The lookup failed before the service was ever contacted

The browser says the onionsite could not be found. That wording is unfortunate, because it sounds like a verdict about the site and it is a report about a lookup.

Reaching an onion service takes two stages. Something has to be found first, and only then can anything be contacted. Most people do not know the first stage exists, so every failure gets attributed to the second.

What actually has to happen

1. The client works out which relays should be holding the directory entry for that key today.
2. It asks them for that entry, which describes where the service can currently be met.
3. It picks one of the meeting points named there and asks it to arrange a rendezvous.
4. Both sides meet at a chosen relay and the connection begins.

Stages one and two are the lookup. If they fail, nothing was ever contacted and the service has no idea you tried. Whether it is running or not is a question that never came up.

Why the lookup fails on its own

• The relays responsible for that entry today are slow, loaded or offline.
• The set of responsible relays rotates on a schedule, and a rotation can be awkwardly timed.
• Your own client cached a failure and is not eager to try again immediately.
• Your clock is wrong, which quietly breaks the whole scheme because the schedule depends on time.

That last one is worth its own sentence. A machine whose clock has drifted badly will fail these lookups consistently, in a way that looks exactly like the entire dark web being broken, and nothing on screen will suggest looking at the clock.

Telling it apart from a retired address

You cannot, from one attempt. That is the honest answer and it is the whole reason this page exists.

What you can do is repeat over a longer period. A lookup failure is intermittent, so trying again in an hour, and again the next day, will usually succeed at some point. A retired address never succeeds, no matter how many times or how patiently you try. Time separates them and nothing else does.

What follows from getting it right

The response changes completely. If this is a lookup failure, the correct action is to close the browser and come back later. If you have decided it is a dead address, the action is to go looking for a replacement, and that is the action with actual risk attached to it.

So the cost of the wrong attribution here is not embarrassment. It is that a temporary network condition sends people out to collect addresses from wherever they can find them, which is precisely how the bad ones get into circulation.

Check the clock before anything else

It takes five seconds and it is the one local cause on this page. Look at the system clock on the machine, including the date and the time zone. If it is out by more than a few minutes, correct it and try again before drawing any conclusion.

Clocks drift on machines that are rarely on, on virtual machines that have been suspended, and on anything whose time synchronisation was switched off at some point for reasons that made sense then. The failure this produces is total and silent, and people have spent whole evenings on it while the answer sat in the corner of the screen.

• Back to the cases the network caused
• When the address really was retired
• Terms used on this site