t.me links died for a day. It wasn’t Brussels - this time.

serverHold is a registry-level status code that prevents the domain from being published in the global DNS. Unlike a normal suspension or a clientHold (which a registrar can apply), this one can only be set by the registry itself.

Once applied, every DNS query for t.me returned NXDOMAIN — the internet’s way of saying the address does not exist.

The stated reason, once it emerged, was compliance with U.S. Treasury sanctions.

A Ukraine-based VPN service listed under OFAC sanctions had maintained a presence on t.me.

Rather than target that specific channel or account, the registry applied a status code that rendered the entire domain unreachable.

The sanctions action that triggered the t.me outage targeted First VPN Service, also known as 1VPNS, a commercial VPN provider based in Dnipro, Ukraine, and operated by Dmytro Rashevskyi.

According to the U.S. Treasury’s July 13 designation, the service had been actively used by ransomware groups since at least 2014 to conceal the origin of attacks against American hospitals, businesses, and critical infrastructure, resulting in billions of dollars in losses.

The operator had marketed the service on criminal forums with assurances that it would keep law enforcement at a distance, while a Belarusian national was sanctioned alongside him for supplying cryptors designed to disguise malicious software.

When OFAC published the sanctions notice, it listed among the entity’s identifiers the Telegram channel t.me/FirstVPNService.

The incident was resolved within roughly twenty-four hours once the hold was lifted.

What remained was a clear demonstration of how little infrastructure stands between a widely used communication tool and sudden, silent disconnection.

The broader mechanism

Domain registries and DNS infrastructure are not neutral plumbing.

When an authority with the appropriate access decides that a domain has become inconvenient, the effect can be immediate and widespread.

This particular decision originated outside the European Union. It was executed through a non-EU registry in response to U.S. sanctions policy.

The policy direction already in motion

While the t.me domain was being restored, European Commission President Ursula von der Leyen was outlining the next stage of the EU’s approach to online access.

The Commission’s position is that everyone wishing to use social media platforms will eventually need to authenticate through an official EU identity application.

Citizens can therefore look forward to a safer internet in which authorities know exactly who is unable to access what.

The registry action showed that the means to interrupt access at scale already exist and can be activated quickly and effectively.

The t.me outage lasted only about a day, but the experiment was a success. A globally used communications gateway was silently disabled, the public received an explanation afterwards, and the infrastructure returned without any uncomfortable debate about who should possess such power.

Brussels did not cause this one.

It may nevertheless be grateful for the demonstration.