fail.dnsp.co

Not a nameserver. Any reply from it is manufactured.

What it does

fail.dnsp.co resolves to an address where nothing is listening for DNS. Aiming a query at it should time out. If an answer comes back, something in the path is impersonating whatever nameserver you try to reach.

Example

$ dig @fail.dnsp.co www.example.org

;; connection timed out; no servers could be reached

Reading the answer

a timeout

Correct. There is nothing there to answer.

any answer at all

Proof of interception: a device is answering on behalf of servers it is not.

REFUSED

Something is present and declining, which still means the packet did not reach a real nameserver.

Notes

This is the strongest single proof of transparent DNS redirection.
Hotel, airport and captive portal networks fail this test routinely.