The tunnel is up but one site won't load

If the tunnel is connected and almost everything works but one particular site never loads, the likely cause is DNS security validation.

Every Litora gateway runs its own DNS resolver with DNSSEC validation on: an answer that fails its own domain's cryptographic signature is rejected rather than passed to you. That protects you from forged answers — and it also means a site whose owner has broken their DNSSEC records will not resolve through Litora, even though it may load on a network whose resolver does not validate.

How to tell: the site fails on every Litora location but works with the tunnel off, and other sites are fine. You can confirm at dnsviz.net, which visualises a domain's DNSSEC state.

What to do: nothing on your side is broken. The site's owner has to fix their records — this is worth telling them, since validating resolvers are common. If you believe the site's DNSSEC is actually fine, message the bot with the domain and we will look.