docs(rules): read a public DNS record over DoH

Plain lookups from inside the network cannot see it. The gateway filters DNS
by content category, which it enforces by redirecting every port 53 packet to
its own resolver, so an external resolver appears to answer with the
split-horizon address and switching resolvers looks like confirmation.

Author: rewse

.chezmoitemplates/rules/common-standards.md

@@ -74,6 +74,10 @@ On macOS, use `mdfind` for file searches. Spotlight indexing makes broad paths l
 
 On macOS, use `container` instead of `docker`. On Linux, use `docker`.
 
+### DNS Lookups
+
+Read how a name resolves from outside a network over DoH, not with `dig` against an external resolver: `curl -s -H 'accept: application/dns-json' 'https://cloudflare-dns.com/dns-query?name=<name>&type=A'`. A gateway that filters DNS redirects every port 53 packet to its own resolver, so `dig @8.8.8.8` returns the internal answer while appearing to come from Google, and trying a different resolver changes nothing. Send a query to an unroutable address such as `192.0.2.1` to tell the two apart: an answer means the redirect is in place, a timeout means the queries leave.
+
 ### URL Fetch Retry
 
 When a URL fetch is denied (403, access denied, bot block), retry with `tvly extract <URL> --format markdown --json`. Tavily fetches server-side, so the block on this host does not apply.