dnsp.co on UDP/10053
The same resolver, listening on UDP/10053.
What it does
Transparent DNS interception is usually wired to port 53 alone. Running the identical query against port 10053 tells you whether the difference you are seeing is about DNS or just about that port number.
Example
$ dig @dnsp.co -p 10053 www.example.org +short
123.45.67.89
Reading the answer
the same sentinel on both ports
Nothing is watching port 53 specifically.
clean on 10053, altered on 53
Port-based interception: a proxy is watching the standard port only.
nothing on 10053
Outbound UDP to unusual ports is blocked, which is common on managed networks.
Notes
- Run the basic test first so you have a port 53 result to compare against.