Why do I see multiple Google IPs if my resolver is set to 8.8.8.8?
Google Public DNS is anycast: the query arrives at 8.8.8.8 but is processed by the closest resolver cluster (172.217.x.x, 172.253.x.x, etc.). The DNS leak widget lists those internal nodes, so several Google LLC IPs mean the traffic still flows through Google. Only unfamiliar networks indicate a potential leak.
How does the DNS leak test actually work?
Your browser fetches ten random hostnames under our probe domain. Each hostname encodes a unique ID, and our lightweight DNS server logs the resolver IP that requested it. When the widget polls the API we return the list of resolver IPs plus provider metadata sourced from DB-IP, giving you transparency without sending full queries to third parties.