically since 1 February 2024.

Two technical details explain almost all the symptoms.

The first: there are two ways of blocking, and they are kept distinct in the text of the regulation. Either name resolution is disabled, or the routing of traffic towards the addresses is blocked, or both. They are the same two rows of the table above, written into a rule.

The second: requests may be redirected to an information page explaining the situation and pointing out the possibility of lodging a complaint. So the symptom isn’t always an error: sometimes it is a page appearing in place of the site.

The deadlines are tight. For live content the block has to be carried out within thirty minutes of notification. In 2024 the scope was extended, VPN providers and public DNS providers wherever resident were added to those the orders can be addressed to, and the condition for blocking a resource moved from “used uniquely” to “used predominantly” for unlawful activity.

The official tool almost nobody knows about

This is the most useful thing in the article.

There is no public, downloadable list of blocked names, and the delibera explains why: the full list of addresses is not published because it might contain personal data. There is, though, an official AGCOM tool where you query one name or address at a time and see whether it comes back as blocked: it is at blocchips.agcom.it, it is linked from the institutional page, it only asks you to pass an anti-robot check and it doesn’t ask you to register.

Ten seconds in there separates “the site is down” from “the site is blocked in Italy”, which are two completely different stories and lead to two different reactions.

If it comes back as blocked and you think that is a mistake, the complaint route exists: it has to be lodged within ten days, and it can be lodged by those the order was addressed to and, for live broadcasts, by anyone with a qualified interest, that is service providers, whoever uploaded the content and whoever runs the site or the page. One point needs saying clearly because it changes expectations: the complaint does not suspend the block. Beyond that there remains the route of the administrative courts, with the ordinary time limits of administrative proceedings.

That the subject is still being argued over is shown by the facts, with no need for commentary. In June 2025 the European Commission asked Italy for clarification on ten points of the draft amendment to the regulation, among them its relationship with the European regulation on digital services and with the Charter of Fundamental Rights, and the reasons for the six-month term before addresses are unblocked. At the end of December 2025 AGCOM fined Cloudflare over fourteen million euro for failing to comply with a blocking order, and Cloudflare appealed, arguing among other things that the fine is calculated on worldwide turnover. There also appears to be a July 2026 judgment of the TAR del Lazio rejecting Cloudflare’s appeals, but I found it reported by a law firm that was acting for the other side and I have not read the text, so I pass it on as an unverified report.

Changing DNS: what it does and what it doesn’t

At this point a lot of people think about changing their DNS, and it is worth understanding what actually happens, because the expectations out there are wrong in both directions.

Changing resolver means asking somebody other than your own provider to translate names for you. People do it for legitimate and widespread reasons: sometimes it is faster, often it is more reliable, and some resolvers filter out malware and phishing sites. Quad9, for instance, blocks malicious domains on the basis of reports from its partners, and Cloudflare offers variants that filter malware, or malware and adult content.

What really changes is who sees your requests, and here it pays to read the official pages instead of the summaries. Cloudflare states that it truncates the originating address and deletes logs within twenty-five hours, with random sampling of no more than 0.05% of traffic for diagnostics. Google keeps temporary logs containing the device’s address and deletes them within twenty-four or forty-eight hours, plus sampled permanent logs from which the address is removed. Quad9, which is a non-profit foundation based in Zurich, states that it strips the client address at the network edge and does not store it on disk.

None of these three options amounts to “nobody sees anything”. Changing resolver doesn’t remove the observer, it swaps it for a different one that declares it behaves in a certain way.

And now the two limits, which are technical facts and not opinions.

The first: changing resolver has no effect at all on a block acting on the routing towards the address, because that block bites after the name has been translated. The Italian rule explicitly provides for both measures.

The second: since 2024 publicly available DNS providers, wherever resident and located, are also among those the orders can be addressed to. The dispute with Cloudflare arises from exactly this. So the idea that moving to a foreign resolver puts you out of reach of an Italian order does not hold as a general rule.

On the legal side, for an ordinary reader, the formulation I can defend after reading the parliamentary documentation is this, and I will stop there: the law does not provide for a penalty for changing DNS as such; it provides penalties for buying and consuming unlawful services, and those apply regardless of the technical means by which you get there. I am not a lawyer and this is not legal advice.

What to do, in order

1. Try another device on the same network. If it works there, it is the first device's memory: often a restart is enough.
2. Try it on mobile data. If it works, the problem is between your house and your provider.
3. Look at the error. A certificate warning means the DNS worked. A name that won't resolve means the opposite. A page that sits loading means the name translated but the connection never started.
4. Check the clock, if the warning talks about a certificate not yet valid. It happens on computers left switched off for a long time and on devices whose backup battery has run flat.
5. Query the AGCOM tool at blocchips.agcom.it. Ten seconds, and you know whether that name comes back as blocked in Italy.
6. Restart the router and wait. If the cause was an old answer left in memory, time sorts it out on its own.
7. If you are on a public network, on a train or in a hotel, the reason is almost always that you haven't logged in to the portal yet. Try opening any unencrypted site and see whether the sign-in page appears.

To understand what sits underneath

If the problem isn’t one site but the whole connection, start from How good is my connection? to get a number, and then the checks in order in Slow Wi-Fi: six checks to make before calling your provider. And if sites open but video calls keep stumbling, the cause is a different one again: I have explained it in The video call keeps breaking up, but the test says the line is fast.