Description
About DNS Privacy Check
Introduction
DNS Privacy Check is a best-effort privacy smoke: it resolves your public IP and optionally probes DNS-over-HTTPS, then explains what a browser page cannot prove. It is not a full ISP DNS leak laboratory and does not log which recursive resolver answers your everyday queries.
What this tool does
On Run, it resolves public IP via DeviceHub /api/client-ip when available (with possible ipify fallback) and probes Cloudflare DoH for a sample record. Results include IP source labels, DoH status, and honesty rows. It does not claim leak or no-leak.
When to use it
Use it after enabling a VPN, when teaching the gap between DoH success and ISP resolver visibility, or before escalating to dedicated leak labs. Prefer WebRTC Leak Test for ICE candidate IPs, IP Address for a calm HTTP egress snapshot.
How it works
Public IP uses the same DeviceHub and ipify helpers as other network tools. DoH is a fetch to Cloudflare’s public dns-json endpoint. Browser fetch cannot attach to OS resolver sockets. Permissions stay none. Third-party fallbacks observe your egress when they run.
Step-by-step instructions
- Open DNS Privacy Check on the VPN or network path you want to inspect.
- Click Run and wait for public IP and DoH results.
- Read honesty rows; inconclusive by design is valid when proof is impossible.
- Cross-check with WebRTC Leak Test and IP Address before drawing conclusions.
Common problems
Expecting a red or green leak verdict misunderstands scope. DoH success does not prove every app uses encrypted DNS. Split-tunnel VPNs often leave DNS on the ISP while HTTP exits elsewhere.
Privacy explanation
IP resolution may hit DeviceHub or ipify; DoH sends a query to Cloudflare’s public resolver. DeviceHub does not upload results for ad profiling. Permissions stay none.