Skip to content

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

1 Commit
 
 
 
 
 
 

Repository files navigation

edns-resolver-probe

A tiny, dependency-free browser probe that reveals which DNS resolver actually answered for you — and, when the resolver discloses it, which network you are really on.

Why this exists

A DNS leak cannot be observed from the browser directly: JavaScript never sees which resolver handled a lookup. The only reliable way is to resolve a hostname nobody has resolved before, and have the authoritative side report who asked for it.

edns.ip-api.com/json does exactly that, for free: each request redirects to a single-use random subdomain, and the JSON names the resolver that queried for it.

The part most leak tests get wrong

Anycast makes naive tests unreliable. A resolver IP can geolocate to Switzerland while serving a user in France, so "your DNS is in another country" is not, on its own, evidence of a leak.

EDNS Client Subnet (ECS) settles it. When a resolver forwards a truncated slice of your network to the authoritative server, the response carries a second, independent signal. Measured on 9 August 2026, on a French connection behind Google DNS:

dns:  Switzerland - Google      <- anycast, proves nothing on its own
edns: France - Free SAS         <- the real network. This is the leak.

Not every resolver sends ECS — Cloudflare strips it by default — so the field is frequently absent. When it is absent, this probe says so instead of guessing.

Usage

Open index.html, or try the live demo. No build step, no dependencies, no server.

It runs four queries, because a machine usually has more than one resolver configured and the OS rotates between them — a leak often appears only on the second or third query.

Honest limits

  1. One provider. All observations come from ip-api.com. If it is unreachable or rate-limits you, the probe reports nothing rather than inventing a verdict.
  2. ECS is optional. No ECS field means "unknown", not "no leak".
  3. Browser scope. This reflects the resolver your browser reached. Another application on the same machine may use a different one.
  4. A single run is a sample. Resolver rotation means repeated runs can differ.

Related

A hosted version with an explanation of what each field means is available at anonymflow.com/en/tools/dns-leak-test.

License

MIT.

About

Dependency-free browser probe: names the DNS resolver that actually answered, and uses EDNS Client Subnet to tell a real leak from an anycast artefact.

Topics

Resources

Stars

0 stars

Watchers

0 watching

Forks

Releases

Packages

Contributors

Languages