DNS answers
Looks up a few well-known names through this network's own resolver and through a public resolver (Quad9, over HTTPS), then compares the answers. This is the one check that sends a request to the internet: it carries the test name, and nothing about you or your network.
What it finds
- A network whose resolver answers differently from a public resolver, the pattern of a DNS redirect
- A network that sends every lookup to an address inside itself, the pattern of a sign-in or block page
What it cannot find
- A hijack of names this check did not ask for
- A hijack that only happens on some pages
- A network that answers honestly now and not later
- Anything the DNS answer does not touch, such as traffic redirected after the lookup
- Differences that are innocent: content delivery networks answer differently by place and time