Is it DNS? Find out in two queries.
No install. No agent. Nothing you run here reports back about you. Paste two ordinary DNS queries into any terminal you already have. The queries are the diagnosis. You read the answer yourself. Works on a laptop, a server, a container, a router shell: anywhere DNS resolves.
This page itself loads two things beyond its own markup: Cloudflare Web Analytics, a cookieless page-view beacon, and Microsoft Clarity, masked session recording with cookies off (opt out with ?clarity=off). They count the page and how it is used, not you, and they play no part in the two checks below.
Run it right here, over DoH
One click. Your browser mints a fresh nonce and asks over DNS-over-HTTPS, using the JSON API that Cloudflare and Google publish rather than the RFC 8484 wire format. Nothing is stored; the query goes to a public resolver, same as any page load.
Or paste it into any terminal
1 · Is your DNS answer being rewritten?
Ask for the public tripwire name. Its answer is a fixed test address
(192.0.2.111, reserved and unroutable). If you get anything else back, something on
your path rewrote the answer.
good: 192.0.2.111 · anything else: your DNS answer was rewritten in flight
2 · Did your query reach the genuine authority?
Ask for a name that has never existed and never will: a fresh random label. No cache,
forwarder, or interceptor can have an answer ready, so a reply means your query actually reached a
real authority. The reply is a signed receipt. The label is x plus 26 characters from
a-z2-7; the nslookup pane below carries a fixed one, so change a few of its letters
before you run it or you are asking for a name someone else may already have cached.
good: a base64url TXT string comes back · empty / SERVFAIL: your path never reached the authority
dig always has. Nothing is installed and
nothing reports back about you.