A tiny, dependency-free browser probe that reveals which DNS resolver actually answered for you — and, when the resolver discloses it, which network you are really on.
A DNS leak cannot be observed from the browser directly: JavaScript never sees which resolver handled a lookup. The only reliable way is to resolve a hostname nobody has resolved before, and have the authoritative side report who asked for it.
edns.ip-api.com/json does exactly that, for free: each
request redirects to a single-use random subdomain, and the JSON names the resolver that
queried for it.
Anycast makes naive tests unreliable. A resolver IP can geolocate to Switzerland while serving a user in France, so "your DNS is in another country" is not, on its own, evidence of a leak.
EDNS Client Subnet (ECS) settles it. When a resolver forwards a truncated slice of your network to the authoritative server, the response carries a second, independent signal. Measured on 9 August 2026, on a French connection behind Google DNS:
dns: Switzerland - Google <- anycast, proves nothing on its own
edns: France - Free SAS <- the real network. This is the leak.
Not every resolver sends ECS — Cloudflare strips it by default — so the field is frequently absent. When it is absent, this probe says so instead of guessing.
Open index.html, or try the live demo.
No build step, no dependencies, no server.
It runs four queries, because a machine usually has more than one resolver configured and the OS rotates between them — a leak often appears only on the second or third query.
- One provider. All observations come from
ip-api.com. If it is unreachable or rate-limits you, the probe reports nothing rather than inventing a verdict. - ECS is optional. No ECS field means "unknown", not "no leak".
- Browser scope. This reflects the resolver your browser reached. Another application on the same machine may use a different one.
- A single run is a sample. Resolver rotation means repeated runs can differ.
A hosted version with an explanation of what each field means is available at anonymflow.com/en/tools/dns-leak-test.
MIT.