DNS resolver check: which resolver your device really uses

Which DNS resolver you really use

Every website visit starts with a DNS lookup, and the resolver that answers it sees every name you ask for. This view detects the resolver by making your browser look up a one-time name inside a zone we run ourselves, then reading which addresses asked our name server. A public resolver such as Google, Cloudflare or Quad9 answers from a pool of many addresses; an ISP resolver sits in your provider's network.

The checks go beyond a DNS leak test: whether the resolver validates DNSSEC signatures (it has to fetch our key to do so), randomises its source ports against cache poisoning, minimises the names it reveals to each server, sends part of your network as EDNS Client Subnet, and how it handles short TTLs and answers too large for UDP.

What is a DNS leak?

Your VPN carries the traffic, but your device still sends its DNS lookups to the resolver it had before, usually your ISP's. The ISP then sees every name you visit. This view lists the resolvers that asked our name server for your one-time name; if you are on a VPN and your ISP's resolver appears here, the lookups are leaking.

How does this page find my resolver without asking my browser?

The browser is told to fetch a unique name inside a zone whose authoritative name server we run. Nobody has that name cached, so your resolver has to ask our server, and our server records which address asked, over which transport, with which options. The address is the resolver's own, not yours, which is exactly what is being tested.

Why are several resolver addresses listed?

Large public resolvers such as Google, Cloudflare and Quad9 answer from pools of many servers, and a single lookup can fan out to several of them. Each egress address is shown with the network it belongs to. A single address in your ISP's network is the other common shape.

What does DNSSEC validation mean here?

A validating resolver checks signatures on the answers it receives. To do that it fetches our zone's key and sets the DO bit in its queries, both of which our server sees. One of the probe names carries a signature that cannot verify; a validating resolver refuses that answer, a non-validating one passes it on.

What is EDNS Client Subnet?

Some resolvers forward the first part of your address, typically a /24, to authoritative servers so that content networks can answer with a nearby server. It improves routing and gives up part of your address to every zone you query. The view shows whether your resolver sends it and how much of the address it reveals.

Does my resolver honour short TTLs?

One probe answer is valid for two seconds and the page asks for it again after that. A resolver that queries our server a second time honours the TTL; one that answers from its cache enforces a minimum of its own, which is common and only matters when records change quickly.

Related terms: Recursive resolver, DNS leak, DNSSEC validation, QNAME minimisation, Source port randomisation, EDNS Client Subnet