DNS leak test and ad blocker test

What the test checks

Before your device can load a website, an app or an ad banner, it asks a DNS server for the matching address. Whoever answers that question helps decide what gets loaded at all: an ordinary DNS server hands out every address. A DNS filter returns no real address for known ad, tracking and malicious sites – so the content is never loaded.

That is why the test has two parts:

• DNS server: your browser looks up a few randomly generated names that only our test server knows. This shows us which DNS server actually makes the queries – regardless of what your settings say.
• Blocking check: your browser tries to reach 29 well-known addresses: 12 ad networks, 9 trackers, 5 telemetry services from device makers and 3 official Cloudflare test sites for malware, phishing and adult content. Anything that cannot be reached counts as blocked.

We explain how this works in detail in DNS filtering explained simply.

What is a DNS leak?

A DNS leak is when DNS queries end up at a different server from the one you set up. A typical example: a filtering DNS service is entered in the router, but the browser uses its own “secure DNS” (DNS over HTTPS). The browser’s queries then go around the filter, and ads and trackers get through again even though the router setting is correct.

If the test shows several different DNS services, that points to exactly this kind of gap. Several addresses of the same service, on the other hand, are normal: big providers such as Google or Cloudflare answer queries from many servers. More on this: why your DNS filter needs a fixed route.

How to read your result

• Internet provider (your broadband or mobile operator): this is the normal case if you haven’t changed anything. These DNS servers usually filter neither ads nor trackers.
• Public DNS (Cloudflare, Google): whether anything is filtered depends on the address. Cloudflare 1.1.1.1 and Google 8.8.8.8 do not filter. Cloudflare 1.1.1.2 blocks malicious sites, 1.1.1.3 adult content as well. The test sites in the “Protection from dangerous sites” section show which variant is active. More in Cloudflare 1.1.1.3 for families.
• Filtering DNS service (e.g. Quad9, NextDNS, DNS4EU, Control D): depending on their settings, these services block malicious sites, and some also ads and trackers. The second part of the test shows how much.
• XIBRO SHIELD: your queries go through your own XIBRO filter.
• Unknown: a data centre we cannot match to any DNS service – often a VPN service or a company network.

Why the test blocks things although your router filters nothing

The test measures what arrives on this device in this browser. Browser extensions such as uBlock Origin, the Brave browser or Firefox’s strict tracking protection also block many of the test addresses. The result then looks good – but it only applies to this one browser. Apps, smart TV and game console on the same network get nothing from it. If you want to see what your network does, open the test in a private window without extensions.

Conversely, a test on your laptop says nothing about your TV: every device looks up addresses itself, often without a browser. Why that is, is explained in DNS filters for smart TVs and consoles.

How to improve your result

1. Enter a filtering DNS server in your router. Instead of your provider’s servers, enter Cloudflare 1.1.1.2 in your router – or 1.1.1.3 if children live in your household. It costs nothing and protects every device on your Wi-Fi from known malicious sites. It does not block ads and trackers.
2. Private DNS on your Android phone. Android has a “Private DNS” setting where you enter the name of a filtering DNS service. It also applies on the go, on mobile data.
3. Check secure DNS in your browser. If the test shows several DNS services, look in your browser settings for the secure DNS option (DNS over HTTPS). If a different provider is entered there than in your router, you get exactly the leak described above.
4. Block ads and trackers for all devices. For that you need a DNS filter with blocklists – either one you run yourself, for example with Pi-hole, or a ready-made service.

XIBRO SHIELD is such a ready-made service: your own Pi-hole filter for your household, on servers in Germany. Phone, tablet and laptop connect via WireGuard – only the DNS queries go through us, all other traffic runs directly as before. With FAMILIE and ZUHAUSE you also protect your smart TV and console through your router. During the Early Access phase you can use FAMILIE free for 90 days: here is how to join.

Frequently asked questions