DNS Leak Test

On click, the current Web test first requests a one-time subdomain from IPOK's self-hosted authoritative DNS. It may fall back to bash.ws only if initial ID issuance fails; older clients still use bash.ws. The selected backend processes source-network, test-ID, and DNS-request metadata.

The self-hosted backend returns only observed resolver IPs and does not invent country or ISP data. If the selected backend provides country data, IPOK gives a heuristic country-consistency hint only when the exit and every resolver have comparable two-letter codes. A mismatch is a path clue; a match or unknown result does not prove DNS used a tunnel.

Your public IP

Try a sample IP

Try sample:

DNS is one leak path; the IP leak test also checks WebRTC and both IP stacks.

FAQ

Does a country mismatch prove a DNS leak?

No. Public or anycast resolvers may be located elsewhere and location databases can be wrong. It is only a prompt to inspect the DNS path.

How can I investigate further?

Review DNS settings on the proxy, VPN, system, and router you are authorized to manage, then repeat with more than one test. Merely switching to a public resolver does not prove DNS is tunneled.

Related checks

IP speed test · proxy node bandwidth

ipinfo.io Alternative: Geolocation, IP Risk & Purity

proxycheck.io Alternative: Multi-Source Proxy Detection

IP Purity Check — Multi-source Risk Score

Native IP Check — Native vs Broadcast IP

IP fraud score check — every source's verdict shown

ChatGPT Official Region Snapshot + IP-Side Signals