IP Intelligence Weekly #3: DNS Mismatch Jumps to 39%, But Read It Carefully

Issue three of the IPchase intelligence weekly. Same methodology: anonymous aggregates produced when visitors run checks on the site, recording only network-layer traits — IP type, country, IPv6 share — and never any fingerprint information. Sample window: November 6–12.

This issue's number is counterintuitive: DNS mismatch climbed from 17% two weeks ago to 39%. More than double. Let's go through how that number is produced, what can contaminate it, and whether you should be worried.

Number one: 39% DNS mismatch — with at least three explanations

The detection is straightforward: the visitor triggers an authoritative lookup for a random subdomain, we record which IP asked, and compare that resolver's country against the visitor's HTTP exit country. Different country, one mismatch counted.

Going 14% → 17% → 39% deserves a pause. There are three plausible explanations, and we do not have enough evidence to pick one:

One: real leaks are up. More first-time visitors proxy only their browser traffic and never touch system DNS. That fits a visitor base where datacenter IPs have held above half for months — lots of people connect a proxy and start working without ever thinking about where DNS goes.

Two: public encrypted resolvers cause false positives. We have to be honest about this limitation: if a visitor configured a global anycast resolver such as 8.8.8.8 or 1.1.1.1, those IPs are usually geolocated to the United States — even when the visitor is in Shanghai and the answer actually comes from a nearby node. Our check reports "mismatch," but that isn't a leak, just a resolver whose ownership doesn't match the user's location. As DoH adoption grows, this bias systematically inflates the rate.

Three: sampling noise. A single week is a small sample. In a window of a few hundred checks, a couple of days with unusual visitor composition can move the whole week.

So our conclusion: treat 39% as a rough indication, not a precise figure. Watch the trend instead. We shipped the fix right after writing this issue: public anycast resolvers (8.8.8.8, 1.1.1.1 and friends) are now identified individually, and a mismatch caused only by them no longer counts as a leak — it is reported separately as "public DNS usage". The homepage network pulse now uses the corrected metric, and the next issue gets the first clean dataset.

Your personal takeaway is unaffected: if your DNS egress and HTTP egress genuinely disagree, the DNS leak test shows you exactly which resolver answered, so you can tell "wrong local DNS" apart from "just using public DoH." Background mechanics are in our DNS leak explainer.

Number two: datacenter IPs hold at 56% — the structure has settled

Datacenter share is 56.0%, essentially flat (-0.4 points). Residential 41.2%, other 2.8%.

Three consecutive issues oscillating between 53% and 57%: the visitor mix has stabilized. Over half of all exits are datacenter, which means scraping, automation and multi-account operations. Mobile share has been 0.0% for two straight weeks — consumer traffic never looks like this, and it confirms the visitor profile.

No new advice here, just the highest-value conclusion again: datacenter ASN ownership is publicly visible and risk engines need zero sophistication to classify it. For account-sensitive work, budget belongs in IP type, not quantity — the comparison is here.

Number three: France ties Singapore for third place

Top five countries: US 33.7%, China 17.8%, Singapore 5.3%, France 5.3%, Germany 4.0%. France jumped from outside the top ranks to tie Singapore — the second notable move this issue.

Combined with Germany's 5.5% last issue, European origin has risen two issues running. The practical value is unchanged: don't benchmark only US nodes. European routes often hold up better under evening congestion — compare on/off-proxy download deltas with the speed test and check jitter with ping.

IPv6: 5.7%, still low

Down 0.8 points week over week. Proxy providers' residential nodes remain IPv4-first. Standing reminder: native IPv6 on your machine plus a v4-only proxy means some requests can bypass the tunnel — run two consecutive full checks and see whether your exit "flips."

This week's action list

1. Run the DNS leak test and look at which resolver answered — local ISP or public DoH, very different meanings
2. When you see a jump like 39%, ask first whether the methodology changed and how big the sample is. That habit is worth more than any single number
3. Give European nodes a real try instead of defaulting to the US

Data updates weekly. To see your own exit type and location, the IPchase homepage displays it on load.