DNS resolver test: which DNS server is your device really using?
Will show which DNS resolver your requests actually travel through, using a unique disposable subdomain per visit, to help confirm whether your router or ISP is quietly overriding your chosen DNS settings or a hijack has occurred. Coming with the AdminKit API.
A unique, disposable subdomain per visit, resolved through AdminKit's own authoritative DNS, so we can honestly report which resolver answered.
- Whether the resolver that reaches AdminKit matches the DNS server your device or VPN claims to use
- A plain verdict: no leak detected, or which resolver actually answered instead
- Ships alongside the AdminKit Protective DNS product (layer L1)
Next step
Check your public IP now, or look up any domain's DNS records.
How it works and limits
A DNS “leak” or hijack happens when your device’s queries are quietly sent to a different resolver than the one you configured — a router malware infection, a compromised DHCP setting, or (for VPN users) traffic that bypasses the tunnel are common causes. The query itself can also reveal your real location or ISP even while other traffic is otherwise private.
Why a single request to this page cannot answer it honestly
Detecting a leak needs a request whose answer depends on which resolver asked, so the site can report “resolver X resolved this specific, disposable name.” That requires generating a unique name per visit and controlling the authoritative DNS answer for it — infrastructure this page does not have yet. Showing only “here is a resolver somewhere in the path” without that uniqueness would be misleading, so this page stays honestly marked “coming soon” instead of approximating an answer.
What this will check once it ships
- A unique, disposable subdomain generated per visit, resolved through AdminKit’s own authoritative DNS.
- Whether the resolver that reaches AdminKit matches the DNS server your device or VPN claims to be using.
- A plain-language verdict: no leak detected, or which resolver actually answered instead.
Frequently asked questions
Why is this tool not live yet?
A trustworthy answer needs AdminKit to run its own authoritative DNS zone and serve a unique, one-time subdomain per visitor, so that when a resolver looks it up, AdminKit's own nameserver can see which resolver actually made that query (the same technique dedicated DNS leak-test sites use). We do not operate that authoritative DNS infrastructure yet — it ships alongside the AdminKit Protective DNS product (plan layer L1). A page that merely showed the resolver address seen by this single static request would not reliably reveal a hijack, so we are not shipping a weaker, misleading version in the meantime.
What can I check manually today?
Open your device or router's network settings and compare the configured DNS servers against what you expect; on a computer, `nslookup example.com` or `dig example.com` shows which resolver answered. For a more thorough check, a dedicated DNS leak-test site (the kind VPN providers link to) uses the unique-subdomain technique described above.