diff --git a/doc/Changelog b/doc/Changelog
index df5a52f42..495d0d9c6 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,8 @@
+9 September 2010: Wouter
+	- unresponsive servers are not completely blacklisted (because of
+	  firewalls), but also not probed all the time (because of the request
+	  list size it generates).  The probe rate is 1%.
+
 20 August 2010: Wouter
 	- openbsd-lint fixes: acl_list_get_mem used if debug-alloc enabled.
 	  iterator get_mem includes priv_get_mem.  delegpt nodup removed.
diff --git a/iterator/iter_utils.c b/iterator/iter_utils.c
index f01aea633..a55606534 100644
--- a/iterator/iter_utils.c
+++ b/iterator/iter_utils.c
@@ -207,9 +207,15 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 		if(lame)
 			return -1; /* server is lame */
 		else if(rtt >= USEFUL_SERVER_TOP_TIMEOUT && 
-			lost >= USEFUL_SERVER_MAX_LOST)
-			/* server is unresponsive, but keep trying slowly */
-			return USEFUL_SERVER_TOP_TIMEOUT+1;
+			lost >= USEFUL_SERVER_MAX_LOST) {
+			/* keep trying slowly, 1% of the time, because
+			 * this can be due to weird firewalls.  This number
+			 * does not have to be securely random. */
+			if(ub_random(env->rnd) % 100 == 0)
+				return USEFUL_SERVER_TOP_TIMEOUT+1;
+			/* server is unresponsive */
+			return -1;
+		}
 		/* select remainder from worst to best */
 		else if(reclame)
 			return rtt+USEFUL_SERVER_TOP_TIMEOUT*3; /* nonpref */