Privacy Policy
Your privacy matters. This policy explains how DNS Robot collects, uses, and protects your information.
On this page
Information We Collect
Automatically Collected
- IP address: used only for rate limiting and to show your approximate location on the page (from Cloudflare's request data, never stored)
- DNS queries and tool inputs you submit (domain names, IP addresses, etc.)
Voluntarily Provided
- Domain names, IP addresses, and other data entered into our tools
- Feedback or messages you send to us
- Sounds, photos and key taps you give the Morse Code Translator: they are decoded in your browser and never uploaded, and the microphone or camera is used only when you choose it and your browser asks your permission
We do not require account registration. Most tools work without collecting any personal information beyond your IP address.
How We Use Your Information
- Process your tool requests — DNS lookups, WHOIS queries, SSL checks, sitemap generation, etc.
- Display your IP address, ISP, and geolocation in IP-based tools
- Prevent abuse, rate limiting, and security threats
- Improve tool accuracy, performance, and user experience
We do not sell, rent, or share your personal information with third parties for their marketing purposes.
The Feedback Form
The feedback form is the one place where this site keeps what visitors send. When you send a message, we store it in a database on Cloudflare (D1):
What we store
- What you write: your message, the topic you chose, your rating (if you gave one) and the tool you picked
- Context: the page of our site you were on before the form, the page's language, your country (from Cloudflare's request data) and your device type (phone, tablet or computer)
- Your email address, only if you tick "you may email me about this": it is used only to answer that message, never for newsletters or marketing
- A one-day code for your network: a keyed hash of part of your IP address, so no more than 10 messages a day can come from one network. It changes every day, can't be turned back into your address, and is deleted after two days. Your IP address itself is never stored
Services the form uses
- Cloudflare Turnstile checks that a person, not a bot, sends the form. It runs in your browser on the feedback page only and receives your IP address and browser signals; it processes only what this security check needs and doesn't read what you type (Turnstile privacy addendum)
- Google Analytics counts that a message was sent and its topic; it never receives the message or your email address
Messages are kept for up to 24 months, then deleted automatically. To see, correct or delete a message you sent, write to the address below and tell us roughly when you sent it.
Your DNS Robot Account
An account is optional: every tool works without one. If you create one, it lives on its own site, app.dnsrobot.net, apart from the tools, their ads and their analytics. We keep it in a database on Cloudflare (D1), to give you the account you asked for and to keep it secure:
What your account holds
- Your profile: your email address, the name you give (optional), your language and a profile picture (optional: a 256 × 256 copy your browser makes, stored on Cloudflare R2 and shown only in your account; we never fetch one from another service). Kept until you delete your account
- Passkeys: for each one, its name, the password manager or device that keeps it, its public key and its ID. Your fingerprint, face or screen-lock PIN never leaves your device, and a public key can't be used to sign in as you. Kept until you remove the passkey
- Signed-in devices: the browser and system (from your browser's user agent), the city and country Cloudflare reads from your connection, and your network: your IP address cut to its /24 (IPv4) or /48 (IPv6) block, never the whole address. A device is signed out 30 days after it was last used
- Activity: sign-ins, sign-outs and security changes (passkeys added or removed, a new email address, devices signed out, profile changes), each with its time, browser, city, country and network. Kept for one year, then deleted automatically
- Sign-in codes: stored only as a hash, for 10 minutes or until used
- A public status page (optional): if you publish one for a site you have verified as yours, anyone can open status.dnsrobot.net followed by its domain (for example status.dnsrobot.net/example.com) and see that site's uptime: the bars of the last 90 days, its incidents and, only if you switch them on, response times. The page never shows your name, your email address or anything else from your account, and it asks search engines not to index it. Unpublish it on the site's Uptime tab at any time; its address then answers like a page that never existed
Keeping sign-in safe
- Cloudflare Turnstile checks that a person, not a bot, asks for a sign-in code. It runs in your browser on the sign-in and sign-up pages only and receives your IP address and browser signals (Turnstile privacy addendum)
- Limits: so nobody can flood an inbox or guess codes, we count the codes sent and the wrong codes typed per email address and per network. The counters are stored under keyed hashes that can't be turned back into an address, and are deleted after two days
- Address checks: before sending a code, we check the address's domain against a public list of throwaway inbox services and ask Cloudflare's DNS whether the domain receives mail. Only the domain is looked up
Emails we send
Only what your account needs, never newsletters or marketing: your sign-in codes, a notice when your account is signed in from a browser or country it hasn't used for 90 days, when a passkey is added, when your email address changes (the old address is told too) and when you delete your account. Cloudflare's email service sends them for us (Cloudflare's privacy policy).
Cookies
The account site sets only the cookies signing in needs: one that keeps you signed in (30 days, readable only by app.dnsrobot.net, never by scripts), a copy of your session that lasts one minute and saves a database read, and a short-lived one while you use a passkey. One more, dr_signed_in=1, is shared with dnsrobot.net so the tools' header can show "Account" instead of "Sign in". It holds nothing else and is removed when you sign out. No ad or analytics cookie is set on the account site.
Your choices
- See and download your data: Settings → Your data lists what your account holds and downloads it as a JSON file
- Correct it: change your name, language, profile picture and email address in Settings
- Sign out devices: Security lists the devices signed in to your account; sign out any of them, or all but this one
- Delete it: Settings → Delete account deletes your profile, passkeys, signed-in devices and activity right away, and we email you to confirm. The database's 30-day restore history (Cloudflare D1 Time Travel) still holds a copy for up to 30 days, used only to recover from a failure, never to bring back a deleted account
The account site runs no ads and no third-party scripts besides Turnstile on the sign-in and sign-up pages. To count visits, our own server tells Google Analytics which account page was opened, with your country, device type and the page's language: never your IP address, your email, the domains you watch or anything you type. No analytics cookie or script runs on the account site.
Third-Party Services
To provide our tools, we interact with the following third-party services. Data you enter may be sent to them for processing:
- Cloudflare hosts the site and runs our Worker, so it handles every request, including your IP address (Cloudflare's privacy policy)
- 34 public DNS resolvers (Google, Cloudflare, Quad9, OpenDNS and large ISPs): for a propagation check our Worker sends them the domain and record type. The queries come from our server, so the resolvers do not see your IP address
- DNS blocklists (the lists the IP Blacklist Checker names, such as SpamCop, Mailspike and UCEPROTECT), Google Public DNS, Cloudflare DNS and Team Cymru: for a blacklist check our Worker sends the address you check (for a domain, its mail servers' and web addresses) to each list as DNS queries, through Google's and Cloudflare's resolvers, and asks Team Cymru which network owns it. The queries come from our server, so the lists do not see your IP address. A result is kept for 10 minutes to answer repeat checks, then dropped
- Google Public DNS (dns.google): the Your device row asks it straight from your browser, so Google receives your IP address and the domain you check (Google Public DNS privacy)
- ipify (api4.ipify.org and api6.ipify.org): What Is My IP, What Is My ISP, IP Lookup, the Port Checker and the IPv6 Test ask it from your browser for your public IPv4 and IPv6 addresses, so ipify receives your IP address. ipify states that it never logs visitor information (ipify)
- Regional internet registries (ARIN, RIPE NCC, APNIC, LACNIC with Registro.br, and AFRINIC): IP Lookup, Domain to IP, the IP Blacklist Check, the Email Header Analyzer, ASN Lookup and the IPv6 Test ask the registry's RDAP service from your browser who holds an address block or AS number, so the registry receives your IP address and the address or number looked up. When your browser can't reach it, Domain to IP asks from our server instead
- CAIDA AS Rank (api.asrank.caida.org): ASN Lookup asks it from your browser for a network's rank and customer cone, so CAIDA receives your IP address and the AS number you look up (CAIDA's privacy practices)
- IPinfo: when you look up an address in IP Lookup, What Is My ISP or our IP API, our server asks IPinfo for its location and network, so IPinfo receives that address but not your IP address; its answer is kept for a day (IPinfo's privacy policy)
- crt.sh (Sectigo's Certificate Transparency search): the Domain Age Checker and the Subdomain Finder ask it from your browser for the certificates of the domain you check, so crt.sh receives your IP address and that domain (Sectigo's privacy policy)
- Cert Spotter (SSLMate's Certificate Transparency search): the Subdomain Finder, the CAA Record Checker, the Hosting Checker and the SSL Certificate Check ask it from our server for the certificates of the domain you check, so it receives that domain but not your IP address. When our server's free quota is used up, the Subdomain Finder and the CAA Record Checker ask it from your browser instead, and Cert Spotter then receives your IP address too (SSLMate's privacy policy)
- auDA (.au) and GMO Registry (.shop, .tokyo and other GMO domains): their RDAP services refuse our server, so for these domains the WHOIS Lookup asks them from your browser, and they receive your IP address and the domain you look up (auDA's privacy policy, GMO Registry's privacy policy)
- Public DNS services (Cloudflare 1.1.1.1, Google Public DNS, Quad9, Control D, NextDNS, AdGuard DNS, Cisco OpenDNS, CleanBrowsing, DNS.SB, DNS4EU, IIJ Public DNS, Yandex DNS) and our test nameserver (leak.dnsrobot.net, on our own server): the DNS Speed Test sends DNS queries for popular site names and random test names from your browser to each service it tests, so each receives your IP address and those names (Google Public DNS passes part of your IP address, its /24 network, on to the domains' own servers). To show which DNS your device uses, it also looks up random names only our nameserver answers; it keeps the addresses of the DNS servers that asked and, when one of them passes on part of your IP address (your /24 network, EDNS Client Subnet), that part with them, for 10 minutes, nothing else (Cloudflare's, Google's and Quad9's resolver privacy policies)
- Our test nameserver (leak.dnsrobot.net, on our own server), ipify and public DNS services (the DNS Leak Test): your browser looks up random names only our nameserver answers. It keeps, for 10 minutes and only in memory, the address of each DNS server that asked, how many queries each sent and, when one of them passes on part of your IP address (your /24 network, EDNS Client Subnet), that part, so the page can show them to you; nothing else is kept. Your browser also asks ipify (api4.ipify.org and api6.ipify.org) for your IPv4 and IPv6 addresses, so ipify receives them, and our server names the network of your other address through Team Cymru, which also looks up its reverse DNS name. To tell which public DNS service asked, your browser sends each service it can read (Cloudflare 1.1.1.1, Google Public DNS, Quad9, Control D, CleanBrowsing, DNS.SB, DNS4EU and IIJ Public DNS) a few DNS-over-HTTPS questions about our test name, so each receives your IP address. Your last result stays only in your own browser (localStorage), without your own addresses, to compare with your next test; Forget the last run deletes it (ipify, Cloudflare's, Google's and Quad9's resolver privacy policies)
- Cloudflare Realtime (TURN relay and call server) and Cloudflare's speed test servers (speed.cloudflare.com): the Packet Loss Test and the Ping Test send small test packets from your browser through Cloudflare's nearest data centre and back, place a short silent test call there and, with the under-load option, download and upload test data, so Cloudflare receives your IP address; it relays the encrypted packets without reading them (Cloudflare's privacy policy)
- Amazon Web Services: the Ping Test times requests from your browser to AWS's public endpoint in each AWS region, so AWS receives your IP address (AWS privacy notice)
- Globalping (the jsDelivr team's network measurement service, api.globalping.io): Traceroute asks it from your browser to trace the route to the website or address you enter from probes in several cities, so Globalping receives your IP address and that target. Globalping makes every measurement public: anyone with a result's link can see its target and hops. The Hosting DNS Lookup uses it the same way for hosts whose nameservers our server can't reach: your browser asks Globalping's probes to query that host's nameservers about the domain you enter. With Trace to me, your browser first asks ipify for your public IP address, which becomes the target and so appears in that public result; the trace starts only when you press its button. If your browser can't reach Globalping, our server asks it instead with our account, and Globalping then receives our server's address, not yours (Globalping's terms of use)
- The websites you check and Cloudflare Browser Run: the Website Down Checker opens the address you enter from our servers in several places and takes a screenshot of it with Cloudflare's Browser Run, so the site sees our servers' addresses, not yours. It also asks Cloudflare's filtering DNS (1.1.1.2 and 1.1.1.3) whether the site is listed as malware or adult, and, for well-known services, reads their public status page. Each result and screenshot is kept for up to one day to answer repeat checks and share links, without your IP address. To test your own connection, your browser also contacts the site once, as a normal visit would, so that site receives your IP address (Cloudflare's privacy policy)
- The pages you analyse and Cloudflare Browser Run: the Link Analyzer reads the page you enter once from our server and checks each of its links with one request, so those sites see our server's address, not yours. With Render with JavaScript it opens the page once in Cloudflare's Browser Run instead (images and fonts aren't loaded). Results are kept for 5 minutes to answer repeat checks, without your IP address. If you paste a page's source, it is read in your browser and only its link addresses are sent to our server to be checked (Cloudflare's privacy policy)
- The websites you check, Cloudflare Browser Run and public vulnerability data: the CMS Detector reads the page you enter once from our server (on a WordPress site also up to two of its own small files: the theme's style.css and its /wp-json/ index), so the site sees our server's address, not yours. Scan in a browser opens the page once in Cloudflare's Browser Run instead. For the versions a site shows, our server asks OSV.dev, endoflife.date and WordPress.org about a software name and version or a plugin folder only, never the address you checked or your IP address. Results are kept for up to an hour (a browser scan's for up to 6 hours) to answer repeat checks, without your IP address, and no list of checked sites is kept (Cloudflare's privacy policy)
- The websites you test, Amazon Web Services, Cloudflare Browser Run, Google's Chrome UX Report and Amazon Bedrock (the Website Speed Test): our test servers at Amazon Web Services in 9 places open the address you enter in a fresh Chrome, like a visitor, so the site sees one of our 9 published addresses (listed on the speed test page), never yours. Each run uses a new, empty Chrome profile and cache under a separate account without privileges, deleted right after. The address is also opened from Cloudflare's network for a first-look screenshot (Browser Run), the server timing and the site's technology, and our server asks Cloudflare's filtering DNS (1.1.1.2 and 1.1.1.3) whether the site is listed as malware or adult. Google's Chrome UX Report receives the address and its site (origin) to return real users' data. The test's technical results (the address you tested, scores, metrics, the site's technology and the addresses of its own files; no personal data unless the address itself carries some) go to an AI model on Amazon Bedrock that writes the fixes. Reports, with their screenshots, video and Lighthouse files, are kept for 30 days; anyone with a report's link can open it, and reports are never listed or indexed (Google's privacy policy, AWS privacy notice, Cloudflare's privacy policy)
- Have I Been Pwned (Pwned Passwords): the Password Strength Tester checks whether a password appears in known data breaches without the password leaving your device. Your browser turns it into a SHA-1 hash and sends only the first 5 of its 40 characters to our server, which fetches every breached hash starting with them from Pwned Passwords, adds decoy entries and returns the list for your browser to compare. Have I Been Pwned sees our server, never you, the password or its full hash; we don't log the 5 characters, which about 2,000 other hashes share. The Password Generator makes passwords in your browser and sends nothing (Pwned Passwords)
- Domain registries, Cloudflare Registrar, Amazon Bedrock and Workers AI: the Domain Checker asks whether the name you type is registered from our server, through Cloudflare's registrar check and each extension's registry (RDAP or WHOIS), so they see our server, not you. For a taken name it also opens that domain's homepage once from our server, to tell a live site from a parked or for-sale page. For AI name ideas, our server sends the description you type to Amazon Bedrock (the Qwen model, in AWS's US East region) and, when Bedrock is slow to answer, to Cloudflare's Workers AI; neither receives your IP address, and both state that they don't use it to train models. Availability answers are kept for 5 minutes and a taken name's details for up to 6 hours, to answer repeat checks, without your IP address. We never register, log or sell the names you search (Amazon Bedrock data protection, Workers AI data usage)
- What Is My User Agent (your request's headers, Google Public DNS and Team Cymru): the page shows the headers your browser sent us with its request (the user agent, Client Hints, languages) and the connection details Cloudflare gives our Worker; we read them once to show them back and never store them. A user agent you paste is read in your browser and sent nowhere. Verify a crawler sends the IP address and user agent you enter to our server, which compares the address with the crawler operator's published IP list, asks Google Public DNS for its reverse and forward names, and asks Team Cymru which network the address belongs to; nothing is kept.
- Cloudflare, Google Public DNS, RIPE NCC and Team Cymru (the IPv6 Test): your browser contacts Cloudflare's address checks (ipv4.icanhazip.com, ipv6.icanhazip.com, 1.0.0.1, 2606:4700:4700::1111 and our spare domain dnsrobot.org) over IPv4 and over IPv6, and Google's 8.8.8.8 when 1.0.0.1 doesn't answer, so they receive your IPv4 and IPv6 addresses. For an address registered in Europe, your browser reads its public record in the RIPE Database (rdap.db.ripe.net). To name the network behind each address, our server asks Team Cymru (through Cloudflare's DNS) and looks up each address's reverse DNS name, so the operator of that reverse zone (usually your provider) sees the lookup. In the test's website mode, our server asks Google Public DNS for the domain's records. We keep none of your addresses (Cloudflare's privacy policy, Google Public DNS privacy, RIPE NCC privacy statement)
- The websites you check, Cloudflare's filtering DNS, Team Cymru and hstspreload.org (the Redirect Checker and the HTTP Header Checker): our server requests the address you enter and follows its redirects one request per hop (also the http, https, www and non-www versions of the site and, when you ask for it, the same address from up to 11 places), so those sites see our servers' addresses, not yours. It asks Cloudflare's filtering DNS (1.1.1.2 and 1.1.1.3) whether each host on the way is listed as malware or adult, Team Cymru which network owns each address, and hstspreload.org whether the site is on the HSTS preload list. Cookie values the sites set are never shown or kept. Each result is kept for 2 minutes to answer repeat checks, without your IP address
- Our mail servers (probe.dnsrobot.net and mailprobe.dnsrobot.net; the second runs at Amazon Web Services), SpamAssassin (on that server) and Cloudflare Email Routing (the Email Checker and the SMTP Test): to check an address, our server asks its domain's mail server whether it would accept mail for it and hangs up before any message is sent; the answer is kept for up to a day under a keyed hash, without the address. For Test your email, the message you send to your one-time address arrives at our own mail server (Cloudflare Email Routing is the backup), is scored there by SpamAssassin, and its report (the headers, the links and a 140-character preview) is kept for 7 days or until you delete it; the full message and its attachments are deleted as soon as the report is made. The SMTP Test connects from our server to the mail server you name and keeps its answer for 2 minutes.
- Cloudflare DNS and Google Public DNS over HTTPS (the DKIM Checker's Verify an email): your browser asks them for each signature's key name (selector._domainkey.domain), so they see those names and your IP address. The email itself stays in your browser; only the From domain and the signing domains go to dnsrobot.net for their DMARC policy, and no icon is fetched for the email's domains. An email is sent to our server only for an Ed25519 signature your browser can't check, after you agree; it is checked in memory and not stored. Domain checks run on our Worker (Google Public DNS, Cloudflare behind it); an answer is kept up to 2 minutes for anyone checking the same domain, and the checked site's icon comes through our favicon service (Google's and DuckDuckGo's icon servers see the domain). The DMARC Report Analyzer and the DMARC Record Generator, SPF Record Generator and DKIM Record Generator ask the same two services from your browser for a domain's published records (its DMARC, SPF and DKIM records, the records that permit report addresses and, for an emailed report, the signer's key), so they see those names and your IP address. A generated private key never leaves your browser, and neither does a report's content, except the sending servers' IP addresses, which the analyzer sends to dnsrobot.net to look up their host names (up to 100 a run, more if you ask)
- The platforms the Username Checker asks (Twitch, PlayerDB for Minecraft and Xbox, GitHub, Bluesky, Mastodon, Chess.com, Lichess, speedrun.com, Hugging Face, DEV, Codeberg, Hacker News, Codeforces, Codewars, Mixcloud and Gravatar): the Username Checker asks their public lookups for the name you enter straight from your browser, five of them as you type, so each receives your IP address and that name, as when you visit a profile. Our server asks the other platforms, which see our server's address, not yours
Each service has its own privacy policy. We recommend reviewing them if you have concerns about specific tools.
Chrome Extension
The DNS Robot Chrome extension ("DNS Robot - DNS Lookup Tool") provides quick DNS lookups from your browser toolbar. This section explains how the extension handles your data.
Data Collection
- The extension reads the current tab's URL solely to auto-fill the domain name in the lookup input field
- No browsing history, page content, or personal information is collected, stored, or transmitted
- DNS queries are sent to our API at dnsrobot.net or Cloudflare DNS-over-HTTPS as a fallback — no data is logged or retained
Permissions
- activeTab — reads only the current tab's URL to extract the domain name. No page content is accessed
- Host permissions (dnsrobot.net, cloudflare-dns.com) — used exclusively to send DNS lookup API requests. No other hosts are contacted
No Remote Code
All JavaScript is bundled locally within the extension. No remote code is loaded or executed.
The Chrome extension collects zero personal data. It does not track you, store cookies, or send analytics.
Data Security & Retention
Security Measures
- All traffic is encrypted via HTTPS/TLS
- The site runs on Cloudflare's network as static pages and one Worker, with no database of visitors or their checks
Retention
- Tool queries are not stored permanently — most are processed in real-time and discarded
- No server logs of visitors are kept: the rate limit counts checks per IP address for one minute, in Cloudflare's memory only
- Your theme choice stays in your browser's localStorage until you choose System in the theme menu or clear the site's data
Request logs
- We don't keep a log of each request: there is no record of what you looked up or of your IP address
- When something fails on our server, its error log keeps the time, the error's type and the page path that failed for up to 7 days so we can fix it: never what you looked up, and no IP address
- Answers are cached briefly, from 30 seconds to a week depending on the tool, so a repeat check is fast. They are kept under what was looked up, never under who asked
Your Rights (GDPR / CCPA)
Depending on your location, you may have the following rights:
- Access — request what data we hold about you
- Rectification — request correction of inaccurate data
- Erasure — request deletion of your data ("right to be forgotten")
- Restriction — request we limit how we process your data
- Portability — request a copy of your data in a machine-readable format
- Objection — object to processing based on legitimate interests
- Opt-out of sale — we do not sell personal information, but California residents (CCPA) may make this request
To exercise any of these rights, contact us at the email below. We will respond within 30 days.
Children's Privacy
DNS Robot is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
Contact & Policy Updates
We may update this policy from time to time. Changes will be posted on this page with an updated date. Continued use of the site after changes constitutes acceptance.
For privacy-related questions or to exercise your rights:
hello@dnsrobot.net