…
Testing DNS path…
Racing two Pi-hole-only probes. This takes up to ~3 seconds.
Diagnostics
Caveats & how to read this
- Chrome Private/Local Network Access: this page is
public-origin and fetches private IPs (
192.168.x; CGNAT100.64.0.0/10is also classified private). Chrome may send a PNA preflight (handled server-side viaAccess-Control-Allow-Private-Network: true) or, under the newer Local Network Access model, show a one-time permission prompt — deny it and the canary shows a false RED. Firefox historically doesn't enforce this; Safari differs again. - Browser DoH: if the browser uses its own DNS-over-HTTPS ("secure DNS"), probes bypass Pi-hole and this page shows RED even though the OS resolver may be Pi-hole. Accurate for the browser, not necessarily for the whole device.
- DNS caching: after toggling Tailscale or switching networks, the OS/browser may serve cached probe answers for a short while — reload after a few seconds before trusting a surprising verdict.
- Hostile/captive networks: networks that rewrite NXDOMAIN send the probe to a wrong host; TLS validation makes the probe fail — RED, which remains correct.
- Timeout: a probe to a resolvable-but-unreachable IP burns the full 3 s, so RED can take up to ~3 s; NXDOMAIN-everywhere RED is near-instant.