Network workflow
Browser DNS, IP and HTTP requests: consent, CORS and privacy
Most g3n-data tools operate locally. DNS lookup, IP geolocation and HTTP request testing are explicit exceptions: they connect only after you review the displayed destination, consent and press Send.
Content updated: · Maintained by Hung Chi-Hsueh · corrections
Read the destination before sending
DNS requests send the supplied name and record type to Google's DNS-over-HTTPS JSON endpoint. The request sets edns_client_subnet=0.0.0.0/0 to disable ECS disclosure to authoritative servers; Google still sees your connection IP. PTR requires a reverse DNS name, not an automatically guessed address. A resolver answer can reflect caching, split DNS or a different resolver policy.
IP lookup sends the supplied IP to IPQuery. It does not automatically discover your own IP. The separate self-lookup checkbox deliberately makes two requests: discover the public IP, then request its details. Providers can retain operational logs, apply rate limits or change availability; approximate location and risk flags do not identify a person or prove an address is safe.
An HTTP test can have real side effects
GET and HEAD require an empty body here. POST, PUT, PATCH, DELETE and OPTIONS are real requests, not simulations; use an endpoint you control and disposable data. The displayed HTTPS URL, explicitly provided header values and body are sent. Browser-controlled headers cannot be faithfully overridden. Cookies, referrer and cache are omitted by this tool, but the receiving server still sees your network connection.
Redirect following is off by default. Enabling it may send the body or custom headers to another host; do not enable it with secrets. The browser may hide manual redirects and some response headers. A CORS error does not prove that nothing reached the server, and an HTTP error status can still have a meaningful body. No proxy retries around browser restrictions are used.
Bounded responses, not continuous monitoring
Each request has a 10-second deadline, Cancel and a 1 MiB response cap. Oversized or cancelled responses do not expose partial exports. Editing the input invalidates the old result and consent. The body is a UTF-8 preview, not a byte-preserving binary download; undecodable bytes can appear as replacement characters.
Only the browser-visible status, headers, timing and body are reported. There is no backend probe, TLS certificate audit, complete redirect trace, identity verification or proof of global availability. Do not put production secrets in an arbitrary endpoint merely to reproduce an example. Clearing the page cannot erase data already received by a provider.
Data provenance