IPCanary

DNS Resolver Check — is anything rewriting your answers

Query four independent encrypted resolvers in parallel from your own browser and compare their answers to detect DNS filtering, hijacking or interception.

Advertisement
DNS answer integrity running
Querying Cloudflare, Google, Quad9 and AdGuard in parallel...
Resolver filtering posture running
Checking whether tracking domains resolve normally...
This is a resolver integrity check, not a classic DNS leak test. It compares what four independent DNS-over-HTTPS providers return for the same name, directly from your browser, which reliably surfaces answer rewriting, captive portals and filtering middleboxes. A full leak test — which reveals which resolver your operating system actually uses — requires a wildcard DNS zone under our own domain. That module is built and ships the moment a custom domain is attached; we would rather tell you that than show you a test that quietly does something weaker than its name implies.

Read: should you turn on DNS over HTTPS

Advertisement

Frequently asked

What is the difference between this and a DNS leak test?

A leak test tells you which resolver your device is using by asking you to resolve a unique hostname under a domain the tester controls. This test instead asks four known resolvers the same question and compares answers, which catches interception and filtering but not resolver identity.

Different resolvers returned different IP addresses. Is that bad?

Usually not. Large sites answer differently depending on where the query came from, so a CDN will legitimately return different addresses to different resolvers. Divergence matters when one resolver returns nothing, a private address, or a portal address.

All four resolvers were unreachable. What does that mean?

Something on your network is blocking DNS-over-HTTPS outright, which is common on corporate networks, school networks and some ISPs that want to keep DNS visible to themselves.

Advertisement