BigBears Docker DNS Differential Checklist
Tested fixture: bb-lab-adguard-docker-dns-20260827

SAFETY BOUNDARY
[ ] Use read-only checks first.
[ ] Do not disable network protection globally for diagnosis.
[ ] Do not expose private IPs, domains, filter lists, tokens, or credentials.
[ ] Never click ads during QA.

HOST CONTROLS
[ ] Record OS, architecture, kernel, Docker, Compose, and DNS-filter version.
[ ] Resolve an ordinary control domain through the default resolver.
[ ] Resolve the target hostname through the default resolver.
[ ] Resolve the same hostname through one authorized isolated control resolver.

DOCKER CONTROLS
[ ] Inspect /etc/resolv.conf inside the affected container.
[ ] Run getent/nslookup inside the affected container.
[ ] Run a disposable --rm container on the same Docker network.
[ ] Repeat only the disposable control with an explicit authorized test resolver.

INTERPRETATION
[ ] Ordinary control works, but target is sinkholed locally: inspect local DNS policy.
[ ] Host works, one container fails: inspect container/network-specific DNS state.
[ ] Local and isolated controls both fail: inspect egress/upstream availability.
[ ] Normal DNS alone does not prove GA4 processing or public AdSense delivery.

VERIFICATION
[ ] Record exact commands and sanitized outputs.
[ ] Confirm the result on an independent public network before claiming a site-wide outage.
[ ] Remove disposable containers with --rm.
[ ] Record every persistent change and its rollback; if none, state that explicitly.

Sources:
https://adguard-dns.io/kb/adguard-home/getting-started/
https://docs.docker.com/engine/network/
https://developers.google.com/analytics/devguides/collection/protocol/ga4/reference