Compare Specific Target Domains
Claude web, API, auth redirects, MCP connectors, and extension bridges use distinct hostnames. Our split probe queries fixed /cdn-cgi/trace paths on each target; your IP on a generic test site may not match your exit to claude.ai.
Compare Within the Same Address Family Only
Two different IPv4 addresses or two different IPv6 addresses across core domains indicate split routing. Never compare an IPv4 string directly against an IPv6 string as a mismatch.
Preserve Failure Reasons When Probes Are Blocked
CORS restrictions, security challenges, or network blocks can prevent browser trace reads. The optional Browser Helper can supplement cross-origin trace probes when authorized.
Re-test With the Same Method After Adjusting Rules
Use the generated Clash, Surge, or sing-box snippets to align domain groups with your proxy policy name, then re-test one change at a time.
Common Real-World Scenario
For example, if claude.ai and api.anthropic.com both return IPv6 but with different addresses while a reference site returns IPv4, compare the two IPv6 core exits directly.
Identify the destination using an unexpected path
After a routing test, group results by web, API, authentication, and reference destinations. Record the host, address family, observed address, and failure reason for each row. Compare addresses within the same family. A reference IPv4 and a Claude-target IPv6 are not directly comparable. Keep targets without readable trace data unconfirmed.
If only an authentication destination fails, inspect its routing-policy match, DNS, and any challenge response. If every target fails, check basic browser and proxy connectivity first. Policy names in rule snippets must refer to groups that actually exist in the client. A sample policy name is not itself a working proxy endpoint.
Change one rule, rerun the same destinations, and retain the before-and-after times, addresses, and statuses. After browser probes succeed, verify the actual Claude Code session, terminal, or remote machine. The probes cover listed HTTP requests, not every login redirect, WebSocket, or connection made by another application.
References & Freshness
The above is independent diagnostic guidance with no access to Anthropic internal risk controls. Policies, UIs, and support workflows may change—always verify against official effective dates and your account portal.