Is DNS Configuration Manager safe?
We analyzed DNS Configuration Manager version 1.2.0's actual code and gave it a 82/100 trust score. This is a low-access, purpose-aligned utility with a…
Bottom line
This is a low-access, purpose-aligned utility with a misleadingly limited DNS-switching capability and one local-network testing weakness.
What it can access
It requests only storage and alarms, fitting saved DNS profiles and status checks but not actual DNS switching. [Q1]
Security weaknesses
The DNS test accepts localhost and private-network addresses, allowing a user-requested connection to local services. [Q19]
Signs of misuse
No evidence shows tracking, sensitive-data collection, remote control, deceptive changes, or hidden intensive work. [Q6][Q12][Q14][Q23]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests only storage and alarms. Those permissions support saved presets and a periodic local status refresh, but they cannot deliver the advertised automatic DNS switching.
Permissions are limited to storage and alarms; proxy, privacy, nativeMessaging, scripting and host permissions are absent. — manifest.json:1-43
Loads saved configuration and runs a one-minute alarm that checks only in-memory/local status. — background.js:38-47
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Defines no content_scripts and grants no host or scripting access. — manifest.json:1-43
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
No page-access mechanism or input-related permission is declared. — manifest.json:1-43
Input handling is confined to DNS IP/name fields inside the extension popup. — popup.js:1-1825
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Declares none of cookies, history, bookmarks, downloads or tabs. — manifest.json:1-43
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
A user click can copy the selected DNS IP to the clipboard, with a temporary-textarea fallback. It does not read clipboard contents or access files, camera, microphone, location, installed apps or native programs.
copyDNS writes the primary IP using navigator.clipboard.writeText or a local textarea/document.execCommand fallback. — popup.js:1261-1273
No clipboardRead, file, capture, geolocation, management or nativeMessaging permission is declared. — manifest.json:1-43
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The user-triggered Test DNS action sends an HTTP HEAD request with no body to the entered IPv4 address. Other fetches load packaged locale files; no analytics, account or developer services exists.
Builds http://{dnsServer} and performs a no-cors, no-cache HEAD request. — background.js:239-255
Loads only chrome.runtime.getURL locale JSON resources from the installed package. — js/i18n.js:39-69
Language fallback also fetches a relative packaged locales/{lang}.json file. — popup.js:1782-1782
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Ready DNS presets are fixed local objects rendered into the popup. — popup.js:1320-1415
UI wording and DoH setup steps are packaged local data. — locales/en.json:1-157
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically runs a one-minute alarm, but that alarm merely recomputes status from the saved local record. DNS tests and save/apply/reset/clipboard actions require popup interaction.
Creates checkDNSStatus with periodInMinutes:1. — background.js:42-47
The alarm only sets isActive based on whether currentConfig exists and returns local status. — background.js:209-222
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
applyDNSConfiguration validates and saves the object, then comments that Chrome extensions cannot change system DNS and this is simulation. — background.js:100-125
No proxy, privacy or settings-changing permission is present. — manifest.json:1-43
Displays Connected DNS and Apply DNS controls but includes a visible warning that configuration is simulated and actual changes must be manual. — popup.html:97-159
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Lists readable popup/background/i18n code plus documentation, screenshots and icons; no hidden binary payload is present. — inventory.json:1-316
Service worker logic is clear source with direct storage and test functions. — background.js:1-279
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Node-only test reads background/popup/i18n files with require('fs') and calls new Function(code) for syntax validation. — test-extension.js:75-90
Second Node test repeats the same local syntax check. — comprehensive-test.js:86-102
Neither test file is the service worker or another declared runtime resource; extension CSP also omits unsafe-eval. — manifest.json:1-43
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
No history, tabs, webNavigation, page host or content-script access is declared. — manifest.json:1-43
Background work is limited to local DNS records, status alarms and a user-requested IP test. — background.js:1-279
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Stores only DNS configuration/status records and creates no random or hardware-derived ID. — background.js:1-279
No analytics SDK, telemetry call or persistent client identifier is present. — popup.js:1-1825
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Uses an empty HEAD request with default credentials behavior; no user data or extension storage is included. — background.js:239-255
No cookie, page or identity capability is declared. — manifest.json:1-43
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Clipboard use is write-only and button-driven. — popup.js:1261-1273
No webpage or capture permission is present. — manifest.json:1-43
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
No externally_connectable declaration or executable web-accessible resource is present. — manifest.json:1-43
Registers internal runtime.onMessage only; no onMessageExternal handler exists. — background.js:31-97
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Footer links point directly to packaged documents, the developer site and the source repository without tracking rewrites. — popup.html:162-194
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No proxy, webRequest, declarativeNetRequest, debugger or downloads permission is declared. — manifest.json:1-43
Apply path saves local state and never calls chrome.proxy. — background.js:100-125
Text says it uses Chrome's proxy API to simulate DNS, but code and permissions show no such API use. — locales/en.json:81-83
Can it communicate with software on the computer or services running on localhost?
The custom-server test accepts any valid IPv4 address, including 127.0.0.1 and RFC1918 private addresses, and attempts an HTTP HEAD request to port 80. This is directly user-triggered and cannot be remotely commanded.
Validator accepts any four octets from 0 through 255 and testDNSConnection fetches http://{dnsServer} without excluding private/local ranges. — background.js:225-255
No external website messaging path exists to exploit this as a remote private-network probe. — manifest.json:1-43
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Fetches extension-local locale files and parses them as JSON. — js/i18n.js:39-69
Extension CSP permits scripts only from self and omits unsafe-eval. — manifest.json:1-43
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Exposes locales and privacy/terms pages to all URLs but declares no externally_connectable entry or executable web-accessible script. — manifest.json:1-43
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Chooses one of four packaged locale dictionaries based on the saved language. — js/i18n.js:20-213
Contains no targeting, anti-analysis or environment-dependent payload branch. — background.js:1-279
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Minute alarm only reads current in-memory configuration and returns a small status object. — background.js:38-47
Package contains UI assets/source and no worker, WASM or compute payload. — inventory.json:1-316
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Custom DNS fields belong to the extension's own UI and save local configuration. — popup.html:117-135
No content script or scripting permission can modify host-page forms. — manifest.json:1-43