EDNS0 Client Subnet (ECS) & GeoDNS Audit

Inspect RFC 7871 EDNS0 Client Subnet privacy exposure, compare public resolver ECS handling policies, and evaluate CDN GeoDNS routing precision vs user IP anonymity.

Standard Specification RFC 7871 Client Subnet extension

Subnet Mask Truncation /24 IPv4 · /56 IPv6 Neighborhood granularity

Privacy-Stripping Resolvers Cloudflare & Quad9 Zero ECS forwarding

CDN Architecture Shift BGP Anycast Renders ECS obsolete

🌐 Public Resolver ECS Behavior Matrix

Compare how leading global recursive DNS resolvers handle client IP forwarding when resolving queries to authoritative nameservers.

Resolver Service	Anycast IPs	ECS Forwarding Policy	Privacy Posture	GeoDNS Routing Impact
Cloudflare 1.1.1.1	1.1.1.1 / 1.0.0.1	Completely Stripped	Zero Leakage	Routes to nearest Cloudflare Anycast PoP, optimal for BGP Anycast CDNs.
Google Public DNS	8.8.8.8 / 8.8.4.4	Active /24 Forwarding	Subnet Exposed	Transmits client /24 to authoritative NS for geographic DNS optimization.
Quad9 (IBM / Packet Clearing House)	9.9.9.9 / 149.112.112.112	Completely Stripped	Zero Leakage	GDPR-certified Swiss jurisdiction; strictly blocks client IP transmission.
OpenDNS (Cisco Umbrella)	208.67.222.222	Active /24 Forwarding	Subnet Exposed	Original co-author of RFC 7871; forwards client subnets to participating CDNs.

🧮 ECS Subnet Leakage Simulator

Enter any client IPv4 address to see exactly what portion is transmitted in the EDNS0 payload to external authoritative nameservers.

Sample Client IP Address:

Source Netmask:

Exposed Subnet Payload

Transmitted to authoritative nameserver operator in plain EDNS0 option code 8.

Estimated Geographic Precision

Typical localization precision pinpointed by MaxMind / IP2Location databases.

Frequently Asked Questions

What is EDNS0 Client Subnet (ECS) and why was RFC 7871 created?

EDNS0 Client Subnet (ECS, RFC 7871) is a DNS extension allowing recursive resolvers to forward a truncated portion of the querying user IP (typically the first 24 bits for IPv4, or 56 bits for IPv6) to authoritative nameservers. Content Delivery Networks (CDNs) use this subnet to return geographically proximate edge server IP addresses.

What privacy risks are associated with EDNS Client Subnet?

Because ECS exposes your ISP subnet or home neighborhood network identifier directly to third-party authoritative nameservers on every DNS resolution, it creates a persistent tracking vector. Security-conscious resolvers (such as Cloudflare 1.1.1.1 and Quad9 9.9.9.9) intentionally strip ECS to safeguard end-user privacy.

How does ECS impact recursive resolver caching and DNS performance?

ECS fragments the DNS resolver cache. Instead of caching a single IP answer for all users, the resolver must maintain separate cache entries for thousands of distinct /24 client subnets. This increases authoritative query volume and decreases cache hit efficiency.

How do Anycast CDNs route users without relying on ECS?

Modern Anycast networks (such as Cloudflare, Fastly, and AWS CloudFront) use BGP Anycast routing rather than DNS Geo-steering. The same IP address is announced simultaneously from hundreds of global data centers, allowing Internet routing protocols to naturally deliver traffic to the nearest physical facility without needing ECS.