DNS Privacy & Security Check

What is a DNS privacy check?

The Domain Name System was designed in the 1980s with zero privacy protections. Every time you type a website address into your browser, a DNS query translates that domain name into an IP address. These queries travel across the network in plaintext. Your ISP, your network administrator, anyone on the same Wi-Fi — they can all see exactly which websites you are visiting.

HTTPS encrypts the content of web pages, but the DNS queries that precede every connection are still visible. This metadata reveals your browsing patterns. ISPs in many countries are legally permitted (or even required) to log DNS queries and build profiles of their customers' online activity. Governments use DNS monitoring for censorship. Advertisers use it for targeting. The page content is encrypted, but the envelope is wide open.

Why DNS leak testing matters

Your DNS traffic is a complete log of every domain you visit, every service you use. Even with HTTPS everywhere, DNS gives it all away. ISPs sell aggregated browsing data to advertisers. Network administrators monitor employee activity. Public Wi-Fi operators intercept queries to inject ads. Attackers perform DNS hijacking to redirect you to phishing sites that steal credentials.

It goes beyond personal browsing. DNS queries reveal which cloud services an organisation uses, which security vendors they rely on, which partners they communicate with. For journalists and activists in authoritarian regimes, DNS monitoring can have life-threatening consequences.

How this tool works and its limitations

This tool has two modes. "Check My DNS" runs browser-side heuristic tests using WebRTC and fetch APIs. "Check a Specific DNS Server" runs server-side tests using actual DNS queries via dig, which produces definitive results for DNSSEC validation, NXDOMAIN hijacking, DNS-over-TLS support, and response time.

DNS Leak Detection uses the industry-standard authoritative DNS callback technique. Your browser resolves a unique subdomain (via dnsprobe.online), and our authoritative DNS server logs which resolver IP actually queried it. This reveals the real DNS server handling your queries — not just your IP, but the resolver your OS is sending queries to. If you are using a VPN, the resolver should belong to the VPN provider. If it belongs to your ISP instead, your DNS is leaking. This is the same technique used by dnsleaktest.com and similar tools.

Encrypted DNS Reachability checks whether known DoH endpoints (Cloudflare, Google) are reachable from your browser. This indicates whether encrypted DNS is available to you, but it cannot definitively confirm whether your current DNS queries are actually encrypted. To verify encryption, use your OS or browser DNS settings to explicitly enable DoH or DoT.

DNSSEC Validation checks whether your resolver verifies cryptographic signatures on DNS records. This prevents cache poisoning attacks where an attacker forges DNS responses to redirect you to malicious servers. The test uses specially crafted domains with known-bad DNSSEC signatures. If your resolver accepts these invalid signatures, it is not performing proper validation.

The IPv6 Leak Detection test discovers whether your device exposes IPv6 addresses that could bypass your VPN tunnel. Many VPN configurations only handle IPv4 traffic, leaving IPv6 DNS queries to travel directly to your ISP resolver. This dual-stack leak is a common and often overlooked privacy gap.

ECH/ESNI Support testing checks whether your browser supports Encrypted Client Hello, which hides the domain name during TLS handshakes. Without ECH, even with encrypted DNS and HTTPS, network observers can see which specific domain you are connecting to by inspecting the plaintext Server Name Indication (SNI) field.

Finally, DNS Server Identification attempts to determine which DNS resolver you are actually using. By examining CDN edge routing and timing patterns, the tool can identify whether you are using a known privacy-focused provider, your ISP default, or an unknown resolver.

Understanding Your Score

Your overall privacy grade is a weighted average of six tests. DNSSEC validation carries the highest weight (25%) because it is the most reliable browser-side test and protects against DNS spoofing. IP leak detection and encrypted DNS reachability each carry 20%. ECH support (15%), IPv6 exposure (10%), and DNS server identification (10%) complete the score. For the most accurate results, use the "Check a Specific DNS Server" mode, which runs server-side tests with definitive answers.

A grade of A+ (95–100) means your DNS configuration has excellent privacy protections. An A (85–94) indicates strong privacy with minor areas for improvement. A B (70–84) is good but has notable gaps. A C (55–69) suggests significant privacy weaknesses. A D (40–54) means most of your DNS traffic is exposed. An F (below 40) indicates critical privacy failures that should be addressed immediately.

To improve your score, start with the highest-weighted failing tests. Enable encrypted DNS in your browser or operating system, ensure your VPN handles DNS properly, and consider switching to a privacy-focused DNS provider. For detailed setup instructions, see our guides on DoH vs DoT, changing DNS on Linux, and setting up Unbound as a recursive resolver.