{"ok":true,"request":{"host":"cpa.tg","scheme":"https","http_version":"HTTP/1.1","client_ip":"216.73.216.171","observed_at":"2026-04-17T16:32:41+00:00"},"dns_diagnostics":{"status":"configured","config":{"probe_domain":"probe.cpa.tg","probe_endpoint":"/check/dns-session.php","provider":"self-hosted","results_path":"/var/www/cpa-tg/shared/checker-dns","results_path_label":"shared/checker-dns/hits.ndjson","ingest_secret_configured":true,"session_ttl_seconds":3600,"bind_host":"135.181.253.143","bind_port":53,"forward_url":"https://cpa.tg/check/dns-ingest.php","forward_secret_configured":true,"forward_timeout_seconds":2,"response_a":"127.0.0.1","response_aaaa":"::1"},"contract":[{"name":"Probe domain","field":"probe_domain","description":"Dedicated domain or subdomain delegated for resolver probing","present":true,"value":"probe.cpa.tg"},{"name":"Probe endpoint","field":"probe_endpoint","description":"HTTP endpoint that issues or coordinates DNS probe sessions","present":true,"value":"/check/dns-session.php"},{"name":"Results storage","field":"results_path","description":"Shared storage or service that keeps observed resolver hits","present":true,"value":"shared/checker-dns/hits.ndjson"},{"name":"Ingest secret","field":"ingest_secret_configured","description":"Optional secret for HTTP ingest endpoint used by resolver logging backends","present":true,"value":"configured"}],"missing_requirements":[],"sample_probe_token":"75a90bb4cfb3b9a6","sample_probe_host":"75a90bb4cfb3b9a6.probe.cpa.tg","session_endpoints":{"create":"/check/dns-session.php","status":"/check/dns-session-status.php?token=75a90bb4cfb3b9a6","recent":"/check/dns-sessions.php","report":"/check/dns-session-report.php?token=75a90bb4cfb3b9a6","ingest":"/check/dns-ingest.php"},"ingest_contract":{"header":"X-CPA-DNS-INGEST-SECRET","body_fields":["token","observed_at","resolver_ip","resolver_asn","resolver_provider","country_code","country","source","raw"],"payload_example":{"token":"75a90bb4cfb3b9a6","observed_at":"2026-04-17T16:32:41+00:00","resolver_ip":"8.8.8.8","resolver_asn":"AS15169","resolver_provider":"Google Public DNS","country_code":"US","country":"United States","source":"resolver_logger","raw":{"qname":"75a90bb4cfb3b9a6.probe.cpa.tg","transport":"udp"}}},"recommendations":[],"notes":["DNS leak checks cannot be inferred honestly from browser JS alone. They require a resolver-probing backend.","The checker can already create local DNS probe sessions and store observed hits; what is missing is a real resolver-side signal source.","Example probe hostname for the current request: 75a90bb4cfb3b9a6.probe.cpa.tg","The self-hosted DNS backend scaffold is implemented in scripts/runtime/dns_probe_daemon.php and can write directly into the checker results store."]}}