tools / dns-leak-test
DNS resolver exit test/
See the resolver exits used by this run’s browser DNS queries, and compare with your network setup to investigate leaks or routing issues.
DNS resolver exits
Your browser requests random domain names generated for this run. dnscheck.tools observes the recursive resolver exits, with a wait of up to 12 seconds. That service can see the connection’s source and the resolver IPs.
This shows only the browser’s query path for this run, not your computer’s full DNS configuration. Protocols such as UDP/TCP here describe the connection from the resolver to the authoritative server. They do not show whether the browser uses DoH or DoT. Query counts may include retries.
dnscheck.toolsFAQ
How does this differ from a DNS record lookup?
This page tests which recursive resolvers your browser’s requests pass through. A DNS record lookup checks a domain’s A, AAAA, MX and other records. They answer different questions.
Why is the detected DNS IP different from my public IP?
This is the exit used by a recursive resolver when querying the authoritative server, not the browser’s HTTP exit. It may belong to an ISP, public DNS or proxy service. Different addresses alone do not prove a leak.
How can I use this to investigate DNS leaks?
Test with your intended network setup and check whether the resolver’s network matches it. Repeat after switching VPNs or proxies. Differences in countries or IPs, or missing results, alone establish neither a leak nor safety.
Why are there multiple resolvers and repeated queries?
Networks may use several recursive resolvers. Caching, retries and resolution chains can also produce multiple observations. The page deduplicates exit IPs and retains the types and counts actually observed for each.
Can this show whether the browser uses DoH or DoT?
No. UDP, TCP and other protocols shown here describe the resolver-to-authoritative-server connection, not encryption between the browser and resolver or your computer’s full DNS setup.
What if no results appear, and are checks logged?
A run waits up to 12 seconds. Restricted connections or requests remain unconfirmed; retry later. dnscheck.tools sees the connection source and resolver IPs. This site stores no results. Stopping or leaving closes this run’s connection.