guide
DNS lookup vs DNS leak test
A DNS record lookup asks a resolver about a domain. A DNS leak test investigates which resolver receives queries from your connection.
What this DNS tool does
IPTestor sends your domain and selected record type from its server to Cloudflare DNS over HTTPS. It displays the returned records, their time-to-live values and the resolver’s DNSSEC validation flag.
The resolver named in this result is the provider used by this tool. It is not a discovery of your browser’s resolver, your router’s DNS settings or the DNS path used by every application on your device.
Reading an answer correctly
A and AAAA records contain IPv4 and IPv6 addresses. MX describes mail routing, NS names authoritative servers, TXT carries text-based records and CNAME names an alias. SOA describes zone administration; CAA controls which certificate authorities may issue certificates.
An OK response with no answers of the chosen type does not mean a domain is broken. For example, a domain can have an A record but no CNAME. A domain-not-found response is different from an empty answer for an existing name.
TTL is expressed in seconds and concerns resolver caching. It is not a guarantee that a change becomes visible everywhere after that interval. Different caches, authoritative changes and resolver behavior can affect observations.
Why it does not establish a DNS leak
A leak test normally causes your device to request uniquely identifiable names and observes the resolver requests at controlled authoritative DNS infrastructure. To interpret the result, you also need to know your intended VPN or DNS configuration.
Asking our server to look up example.com does not provide that observation. Do not interpret Cloudflare appearing in IPTestor as proof that your device uses Cloudflare, or as proof that your VPN is working. DNS leak and WebRTC leak tests are not implemented here.
A reproducible record check
Enter example.com and select CNAME. In our recorded September 2026 check the tool returned OK with an empty answer list. This is a dated observation; DNS records can change. The raw response control shows what was returned for your own request.
For a non-existent test name, use a name under the reserved .invalid suffix. Compare its status with an empty answer. When reporting a problem, include the domain, type, resolver, UTC timestamp and returned status, rather than only a screenshot of an empty table.