Is DNS Lookup safe?
We analyzed DNS Lookup version 0.2's actual code and gave it a 82/100 trust score. DNS Lookup has a sensible, limited design, with minor privacy and…
Bottom line
DNS Lookup has a sensible, limited design, with minor privacy and transparency concerns but no established abuse.
What it can access
It can read the current tab’s hostname and send lookup details to its DNS service, which fits its purpose but reveals the site being checked.[Q1][Q4][Q6]
Security weaknesses
The packaged code is minified and harder to inspect, but no concrete misuse-enabling weakness was established.[Q10][Q16]
Signs of misuse
The popup may automatically send the current hostname for a DNS lookup, but no tracking, sensitive-data collection, or remote control was found.[Q8][Q12][Q14][Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests storage and temporary active-tab access. Storage supports synchronized preferences, while activeTab lets the popup read the current hostname for its default lookup; no broader permission is requested.
Declares only storage and activeTab permissions and a private popup, with no host permission or content script. — manifest.json:1-31
Queries the active tab and extracts new URL(tab.url).hostname to seed the lookup. — app.js:1
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Defines no content_scripts, scripting permission, or host access. — manifest.json:1-31
The active-tab helper returns only URL.hostname and does not inject code or query the document. — app.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Has no webpage code or broad page-reading capability. — manifest.json:1-31
Its sole input form binds to the extension's private search.query field. — app.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It can read the active tab's URL when the popup is invoked and reduces it to a hostname. It cannot access cookies, signed-in sessions, bookmarks, downloads, or chronological history.
Calls chrome.tabs.query for the active tab and returns parsed URL.hostname unless it is a chrome: page. — app.js:1
Requests no cookies, history, bookmarks, sessions, or downloads permission. — manifest.json:1-31
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares none of the relevant device or management permissions. — manifest.json:1-31
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends the domain query, DNS record type, and selected resolver to https://www.whatsmydns.net/services/extension/lookup. The service returns the DNS records displayed in the popup.
apiRequestUri appends query, type, and server to the whatsmydns.net API URL, and search() fetches that URL as JSON. — app.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Parses the API response with response.json() and renders record fields through precompiled Vue components. — app.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
With default settings, simply opening the popup automatically looks up the active tab's hostname, sending it to whatsmydns.net before a separate Search click.
Defaults searchAutomatically to true and defaultSearch to current; the mounted lookup component invokes search when loaded with no results. — app.js:1
The startup helper reads the active hostname and marks the store loaded, which mounts the automatic-search flow. — app.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares none of the settings, proxy, search, management, or override capabilities. — manifest.json:1-31
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
All application and framework code is combined into a single minified Webpack/Vue bundle, which makes behavior harder to inspect, although the DNS flow and fixed services remain recoverable and no encrypted data is present.
Contains the entire minified CSS, Vue runtime, state, components, and application logic on one generated line. — app.js:1
Maps the packaged application directly to app.js with no source map included. — mix-manifest.json:1-12
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Regenerator's fallback uses Function('r', 'regeneratorRuntime = r') and Webpack's global-object fallback uses new Function('return this'). — app.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Sets previousQuery to each cleaned lookup and persists the entire options object using chrome.storage.sync.set. — app.js:1
The active hostname, current default, and searchAutomatically default combine to issue an immediate lookup on popup load. — app.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Storage contains only lookup preferences and previousQuery; API parameters are query, type, and resolver with no client identifier. — app.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests neither cookies nor identity permissions and has no page content script. — manifest.json:1-31
The API URL contains only query, type, and server parameters. — app.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Declares no content script, clipboard, capture, camera, or microphone capability. — manifest.json:1-31
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
The background script is empty. — background.js:1
Defines no runtime messaging listener or window message bridge. — app.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Constructs documented lookup and propagation links on the same configured whatsmydns.net domain. — app.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, downloads, or proxy permission. — manifest.json:1-31
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging permission or host access. — manifest.json:1-31
The configured production service domain is fixed to https://www.whatsmydns.net. — app.js:1
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
DNS JSON is rendered as text fields, while the Function fallbacks use bundle constants unrelated to response data. — app.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Defines only a private action popup and no website-facing extension surface. — manifest.json:1-31
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Selects the .net production suffix solely from the presence of update_url in the packaged manifest. — app.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
The background script is empty. — background.js:1
Runtime work is limited to the popup UI, storage, and one DNS API lookup at a time. — app.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Declares no content script or scripting permission. — manifest.json:1-31
The form submits only the popup's own query state to the DNS API. — app.js:1