[BUG] Blocked Datadog telemetry causes massive DNS retry amplification

Preflight Checklist

• [x] I searched existing issues and did not find this DNS retry amplification reported.
• [x] This report contains no account identifiers, DNS profile identifiers, or credentials.

What's Wrong?

When Claude Code / Claude in Chrome telemetry endpoints are blocked by a DNS filtering service, telemetry appears capable of entering an extreme retry loop instead of applying bounded exponential backoff.

Over a 90-day AdGuard DNS window, the affected network recorded:

• browser-intake-us5-datadoghq.com: 13.37 million queries, 13.348 million blocked (~100%)
• segment.io: 4.078 million queries, 4.076 million blocked (~100%)
• Total: 22.425 million DNS queries, 19.533 million blocked (87%)

The traffic was not steady normal usage. It appeared as several sharp bursts between approximately June 18 and July 6, 2026, reaching millions of blocked queries per day. By comparison, the most recent 30-day window contained about 1.176 million total DNS queries, and only about 39,000 Datadog queries.

At the time of the bursts, Claude was the relevant actively used product. Inspection of the currently installed Claude Code binary confirms that it embeds the exact affected endpoint and identifies the telemetry service as Claude Code:

https://browser-intake-us5-datadoghq.com/api/v2/logs
https://http-intake.logs.us5.datadoghq.com/api/v2/logs
claude-code-error-tracking
service: claude-code
hostname: claude-code
CLAUDE_CODE_DATADOG_FLUSH_INTERVAL_MS

This report is specifically about retry amplification when telemetry is blocked/unreachable, not about the presence of telemetry itself.

What Should Happen?

Telemetry failure must never generate unbounded DNS traffic. When Datadog or Segment endpoints are blocked, unreachable, or return DNS failure, Claude Code and the Claude browser extension should:

1. Apply exponential backoff with jitter.
2. Enforce a strict retry ceiling/circuit breaker.
3. Avoid multiplying retries across sessions, subagents, background workers, or duplicate SDK initialization.
4. Drop telemetry safely without affecting normal Claude functionality.

Suspected Trigger

1. Configure a DNS filter to block *.datadoghq.com and segment.io.
2. Run one or more Claude Code sessions and/or Claude in Chrome.
3. Leave sessions running during normal work.
4. Observe DNS query counts for the blocked endpoints.

The historical burst is no longer continuously reproducible, so a packet-level monitor is now running to capture any recurrence and map it to the originating process/device.

Related Issue

#51691 reports that the Claude extension can load the Datadog SDK more than once and also references Segment/CSP failures. That issue does not cover the DNS retry amplification described here, but duplicate SDK initialization may be relevant.

Environment

• Current Claude Code version inspected: 2.1.227
• OS: Windows 10.0.26200.8973
• DNS filter: AdGuard Personal DNS
• Network DNS transport now in use: DNS-over-TLS

Historical screenshots are available, but are omitted from the public report because the originals contain account information. Sanitized copies can be provided if needed.