Domain checks now send DNS over TCP through the same SOCKS proxy as the HTTPS checks. UDP associate was refused: proxies implement it poorly, and Go’s proxy library does not support it. Authoritative servers must answer on port 53 over TCP anyway. The human agreed.