FuzeVPNSimple. Clear. Straightforward.
Log in Subscribe
Choose languageEN

Choose language

Subscribe
Menu
Choose languageEN

Choose language

Subscribe

Connection & DNS

DNS client subnet exposure test

Inspect the EDNS Client Subnet option actually received for a unique DNS query by the authoritative collector.

DNS collector required. An authoritative DNS collector, delegated zone and shared observation storage are required. The web interface alone cannot measure ECS or support a conclusion.
Checking configuration…
Path to test
Test not started

A random DNS label prevents reuse of a cached answer.

Received ECS prefix

Authoritative query

JSON report
Aucun rapport.

Compare before and after

Run the same test on the same device and save a baseline. Activate your VPN or change one relevant setting, rerun under the same conditions and save the next result.

Save a before result and an after result to compare them.

What this test tells you

EDNS Client Subnet, or ECS, lets a recursive DNS resolver send part of a client network address to an authoritative DNS server. This test checks what reaches the collector rather than guessing from your IP. The recursive resolver's own address is separate from any client subnet it forwards.

How to run the test

  1. Check that the collector is available and choose browser mode or an explicit resolver lookup.
  2. Start the unique query and wait until the collection window completes, even if an early observation appears.
  3. Read the exact option, source prefix and resolver address together with the final status.

How the measurement works

Browser mode requests a resource on a unique hostname to trigger resolution through the browser's DNS path. Explicit mode sends DNS from our server to the chosen resolver.

The authoritative collector records the ECS option actually received for the test query. Its temporary network observations can include the resolver IP and a client prefix; publishing the interface alone cannot supply this measurement.

Understanding your results

Non-zero subnet prefix received
The authoritative collector received an ECS option exposing the displayed portion of a client network address for this query.
Zero prefix or no ECS observed
An ECS /0 option carries no client subnet. A completed query without the option is a distinct observation; neither proves the resolver's behaviour for every domain.
No observation or invalid option
Missing collector configuration or a query that never arrives leaves the result indeterminate. A malformed option is a protocol error rather than valid exposure evidence.

Compare before and after

  1. Save the mode, resolver or browser DNS setting, prefix and final collector status.
  2. Change one relevant resolver setting and run a fresh unique query from the same device.
  3. Compare completed observations in the same mode. Explicit server queries should not be treated as measurements of your browser's own resolver.

Limits of the test

  • Resolver ECS policies can vary by destination and may change over time.
  • A failed resource load does not necessarily mean DNS failed; the collector's actual query observation is the decisive evidence.

What to change, if needed

A non-zero client prefix is exposed
Check your resolver's documented ECS policy and consider an appropriate alternative, then retest through the intended DNS path.
No authoritative observation arrives
Check the displayed availability and retry. Do not label the resolver ECS-free while evidence is missing.

Frequently asked questions

Does ECS reveal my full address?

It depends on the received prefix. Read its length and address family instead of assuming the entire IP was sent.

Is encrypted DNS enough to prevent ECS?

No. Encryption to a resolver and the subnet information that resolver forwards are separate questions.

Sources and technical references