diff --git a/src/indexer/bns-indexer.js b/src/indexer/bns-indexer.js
index c136cb6..93b529c 100644
--- a/src/indexer/bns-indexer.js
+++ b/src/indexer/bns-indexer.js
@@ -39,6 +39,13 @@ const CONFIG = {
   // Set to "" to disable TLD indexing (the /tld-list.json endpoint then 503s).
   // See Decentralized.DNS/DESIGN-tld-registry.md §7.
   tldBeacon: process.env.BNS_TLD_BEACON_SCRIPTHASH ?? (NETWORK.tldBeaconScripthash || ""),
+  // Blocklist addresses (PROTOCOL-ADDENDUM-blocklist.md), as scripthashes. A
+  // list is an ordinary address that resolvers read like a beacon; serving it
+  // here lets a client that only reaches this indexer (port 443) read the
+  // list. Defaults to the network table's lists; BNS_LIST_SCRIPTHASHES
+  // (comma-separated) replaces them, and "" disables.
+  lists: (process.env.BNS_LIST_SCRIPTHASHES ?? (NETWORK.blocklists || []).map((l) => l.scripthash).join(","))
+    .split(",").map((x) => x.trim()).filter(Boolean),
   // HTTP port for the /tld-list.json snapshot endpoint. 0 disables.
   httpPort: Number(process.env.BNS_HTTP_PORT || 0),
   httpBind: process.env.BNS_HTTP_BIND || "127.0.0.1",
@@ -394,6 +401,7 @@ async function main() {
   log(`connected to BCHN: chain=${chain.chain} blocks=${chain.blocks}`);
   const beacons = [CONFIG.beacon];
   if (CONFIG.tldBeacon) beacons.push(CONFIG.tldBeacon);
+  for (const l of CONFIG.lists) if (!beacons.includes(l)) beacons.push(l);
   log(`tracking ${beacons.length} beacon(s): ${beacons.map((b) => b.slice(0, 16) + "…").join(", ")}`);
   const src = new RpcSource(new BeaconIndex(beacons), CONFIG, rpc);
   src.load();
diff --git a/src/lib/resolver-web.js b/src/lib/resolver-web.js
index 9a4651d..ae385dd 100644
--- a/src/lib/resolver-web.js
+++ b/src/lib/resolver-web.js
@@ -919,7 +919,19 @@ export async function buildBlocklists({ network = NETWORK, lists, index = null,
   const out = new Map();
   if (!subscribed.length) return out;
   const pool = electrum ?? net.electrum.filter((s) => !net.beaconOnly.test(typeof s === "string" ? s : s.url));
-  const el = client ?? (await connectAny(pool, WS, { directIP }));
+  let el = client;
+  if (!el) {
+    try { el = await connectAny(pool, WS, { directIP }); }
+    catch (e) {
+      // No full server reachable (a network that only lets port 443 out).
+      // The project's indexers track the lists in the network table, so they
+      // can stand in — but only when every subscribed list still sits at its
+      // table address; a rotated or private list is unknown to them.
+      const tracked = new Set((net.blocklists || []).map((l) => l.beacon));
+      if (electrum || !subscribed.every((l) => tracked.has(blocklistAddress(l, index)))) throw e;
+      el = await connectAny(net.electrum, WS, { directIP });
+    }
+  }
   try {
     for (const list of subscribed) {
       const address = blocklistAddress(list, index);