Who answers your DNS queries

What a resolver is

Sites are addressed by numbers, people remember names. The translation is done by a DNS server — the resolver: before opening a page, your device quietly asks it “what address does this name have” and only then connects to the site.

Hence an awkward consequence: the resolver sees the list of every name you open — even when the content itself is encrypted. Not a leak by itself, but worth knowing whose hands that list ends up in.

Why the check is ours, not someone else's

You can't learn your resolver from inside the browser — the browser doesn't know who answered its query. It can only be seen from the opposite side: by running an authoritative server for a domain zone and recording who comes asking.

We run such a server ourselves. Sending visitors of a privacy service to a third-party test that would collect their resolvers would contradict the very product.

About “different routes”

With a VPN on, not only site connections but also name lookups should pass through the tunnel. If traffic goes into the tunnel while names are still asked of the home provider's resolver, you get a paradox: content hidden, browsing list visible to the same network as before.

The page compares the country and network of your resolvers with the country and network of the address you exit through. Match — one route. Divergence — some queries live their own life. Without a VPN there's usually no divergence: the provider's resolver on the provider's connection is the norm.

Why there are several servers

At a large operator the resolver is a pool of machines with queries spread across them. That's why the check requests several unique names: a single name would light up just one machine from the pool.

Uniqueness is mandatory: a repeated name would return from cache and never reach us, while a fresh one forces the resolver to come to us in person each time. For the same reason the address set varies slightly between runs.

Questions and answers