Is this a problem only when the mod file changes or during startup as well?

startup as well

Hmm, the initial workspace load is supposed to allow network access.

Also: does go build succeed from the command line?

Could you share logs from your gopls session?
https://github.com/golang/tools/blob/master/gopls/doc/troubleshooting.md#capture-logs

for what it's worth, NixOS/nixpkgs#177632 was diagnosed to be due to dns resolution issues. I will open another issue because the error ends up being misleading and that is a problem of itself, but maybe there are dns issues going on here too?

@Jefftree: can you respond to @findleyr questions? Also is this the dns issue in your case like @rski mentioned?

Regarding the above mention on NixOS/nixpkgs#177632, see #53676

As explained in #53676 (comment) GOPROXY=off setting is intentional to prevent implicit network access - previously, the go command gopls depends on went to the network at the unexpected moment and causes unpredictable delays, so gopls attempts to control the network access by setting GOPROXY=off when necessary.

Ideally, the required modules should be already locally available in the module cache, or users should explicitly request to download them (go build, go mod tidy commands, or various code lenses and quick fixes in go.mod files or in the import statements). Gopls also attempts to download the missing modules when it starts (aka initial package loading), but it sounds like the initial package loading failed due to the network issue, and the subsequent GOPROXY=off error message distracted users. Since there is another issue open (#53676), let's follow up the issue there.