diff --git a/app/validator.py b/app/validator.py
index 9abb50a..7374a7d 100644
--- a/app/validator.py
+++ b/app/validator.py
@@ -152,14 +152,15 @@ async def _check_domain(domain: str) -> dict:
             result["prescreen_status"] = "live"
             return result
 
-        except (httpx.ConnectError, httpx.RemoteProtocolError) as e:
-            # Port refused or bad HTTP response → server may be https-only, try it
+        except (httpx.ConnectError, httpx.RemoteProtocolError, httpx.ConnectTimeout) as e:
+            # Port refused, wrong protocol, or port 80 firewalled/timed-out
+            # → server may be https-only, always retry on 443
             if scheme == "http":
                 logger.debug("Validator %s: %s on http, trying https", domain, type(e).__name__)
                 continue
             break
         except Exception as e:
-            # Timeout or other error → https won't help, mark dead
+            # ReadTimeout or other error — connected but server too slow; mark dead
             logger.debug("Validator %s (%s): %s", domain, scheme, type(e).__name__)
             break