An app cannot connect

Compare the behaviour

Check the same resource with protection stopped. If it is still unavailable, the failure cannot be attributed to NetScope without more evidence.

In the DNS build

Find the domain related to the symptom in activity history. If blocked, review its rule and the app policy. If the request should be allowed, add a specific exception for the verified domain or deliberately change the appropriate DNS policy. Ad blocking can affect useful content.

An allowed query with no connection does not establish successful upstream DNS or TCP delivery. See DNS problems. A DNS policy does not generally allow or deny every connection.

In experimental Preview

Check whether the app is a configured participant and which transport policy applies. When an external proxy fails, a PROXY connection should terminate without hidden Direct fallback. Do not silently switch to Direct to restore access: that changes the intended route.

Compatibility with UDP/QUIC, IPv6 or every app is not promised. Keep the symptom and diagnostics for review without unnecessarily broadening scope.