diff --git a/helpers/on-connect.js b/helpers/on-connect.js
index 0493eede08..e467c45013 100644
--- a/helpers/on-connect.js
+++ b/helpers/on-connect.js
@@ -66,6 +66,30 @@ async function onConnect(session, fn) {
       if (env.NODE_ENV !== 'production') this.logger.debug(err, { session });
     }
 
+    // check against hard-coded denylist
+    let isDenylisted = false;
+    if (
+      session.resolvedClientHostname &&
+      config.denylist.has(session.resolvedClientHostname)
+    )
+      isDenylisted = session.resolvedClientHostname;
+    else if (
+      session.resolvedRootClientHostname &&
+      config.denylist.has(session.resolvedRootClientHostname)
+    )
+      isDenylisted = session.resolvedRootClientHostname;
+    else if (config.denylist.has(session.remoteAddress))
+      isDenylisted = session.remoteAddress;
+
+    if (isDenylisted) {
+      const err = new DenylistError(
+        `The value ${isDenylisted} is denylisted by ${config.urls.web} ; To request removal, you must visit ${config.urls.web}/denylist?q=${isDenylisted} ;`,
+        550,
+        isDenylisted
+      );
+      throw err;
+    }
+
     //
     // check if the connecting remote IP address is allowlisted
     //
@@ -106,30 +130,6 @@ async function onConnect(session, fn) {
     return fn(refineAndLogError(err, session, false, this));
   }
 
-  // check against hard-coded denylist
-  let isDenylisted = false;
-  if (
-    session.resolvedClientHostname &&
-    config.denylist.has(session.resolvedClientHostname)
-  )
-    isDenylisted = session.resolvedClientHostname;
-  else if (
-    session.resolvedRootClientHostname &&
-    config.denylist.has(session.resolvedRootClientHostname)
-  )
-    isDenylisted = session.resolvedRootClientHostname;
-  else if (config.denylist.has(session.remoteAddress))
-    isDenylisted = session.remoteAddress;
-
-  if (isDenylisted) {
-    const err = new DenylistError(
-      `The value ${isDenylisted} is denylisted by ${config.urls.web} ; To request removal, you must visit ${config.urls.web}/denylist?q=${isDenylisted} ;`,
-      550,
-      isDenylisted
-    );
-    return fn(refineAndLogError(err, session, false, this));
-  }
-
   try {
     // NOTE: do not change this prefix unless you also change it in `helpers/on-close.js`
     const prefix = `concurrent_${this.constructor.name.toLowerCase()}_${