Skip to content

Is your DNS leaking past the proxy?

Before a browser connects anywhere it asks a resolver for the address. If that question goes to your real provider instead of through the proxy, every site's nameserver sees the network and country you actually sit in.

Not run

Nothing has been measured yet.

The test makes this browser look up four random names under our probe domain, so whichever resolver it uses has to ask our nameserver, then compares that resolver with your exit IP.

Resolver addresses are held in memory for a minute. Nothing is kept.
Resolvers seen
-
Public resolvers
-
Resolver countries
-
Exit country
-

01Reading

How it works

Your resolver answers to our nameserver.

There is no way to see a resolver from inside a page, so the test makes the resolver come to us.
  • 01

    Random names only our nameserver can answer

    The page requests four hostnames made of a random token under a zone our nameserver is authoritative for. No resolver can have them cached, so whichever one this browser uses has to ask us, and our nameserver sees the address it asks from. That address, not yours, is what is held for a minute.
  • 02

    Public resolvers are not a leak on their own

    Google, Cloudflare and Quad9 answer from the node nearest whoever asked. A node in the exit's country means names were resolved at the exit's end. A node, or an ISP resolver, in another country means they were resolved on your side, and that side is what a site learns.

VeilBrowser carries each profile's proxy below the page and resolves hostnames at the proxy exit, so the resolver a site sees sits behind the same address as the traffic.

Contact salesNetwork and proxy documentation

More tools