Do you store the addresses of my DNS servers?

No. They sit in our server's memory for a few minutes and are erased. They are never written to disk, never appear in logs, and are never passed to third parties.

The check found nothing — is that good or bad?

Neither; it is the absence of a result. It usually happens with encrypted DNS on strict settings, or with an extension that blocks the request. An empty result must not be read as «everything is fine».

It shows Google or Cloudflare — is that a leak?

Not in itself. It means your browser or system is set to a public resolver. The only question is whether its route matches the route of the rest of your traffic.

How is this different from the leak test?

The leak test looks at whether your address is exposed outside the connection, through IPv6 and WebRTC. This page checks something else: who receives the names of the sites you open.

Why does the result change between runs?

Resolvers work as a pool and different machines answer at different times. That is normal. Look at the country and network owner rather than at a specific address.

DNS check: which servers resolve your requests

Servers that answered your requests

No server reached us. This happens when the browser uses encrypted DNS with strict settings, or an extension blocks the request. Try running the check again.

DNS request route

checking

Checking…

Server addresses are resolved on our side from a local database, are never passed on, and are deleted after a few minutes.

What a DNS server does

Sites live at numeric addresses while people remember names. A DNS server, also called a resolver, translates one into the other. When you open a page you first quietly ask it «what is the address for this name», and only then does the browser connect to the site.

That has an uncomfortable consequence: the resolver sees the list of every site you open, even when the content itself is encrypted. That is not a leak by itself, but it matters who ends up holding that list.

Why we do not use somebody else's service

Resolvers cannot be inspected from inside a browser: the browser never reports who answered its request. The only way to learn it is from the other side — by becoming the authoritative server for a domain zone and seeing who comes asking.

So we run our own server for such a zone. Sending a VPN service's visitor to a third-party checker that would collect their resolvers would directly contradict what we sell.

What «different routes» means

If you use a VPN, the tunnel should carry not only your connections to sites but the name lookups too. When traffic goes through the tunnel while names are still asked of your home provider's server, the picture is odd: the content is hidden, yet the list of visited sites is visible to the same network as before.

That is exactly what is compared here: the country and network owner of your resolvers against the country and network owner of your own address. Matching means one route. Diverging means something goes around it. With the VPN off there is usually no divergence at all: your provider's resolver on your provider's connection is normal.

Why there can be several servers

Large providers run a pool of resolvers rather than one, and requests are spread across them. That is why the check asks for several different names: a single name would only reveal one machine out of the pool.

The names are deliberately unique. Repeating the same name would be answered from cache and would never reach us, while a fresh one forces the resolver to come to us again. For the same reason the result can differ slightly between runs.

Frequently asked questions

So that names travel the same path as traffic

With MeerGuard name lookups go inside the same connection as everything else — nothing needs to be configured separately.

Open the Telegram botif Telegram opens for you

Get access on the siteif Telegram is blocked

Leak test

Which DNS servers handle your requests