Verdict reference
Each cohort (one operator, one connection type) ends with exactly one outcome. Four of them are verdicts about your site. Five are not: they describe our ability to measure, and they are never charged. Of the four verdicts, only ok, blocked and target_down will be charged once billing starts; target_policy is free.
Verdicts: about your site
| Outcome | Meaning |
|---|---|
| ok | Subscribers received the page and the certificate was valid for your name. Shown yellow when the layer that matters most in that country could not be checked; the result lists it in coverage_gaps. |
| blocked | Something on the operator's side stopped the page. Always comes with a layer and a method. |
| target_down | The site fails from everywhere, our datacenter controls included. It is down, not blocked. |
| target_policy | Your site refused our exits: an anti-bot challenge, a geo rule or a rate limit. Not censorship. |
Non-verdicts: about our measurement
| Outcome | Meaning |
|---|---|
| proxy_failure | Our exit failed: it changed networks during the measurement (exit_changed) or disappeared (exit_lost). |
| provider_policy | The proxy network we use does not allow this site. Says nothing about the operator. |
| exit_regime | The whole network was in an allowlist-only or shutdown state at the time. |
| inconclusive | Too little data, or exits contradicted each other in a way we could not resolve. |
| not_measured | Nothing to measure with: no suitable exits that day (no_vantage), no verified resolver (no_resolver), or the capability is not verified for that network yet. |
Layers
| Layer | Where the page was stopped |
|---|---|
dns | The operator's resolver gave a wrong answer or none. |
ip, tcp | Your server's address was unreachable or the connection was cut. |
tls_sni | The handshake was interrupted after the server name was sent. |
tls_mitm | A certificate that is not yours was presented on the path. |
http | An operator page was returned instead of yours. |
cdn | The CDN in front of your site shows its own block page, for example Cloudflare's HTTP 451 page for a legal order in the United Kingdom. |
Reserved and not detected yet: quic, throttle, stall, ech, browser.
Methods
- redirect
- DNS answer points to another address, usually a notice page.
- nxdomain
- Forged "no such name" (no SOA record from your zone).
- nodata · servfail · refused
- Empty, failed or refused DNS answers that our controls do not get.
- timeout · drop
- Packets disappear without an answer.
- reset · reset_on_syn
- The connection is reset, during or right at the start.
- blockpage
- A known operator or regulator notice page.
- alert
- A TLS alert injected on the path.
- substitution
- A substituted certificate.
Confidence
- confirmed
- A direct artifact (notice page, forged answer, foreign certificate) plus the evidence minimums: 3 subscribers in 2 subnets for a block.
- likely
- The evidence minimums and clean controls, without a direct artifact. Also the ceiling for DNS blocks on mobile networks and for the optional operator-filter group (Telenor Nettvern+). On mobile networks we cannot ask the provider's DNS server directly; we only see what the customer's phone got.
- partial
- Exits disagree.
conditions.sharesays what share was affected. - insufficient
- The minimum number of subscribers and subnets was not reached.
Results also carry populations: the same operator split by DNS setup, for example subscribers on the operator's resolver against subscribers on Cloudflare DNS. They are reported side by side, never mixed.
Last updated 11 November 2026.