🐛 [CH, DE | DoT] Receiving responses from third-party servers

[tplessas]

Checklist

• I read the README
• I read the FAQ
• I searched the issues

Describe the issue
Wanna begin by thanking you @ookangzheng for the project.

Recently configured the BlahDNS CH DoT endpoint on my Android phone (using the native Private DNS option in settings). At some point today I visited https://dnscheck.tools to check for any leaks, finding out that according to it some of my DNS requests are resolved by servers not part of the BlahDNS project. The website also says that ECS is in action, which should not be the case according to https://blahdns.com.

After a bit of wallheadbanging I figured that the extra servers are actually Adguard's, as can be seen in the screenshots below. The only somewhat similar issue I could find on here was #129.

I also tested all other locales and found similar issues with DE. To be honest, no other DNS leak testing website such as those on the FAQ showed any leaks (tested only with CH DoT, no other servers), but they do test with a much smaller number of DNS requests compared to dnscheck.tools.

To Reproduce

1. Use the DE or CH DoT BlahDNS endpoints while physically in Athens, Greece, on your Android phone.
2. Visit https://dnscheck.tools.

Expected behavior
The results of leak testing should only include BlahDNS servers, as is the case on my computers (Linux/Windows/macOS, all configured with dnscrypt-proxy and using either the DNSCrypt or DoH endpoints. Using the DoH endpoint in the Bromite browser also comes without issues.)

Logs

Starting with Switzerland, first screenshot is testing with dot-ch.blahdns.com, second with dns.adguard-dns.com – notice that IPs are the same (or under the same subnet) in both excluding BlahDNS in the first.

Using Germany results in a whole lot of responding servers, some using IPs from as far as the US!

Here's Japan and Singapore, working fine.

The Finland IPv6 address looks like it's allocated to someone in Germany, though I doubt it matters much if the server's going down anyway.

Server if applicable):

• Locale: CH, DE, FI (?)

Client (if applicable):

• Device: BQ Aquaris X2 Pro
• OS: Android 10
• Client: Private DNS (OS)
• Protocol: DoT

Additional context
Same behaviour both when connecting over my landline WiFi and over the mobile network, so I doubt it's caused by anything in my local network configuration.

I can do more testing if you think it'd be helpful and could provide directions – I guess I'm halfway competent at stuff like this.