Summary

The ISP proxy .gov section said ISP proxies fall back to a provider that "carries some .gov destinations", and that running without a proxy reaches .gov directly. Neither is accurate for government domains outside the US, and the second isn't true for stealth browsers.

• ISP proxies: US .gov works through the ISP provider. Many foreign government domains (.gov.br, .gov.uk, .gov.au, .gov.in, .gov.il, …) are blocked by the provider for every exit IP, and ISP proxies don't reroute blocked destinations, so these fail with provider_blacklisted. Changing country doesn't help.
• Stealth browsers without a proxy_id use a Kernel-managed ISP proxy rather than direct egress, so the same block applies. The page now points to disable_default_proxy for direct routing.
• Lists the two workarounds: a residential proxy (country-only, no targeting, or US state), or bypass_hosts (e.g. *.gov.br) to use direct egress.
• Residential page: notes that the automatic reroute also covers government domains outside the US, not just .gov.

Behavior verified against packages/api/lib/proxies/provider_blocks_byteful.yaml, destination_route.go, and packages/metro-api/lib/egressproxy/{restricted_route.go,stealth_default.go,isp_fallback.go} in kernel/kernel, plus production data: no provider_blacklisted on US .gov over ISP in the last 7 days while foreign gov TLDs are refused, and 87% of US .gov navigations from stealth browsers on the default ISP proxy succeeded over the last 2 days (44k navigations, 774 domains). The remaining failures are site-specific (provider_unreachable / provider_rejected), hence the "individual sites can still refuse proxy traffic" caveat. *.gov.br is accepted by bypass_hosts validation (only exact public suffixes are rejected).

Not run locally with mintlify dev.

🤖 Generated with Claude Code