dig @dnsp.co <any name>
The one test to run first: a fixed answer that never changes.
What it does
Ask our nameserver for any name at all and it replies with the same two sentinel addresses. Nothing about the name matters, so the answer you get is entirely a statement about the path between your machine and ours.
Example
$ dig @dnsp.co www.example.org +short
123.45.67.89
$ dig @dnsp.co anything.you.like AAAA +short
1111:2222:3333:4444:5555:6666:7777:8888
Reading the answer
123.45.67.89
Clean. Your query reached us and the answer came back untouched.
a real address
Something answered in our place: a captive resolver, a middlebox, or a transparent redirect on port 53.
no response
Outbound DNS to servers other than the local resolver is being dropped. Try the alternate port.
Notes
- Substitute any domain you are suspicious about. The answer should still be the sentinel.
- Leaving off @dnsp.co makes it an ordinary lookup and not a valid test.