DigitalDomainKit's Public IP and VPN Visibility Check shows the public IP address and coarse location hints that browser-accessible diagnostic services can see from your current connection. The page still lives at the legacy /tool/dns-leak-tester address, but the tool has been reframed to match its actual behavior: it checks public IP visibility, not resolver-specific DNS leakage.
When you run the check, your browser requests Cloudflare's trace endpoint and the ipify public IP endpoint. The tool displays the IP address returned by those services, the location code reported by Cloudflare when available, and a verification source table. It does not generate unique DNS test domains, compare expected VPN resolvers with observed recursive resolvers, inspect browser DoH settings, run WebRTC STUN checks, or identify the DNS servers used by your device.
What This Tool Actually Checks
The current implementation is browser-side JavaScript. It calls https://www.cloudflare.com/cdn-cgi/trace and https://api.ipify.org?format=json, then displays the public IP address visible to those services. The result banner says Public connection visibility captured when both requests complete and explains that the page does not perform resolver-specific DNS leak testing.
The verification table includes a Cloudflare Network row and, when available, a Browser Diagnostic IP row. That label matters. Earlier versions of this page risked implying that the returned IP represented a DNS resolver. It does not. In this implementation, the displayed value is a public diagnostic IP observed through browser-accessible endpoints.
How to Use the Check
- Connect to the network or VPN profile you want to inspect.
- Open the tool page and select the visibility check button.
- Wait for the browser to contact the public diagnostic endpoints.
- Review the public IP address and location hint shown in the Connection Info area.
- Compare the result with the IP address and country or region you expected from your VPN provider, ISP, or proxy.
- Use the re-test button after changing VPN servers, browser profiles, network interfaces, or privacy settings.
Inputs, Outputs, and Limits
| Area | Current behavior | Important limitation |
|---|---|---|
| User input | No typed input is required. The browser runs the check from the current page session. | You cannot enter a custom resolver, hostname, VPN provider, or test domain. |
| Public IP | Displays the public IP returned by Cloudflare trace or ipify. | This is a public-facing address, not proof of which DNS resolver answered your lookups. |
| Location hint | Shows Cloudflare's location code when the trace response includes one. | Geo-location can reflect an ISP, VPN exit, CDN edge, or database estimate. |
| Processing location | The requests are made by your browser to Cloudflare and ipify. | The tool depends on those services being reachable from your browser and not blocked by extensions or network policy. |
| DNS leak testing | Not performed by this implementation. | A real DNS leak test requires resolver-specific queries and comparison against expected DNS infrastructure. |
| Failure state | If endpoint requests fail, the page shows that the visibility check is incomplete. | A failure does not prove privacy or leakage; it means the browser could not complete this check. |
Example Interpretation
Suppose you connect to a VPN location in Germany and run the check. If the displayed public IP and location hint appear to be in Germany and match the VPN provider's expected exit region, the result is consistent with the browser reaching those diagnostic services through that VPN exit. That is useful as a quick visibility check before browsing, logging in, or testing a geo-specific page.
If the tool still shows your home ISP's public IP or a location near your physical network after the VPN is connected, your traffic may not be using the VPN tunnel, the VPN connection may have dropped, split tunneling may be enabled, or the browser may be using a different network path. That still is not a DNS resolver diagnosis; it is a signal that your public browser-visible IP deserves investigation.
What a Real DNS Leak Test Would Need
A resolver-specific DNS leak test normally creates unique hostnames for the test session and observes which recursive DNS resolvers request those hostnames. It then compares the observed resolver network with what the user expects from a VPN, secure DNS service, router, or ISP. Some tests also examine WebRTC/STUN exposure, browser secure DNS settings, IPv6 behavior, and split-tunnel routing.
This page does not do that. It does not operate authoritative DNS infrastructure, create unique test domains, collect resolver query logs, or attribute recursive resolvers. For that reason, the safe interpretation is narrow: the page tells you what public IP is visible to two browser-reachable diagnostic services at the time of the check.
Privacy and Security Notes
The check runs in your browser and contacts Cloudflare and ipify. Those services receive a request from your current network path, along with normal request metadata such as IP address and user-agent information. DigitalDomainKit displays the returned values in the page, but this tool does not require file uploads, account login, or typed secrets. Do not treat the output as private proof; it is a public visibility check.
If you are using a VPN for sensitive work, pair this page with your VPN provider's own leak-testing guidance, operating-system DNS settings, browser secure DNS settings, and a resolver-specific DNS leak testing service. Also check IPv6 and WebRTC behavior separately when those matter for your threat model.
Troubleshooting
| Problem | Likely cause | What to try |
|---|---|---|
| The check shows your ISP IP while VPN is connected. | The VPN may be disconnected, split tunneling may be active, or the browser may be outside the tunnel. | Reconnect the VPN, disable split tunneling for the browser, and re-test. |
| The location looks wrong. | IP geolocation databases are approximate and VPN providers may route through nearby infrastructure. | Compare with your VPN dashboard and another public IP lookup service. |
| The check is incomplete. | Cloudflare or ipify may be blocked by the browser, extension, network, or DNS policy. | Disable blocking extensions temporarily, try another browser, or test from another network. |
| You need DNS resolver proof. | This page does not perform resolver-specific test-domain lookups. | Use a dedicated DNS leak testing service and compare results with your VPN provider's expected DNS servers. |
Related DigitalDomainKit Tools
- What's My IP is useful when you only need a direct public IP lookup.
- IP Information provides more context about a public IP address, including network ownership where available.
- DNS Lookup checks public DNS records for a domain, which is different from testing resolver leakage.
- Hostname to IP Lookup helps compare DNS answers for a hostname before and after network changes.
- WebRTC Leak Test is the relevant next step when browser peer-connection exposure is the concern.
Editorial and Testing Notes
This page is maintained by DigitalDomainKit and was reviewed on September 16, 2026. The verified implementation is a browser-side Alpine component that calls Cloudflare trace and ipify, displays public IP visibility, shows a failure state when those calls cannot complete, and explicitly states that it does not perform resolver-specific DNS leak testing. The visible table label was updated from a DNS-resolver-style label to Browser Diagnostic IP to avoid overstating what the code measures.
To report a mismatch between this documentation and the live page, use the DigitalDomainKit contact page. Include your browser, VPN status, visible error message, and whether Cloudflare or ipify is blocked on your network.