Find out whose hands your requests pass through.
Two readings side by side: resolver addresses that fetched unique names for this run, and the public path the browser obtained through first-party Privatica STUN.
test not started
DNS resolvers
Waiting for an observation…The authoritative DNS service has not seen this test’s probes yet.
WebRTC
The browser is still gathering candidates.- Public candidates
- Received: 0
- Local candidates
- The browser did not report them.
What each reading means
Two mechanisms show different parts of the network path. An incomplete result stays incomplete instead of becoming a privacy promise.
- 01
Authoritative DNS sees resolver egress
Each run receives several fresh names. The service correlates only queries for those names with the short-lived test and reports the address from which a resolver reached the authority.
- 02
STUN shows the public WebRTC path
The browser contacts first-party Privatica STUN and submits only bounded public candidates. Full SDP, raw ICE lines, and local addresses never leave the tab.
- 03
Missing evidence is not evidence of no leak
A browser, filter, cache, network, or unavailable component can stop a reading. The page therefore distinguishes complete, partial, blocked, and expired outcomes.
How the temporary test works
The service returns a one-time authorization capability, separate random DNS names, and a STUN address. The capability never appears in a probe name, request URL, or the DOM.
The page deletes a completed test, while a short server TTL remains the cleanup guarantee when a tab closes or the network disappears.
Why do I see a resolver I never configured
The authority sees the egress address of the resolver that actually fetched the unique name. Forwarding chains and anycast mean this is not necessarily the address shown in device settings.
My local addresses are hidden — is that good
Yes. A modern browser can replace a local address with a random mDNS name. The page records that fact locally and does not submit the name or internal address.
Does a VPN fix this
Only a before-and-after measurement shows the difference. DNS and the public WebRTC path may not follow the same route as ordinary web traffic.