Find out whose hands your requests pass through.
Four short diagnostics show DNS egress, WebRTC, query privacy, DNSSEC behavior, and name minimization without displaying network addresses.
Full network privacy check
The Lab runs four short readings in sequence. Only one is active at a time; an unavailable reading does not turn the others into false failures.
The check has not run yet. Results live only in this tab and disappear after a reset or reload.
01 DNS and WebRTC
not run yet
02 DNS privacy
not run yet
03 DNSSEC validation
not run yet
04 QNAME minimization
not run yet
Where the results come from
DNS, DNSSEC, and QNAME are authoritative-server observations; WebRTC is a bounded browser-reported summary. Lab receives categories and relations, but does not display or store addresses, capabilities, full names, ICE candidates, or SDP.
What each reading means
Every result belongs to one short run and the network path observed during it.
- 01
The resolver sees the names
Whoever answers your DNS queries holds the list of sites you opened, in order and with timestamps — even when every site uses encryption.
- 02
WebRTC hands out addresses
The browser names its addresses so calls and file transfers can connect directly. The page submits only bounded public candidates; local addresses remain in the tab.
- 03
Controlled zones test behavior
DNSSEC and QNAME minimization use separate controlled names. A missing hint or query produces an inconclusive result, not a convenient conclusion.
How the resolver test works
Each run receives several unique names. The authoritative DNS records who came for them — those are the observed resolvers, whatever the settings screen claims.
Observer returns only minimized evidence to the public page. Resolver and WebRTC candidate addresses never come back to Lab.
Why do I see a resolver I never configured
Providers and public services chain resolvers: the one you set forwards the query onward. The list shows everyone who actually asked, not just the first hop.
My local addresses are hidden — is that good
If this run reports mDNS, the browser gave the page a temporary name instead of a local address. If it reports an exposed host candidate, the address was visible to the page but Lab discarded it immediately. No host candidate does not, by itself, prove that mDNS was used.
Does a VPN fix this
Only if it also carries DNS. A tunnel that moves traffic but leaves queries with the provider hands over the same list of names as before.
A resolver of your own comes with the contour.
Mail, files, knowledge, AI and the network layer under them — on hardware you control.