Couldn't the traffic be somewhat reduced by changing the time and order of operations?<p>Currently, Chrome does the following:<p>(1) on each network change, send three DNS requests with random hostnames.<p>(1a) If at least two of the queries resolve to the same IP, store the IP as the "fake redirect address".<p>(2) on a user search, query the first search term as DNS.<p>(2a) If the query result is NXDOMAIN or matches the fake redirect address, do nothing. Otherwise, show the "local domain" hint.<p>Instead, it could do:<p>(1) on a user search, query the first search term as DNS.<p>(1a) if the query comes back with NXDOMAIN, don't show the hint and stop. We're done.<p>(2) otherwise, make two more DNS queries with random domain names to check for fake redirects.<p>(2a) if the two queries resolve to the same IP as the first one, we have a fake redirect. Don't do anything. Otherwise, show the "local domain" hint.<p>Results of step (2) could be cached until a network change.<p>This would only require 2 instead of 3 probe queries and only if the user actually searched for something <i>and</i> if the search term actually caused a DNS match (fake or genuine).