When you look up a website, the DNS server you have configured is not always the one that ends up doing the work. Queries are often passed on, or “forwarded upstream”, to another resolver, and on untrusted networks they can be quietly redirected to a server you never chose. DNS Upstream Check tells you the IP address of the server that actually performed the lookup, so you can see what is really happening.
See the Real Resolver
Find out which server is actually answering your DNS queries, not just the one listed in your settings. The result is the public IP of the resolver that reached out to look the name up.
Spot Interception
Some networks silently redirect all DNS traffic to their own resolver, regardless of what you have configured. A quick check shows whether your queries are being intercepted before you trust the connection.
Untangle Multiple Resolvers
If you have several DNS servers configured, or a resolver that forwards upstream, it can be hard to know which one is doing the work. This shows you the answer directly.
Monitor for Changes
A companion app for Windows, macOS, Linux, and BSD rechecks on a schedule and flags whenever the answering server changes, useful for keeping an eye on things while you are on the move.
What “Upstream” Means
DNS resolution is rarely a single step. When your device needs an IP address, it asks the resolver you have configured, often your router or a public service such as 1.1.1.1 or 8.8.8.8. That resolver may answer from its own cache, or it may pass the query on to another resolver “upstream” of it, which in turn may forward it again. Somewhere along that chain, one server actually sends the query out to the wider internet on your behalf.
That final server is the one that matters. It is the machine that sees your queries in the clear, decides what answer to hand back, and could, in principle, log or alter them. Knowing its address tells you who is really handling your DNS.
Why It’s Useful
- Confirm which resolver is in use. When several DNS servers are configured, or when a VPN or private resolver is supposed to be handling your queries, this confirms which one is actually doing the lookups.
- Detect interception on public networks. Hotels, cafes, airports, and other public Wi-Fi frequently force all DNS through their own equipment. Checking the upstream server reveals this before you rely on the connection.
- Verify a VPN or encrypted DNS is working. If you expect your DNS to leave through a VPN or an encrypted resolver but the answering server is your ISP, you have a DNS leak worth investigating.
- Catch a compromised router or device. Malware and tampered routers often change DNS settings to redirect traffic. An unexpected server answering your queries is an early warning sign.
- Troubleshoot forwarding setups. On corporate or home networks with chained resolvers, seeing the real egress server makes it far easier to work out where a misconfiguration lies.
How to Check It Yourself
The check relies on a special hostname, dns.publicip.show. When you look this name up, the answer you receive is the IP address of the resolver that performed the lookup. You can query it with the standard tools already on your system:
# Using dig
dig +short dns.publicip.show
# Using nslookup
nslookup dns.publicip.show
# Even a plain ping resolves the name first
ping dns.publicip.show
The IP address returned is the server that actually performed the lookup. Run the same check on a different network, or after connecting to a VPN, and compare the results. If the answering server is not the one you expect, your DNS is being handled by something other than what you configured.
The DNS Upstream Check App
Running a single check is useful, but the answering server can change from moment to moment, especially as you move between networks. The DNS Upstream Check app performs the lookup repeatedly in the background and shows you the current upstream server, alerting you whenever it changes.
That makes it a handy guard against DNS interception on untrusted or public networks: leave it running and you will know straight away if the server handling your queries suddenly changes to something unexpected.
Download
DNS Upstream Check is free to use.
If the Windows app shows a blank window, which can happen on older graphics hardware, virtual machines, or cloud desktops such as Windows 365, try the alternative Windows build instead.
Prefer not to install anything? You can run the manual check above from any device with dig, nslookup, or ping.
Questions or issues? Get in touch and we’ll be happy to help.