IP Address Basics
What is an IP address?
An IP (Internet Protocol) address is a unique numerical label assigned to every device connected to the internet or a local network. It serves two main purposes: identifying the host device and providing its network location so data can be routed correctly.
There are two versions in active use today — IPv4 (e.g. 192.168.1.1) and IPv6 (e.g. 2001:0db8:85a3::8a2e:0370:7334). Every time you visit a website, send an email, or stream a video, your device's IP address is used to send and receive data.
What is the difference between IPv4 and IPv6?
IPv4 uses 32-bit addresses, allowing for about 4.3 billion unique addresses. With the explosive growth of internet-connected devices, this pool has been nearly exhausted.
IPv6 was introduced to solve this problem. It uses 128-bit addresses, supporting a practically unlimited number of unique addresses (about 340 undecillion). IPv6 also improves routing efficiency and includes built-in security features.
Most networks today support both versions (dual-stack), though many ISPs still assign IPv4 by default for home connections.
What is the difference between a public and a private IP address?
A public IP address is the address your internet provider assigns to your router — it is visible to the outside world and is what websites and services see when you connect to them.
A private IP address is used within your local network (home or office). Ranges like 192.168.x.x, 10.x.x.x, and 172.16–31.x.x are reserved for private use and are not routable on the public internet.
Your router uses a process called NAT (Network Address Translation) to let multiple devices share a single public IP address.
What is an ASN (Autonomous System Number)?
An Autonomous System Number (ASN) is a unique identifier assigned to a collection of IP networks operated by a single organisation — typically an ISP, university, government body, or large tech company. ASNs are used by the Border Gateway Protocol (BGP) to route traffic between different networks on the internet.
For example, Google's ASN is AS15169 and Cloudflare's is AS13335. When you look up an IP address, the ASN tells you which organisation controls that block of IP addresses — often more reliable than the ISP name for identifying large cloud or hosting providers.
What is a reverse DNS (rDNS) lookup?
A regular DNS lookup translates a domain name (e.g. google.com) into an IP address. A reverse DNS lookup does the opposite — it maps an IP address back to a hostname.
For example, the IP 8.8.8.8 reverse-resolves to dns.google. Reverse DNS is commonly used in email authentication (mail servers verify the sender's identity), server identification, and network diagnostics.
Not all IP addresses have a reverse DNS record — many consumer IPs do not.
IP Geolocation
How accurate is IP geolocation?
IP geolocation accuracy varies depending on the address type and the database used:
- Country-level: ~99% accurate for most IP addresses.
- City-level: ~80–90% accurate, typically within 25–50 miles of the true location.
- Street-level: Not reliable. IP geolocation cannot pinpoint a precise street address.
Geolocation works by mapping IP blocks to physical locations using data from ISPs, regional registries, and user corrections. Mobile and satellite IPs tend to be less accurate because traffic is routed through central points far from the user.
Why does my IP address show the wrong city or location?
This is common and happens for several reasons:
- Your ISP routes traffic through a central hub in a different city — your IP is registered to that hub, not your home.
- You are behind a corporate VPN or proxy that uses a server in another city or country.
- Mobile networks often assign IPs registered to the carrier's national headquarters.
- The geolocation database may have outdated records for your IP block.
IP geolocation reflects where the IP is registered, not necessarily where the device is physically located.
Why does my IP address look different on different websites?
If two websites show different IP addresses for you, the most likely explanation is that one is detecting your VPN or proxy IP while the other detects the proxy server's IP.
Another cause is a WebRTC leak — browsers can reveal your real local or public IP through WebRTC even when behind a VPN. LookMyIP's WebRTC detection feature can surface this difference and show you both your network IP and your device's real IP.
Can an IP address reveal my exact home address?
No. An IP address cannot reveal your exact home address. It can only narrow your location to a city or region — and even that can be inaccurate by tens of miles.
Only your ISP knows the precise physical address associated with your IP, and they are legally required to keep that information private. ISPs may share it with law enforcement under a valid legal order, but it is never publicly accessible.
IP Blacklists
What is an IP blacklist?
An IP blacklist (also called a blocklist or DNSBL — DNS-based Blackhole List) is a database of IP addresses known to send spam, host malware, or engage in abusive activity. Email servers, firewalls, and security tools query these lists to decide whether to block or flag traffic.
Popular blacklists include Spamhaus ZEN, Barracuda, SpamCop and UCEPROTECT. (SORBS, long a common one, shut down in 2024.) Each list has its own criteria for listing and delisting IPs.
Why is my IP address blacklisted?
An IP can end up on a blacklist for several reasons:
- Your network or a device on it sent spam or participated in a botnet.
- A previous tenant of a dynamic IP address engaged in abuse — you inherited their reputation.
- A misconfigured mail server on your network sent bulk email.
- Your IP belongs to a residential ISP range that some lists pre-emptively block.
Shared IP addresses (common in hosting) can be blacklisted because of other tenants on the same server.
How do I remove my IP from a blacklist?
Each blacklist has its own delisting process:
- Spamhaus: Visit spamhaus.org, look up your IP, and follow the removal request. Resolve the underlying issue first.
- Barracuda: Use the lookup tool at barracudacentral.org to request removal.
- SpamCop: Listings expire automatically after 24 hours with no new reports.
Always fix the root cause before requesting removal, or you will be re-listed quickly.
What is Spamhaus and why does it matter?
Spamhaus is one of the most widely used anti-spam organisations in the world. Its ZEN blocklist is queried billions of times per day by mail servers globally.
If your IP is listed on Spamhaus, outbound emails are likely being rejected or sent to spam by a large percentage of recipients. ISPs, enterprise mail gateways, and cloud email providers like Gmail and Microsoft 365 all use Spamhaus data.
Being delisted from Spamhaus is typically the highest priority when dealing with email deliverability problems.
Does being on a blacklist affect my web browsing?
In most cases, no — IP blacklists primarily affect email deliverability. Regular web browsing, streaming, and downloads are not typically impacted.
However, some aggressive firewalls and security products (particularly in enterprise environments) may block web requests from blacklisted IPs. Certain websites and APIs also check reputation lists before serving requests. If your IP is on a severe list, you might encounter CAPTCHAs more frequently.
VPN & Privacy
What is a VPN and how does it affect my IP address?
A VPN (Virtual Private Network) encrypts your internet traffic and routes it through a server in a location of your choice. To websites and services, your traffic appears to come from the VPN server's IP — not your real home IP.
A VPN changes the IP that external services see. It does not change your device's local IP, and it does not make you completely anonymous — your VPN provider can still see your activity.
What is a proxy server and how is it different from a VPN?
A proxy server acts as an intermediary between your device and the internet. The destination server sees the proxy's IP instead of yours.
- Key differences from a VPN:
- Proxies typically work at the application level (browser only), while a VPN routes all traffic at the OS level.
- Proxies usually do not encrypt your traffic.
- VPNs generally offer stronger privacy and security than proxies.
- Corporate networks often route all traffic through a proxy (like Zscaler) for security monitoring.
What is a WebRTC IP leak?
WebRTC is a browser technology that enables peer-to-peer features like video calls. A side effect is that it can expose your real IP address even when you are using a VPN or proxy.
This happens because WebRTC queries your network interfaces directly, bypassing the VPN tunnel. The leaked IP might be your actual home IP or a local network IP.
LookMyIP detects this automatically — if your browser's real IP differs from the IP your network connection shows, we display a warning so you are aware of the discrepancy.
How can I tell if an IP belongs to a datacenter, VPN or Tor?
The IP lookup shows who holds the address (ISP and ASN), its reverse DNS, and whether it is anycast — announced from many locations at once, like 1.1.1.1, so its city is meaningless.
For the datacenter / VPN / Tor question, use signals together:
- ASN holder: Amazon, Google Cloud, Microsoft, DigitalOcean, OVH, Hetzner and similar mean a server, not a home connection.
- Reverse DNS: names like ec2-….compute.amazonaws.com or a VPN brand in the hostname give it away.
- IP reputation check: reports the usage type from AbuseIPDB (for example “Data Center/Web Hosting/Transit”), whether the IP is a known Tor exit, and recent abuse reports.
What is a DNS leak?
A DNS leak happens when your VPN tunnels your web traffic but your device still sends DNS lookups — the "what is the IP of this site?" questions — to your ISP's resolver. Your ISP can't see the pages you load, but it still sees every domain you visit.
Common causes are the operating system keeping the network adapter's DNS server, IPv6 lookups bypassing an IPv4-only tunnel, and VPN browser extensions that only proxy web requests. Use your VPN app's DNS leak protection, or enable DNS-over-HTTPS in your browser. Our VPN leak guide explains how to test for it.
DNS & Domains
What is DNS and how does a lookup work?
DNS (Domain Name System) translates names like example.com into the IP addresses computers use to connect. When you visit a site, your device asks a recursive resolver — usually your ISP's, or a public one like 1.1.1.1 or 8.8.8.8.
If the resolver hasn't cached the answer, it asks a root server which servers handle .com, asks those which servers handle example.com, and finally asks example.com's authoritative nameservers for the record. The answer is cached for the record's TTL so the next lookup is instant. You can see every record type for a domain with the DNS Lookup.
Why do DNS changes take time to show up everywhere?
Nothing is actually "propagating". Resolvers around the world cached the old answer and keep serving it until its TTL (time to live) runs out. A record with a TTL of 3600 can be served from cache for up to an hour after you change it; a 86400 TTL means up to a day.
To make a change go live quickly, lower the TTL to 300 a day before the change, make the change, then raise the TTL again. The DNS Propagation Checker shows which public resolvers already return the new value.
What is the difference between a CNAME and an A record?
An A record points a name directly at an IPv4 address (AAAA does the same for IPv6). A CNAME says "this name is an alias for another name" — the resolver then looks up that other name.
Use a CNAME when a service gives you a hostname rather than an IP, such as a CDN or hosted shop, so the provider can change IPs without you editing DNS. A CNAME can't coexist with other records on the same name, which is why the bare domain (example.com) usually can't be a CNAME — many DNS providers offer "CNAME flattening" or ALIAS records to work around this.
What is DNSSEC and should I enable it?
DNSSEC adds cryptographic signatures to DNS records so resolvers can verify an answer genuinely came from the domain's owner and wasn't forged. It protects against cache poisoning; it does not encrypt your lookups.
If your DNS provider supports it with one click and automatic key rotation, enabling it is worthwhile. The main risk is operational: if you change DNS provider without first removing the DS record at your registrar, the domain stops resolving for everyone using a validating resolver. Check any domain with the DNSSEC Checker, and see the DNSSEC guide for the details.
Can I find out who owns a domain name?
Often only partly. A WHOIS lookup always shows the registrar, registration and expiry dates, nameservers and status codes. Since GDPR took effect in 2018, most registrars redact the owner's name, email and address, replacing them with a privacy service or "REDACTED FOR PRIVACY".
If you need to reach the owner, most registrars provide a contact form or relay email address in the record. For legal matters — trademark disputes or abuse — registrars can disclose data on a valid request. Domains registered by companies more often show the organisation name.
Email Security & Deliverability
What are SPF, DKIM and DMARC?
They are three DNS-based checks that let receiving mail servers verify an email really comes from the domain it claims to be from.
- SPF lists the servers allowed to send mail for your domain.
- DKIM adds a cryptographic signature to each message, verified with a public key published in your DNS.
- DMARC tells receivers what to do when a message fails — nothing, send to spam, or reject — and where to send reports. It also requires the authenticated domain to match the visible From address.
Check all three at once with the Email Authentication Checker.
Why is my email rejected by Gmail or Outlook?
The bounce message usually says why. 5.7.26 from Gmail and 550 5.7.515 from Outlook mean the message failed authentication: SPF, DKIM or DMARC is missing or doesn't align with the From domain. Other common causes are a sending IP on a blacklist, a missing or mismatched reverse DNS (PTR) record on the sending server, and a high spam-complaint rate.
Since 2024 (Google and Yahoo) and May 2025 (Microsoft), senders of more than 5,000 messages a day must have SPF, DKIM and DMARC. Our spam troubleshooting guide walks through each check.
What is an MX record?
An MX (mail exchanger) record tells other mail servers where to deliver email for your domain. Each MX record has a hostname and a priority number; senders try the lowest number first and fall back to the others if it is unavailable.
An MX record must point to a hostname, never directly to an IP address or a CNAME. If a domain has no MX record at all, senders fall back to its A record. Use the MX Lookup to see a domain's mail servers and check that each one resolves.
Do I need a PTR record to send email?
If you run your own mail server, yes. Most receiving servers look up the reverse DNS (PTR) of the connecting IP, and Gmail requires that it exists and forward-confirms — the hostname it names must resolve back to the same IP.
The PTR is set by whoever owns the IP address (your hosting or cloud provider, or ISP), not in your domain's DNS. If you send through a service like Google Workspace, Microsoft 365 or an email marketing platform, they handle this for you. Check any IP with the Reverse DNS Lookup.
What changed in DMARC in 2026?
In May 2026 the IETF published DMARC as a proper Internet standard in RFC 9989, with reporting in RFCs 9990 and 9991, replacing the 2015 RFC 7489. Existing records keep working — the version is still v=DMARC1.
The main changes: the pct tag was removed (use the new t=y test mode instead), a new np tag sets a policy for subdomains that don't exist, and the organizational domain is found with a DNS tree walk instead of the Public Suffix List. Details are in what RFC 9989 changes.
SSL, HTTPS & Web Security
How long do SSL/TLS certificates last?
For certificates issued since 15 March 2026, at most 200 days. Under CA/Browser Forum ballot SC-081 the maximum drops to 100 days from March 2027 and 47 days from March 2029. Let's Encrypt certificates currently last 90 days, dropping to 64 days in February 2027 and 45 days in February 2028.
At those lifetimes, renewal has to be automated, usually with an ACME client such as Certbot or one built into your hosting platform. See when any site's certificate expires with the SSL Certificate Checker, and read the 47-day timeline.
Why does my browser say a site's certificate is not trusted?
The most common causes are:
- Expired certificate — renewal failed or was never automated.
- Name mismatch — the certificate covers example.com but you visited www.example.com, or vice versa.
- Incomplete chain — the server sends its own certificate but not the intermediate certificate that links it to a trusted root. Desktop browsers sometimes cope; phones and API clients often don't.
- Self-signed or private CA — fine on internal networks, never trusted by public browsers.
- Wrong device clock — a clock set years in the past or future makes valid certificates look invalid.
The SSL Certificate Checker shows the expiry, the names covered and the full chain.
What are HTTP security headers?
They are response headers that switch on browser protections. The most important are Strict-Transport-Security (always use HTTPS), Content-Security-Policy (which scripts and resources may load), X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy, and frame protection with CSP frame-ancestors or X-Frame-Options to prevent clickjacking.
They're configured on your web server or CDN and cost nothing at runtime. Check any site with the HTTP Headers Checker and see the security headers guide for safe starting values.
What is the difference between a 301 and a 302 redirect?
A 301 means the page has moved permanently; a 302 means the move is temporary. Search engines move a page's ranking to the new URL for a 301, but keep the old URL indexed for a 302 because they expect it to return.
308 and 307 are the permanent and temporary equivalents that also guarantee the request method is kept (a form POST stays a POST). Use 301 or 308 for anything you don't plan to undo. Trace any URL's redirects with the Redirect Checker.
What is post-quantum encryption in HTTPS?
Modern browsers combine the usual X25519 key exchange with ML-KEM, a new algorithm designed to resist quantum computers, in a hybrid called X25519MLKEM768. An attacker would have to break both.
It protects against "harvest now, decrypt later" — recording encrypted traffic today in the hope of decrypting it with a future quantum computer. Cloudflare reported in September 2026 that about 70% of browser traffic to its network already uses it. Certificates are not yet post-quantum. See post-quantum TLS in 2026 for how to test a server.
Ports & Network Security
What is a network port?
An IP address identifies a device; a port number (0–65535) identifies which program on that device should receive the traffic. Web servers listen on 443 (HTTPS) and 80 (HTTP), SSH on 22, mail servers on 25, and so on.
Ports below 1024 are "well-known" and reserved for standard services. Your browser also uses a random high-numbered port on your own side of each connection. Our guide to common port numbers lists the ones you'll meet most often.
How do I check if a port is open?
From outside your network, use the Open Port Checker: it tries to connect to the port on your public IP and reports whether the connection succeeds. That's the test that matters for port forwarding or hosting a game server.
From inside a machine, ss -tlnp (Linux) or netstat -an (Windows/macOS) lists what's listening. A port can be listening locally but still be blocked by a firewall, your router or your ISP, which is why the outside test is needed. The open ports guide covers both, including nmap.
Is it dangerous to have open ports?
An open port is only as risky as the service behind it. Port 443 on a patched web server is normal. Ports that expose databases (3306 MySQL, 5432 PostgreSQL, 27017 MongoDB, 6379 Redis), remote desktop (3389), or admin panels to the whole internet are among the most common ways systems get breached — internet-wide scanners find them within minutes of going online.
The safe default is to expose only what must be public, put everything else behind a VPN or an IP allow-list, and keep exposed software updated.
Why can't I open a port even after port forwarding?
The usual culprit is CGNAT (carrier-grade NAT). Many ISPs, especially mobile and fibre providers, share one public IPv4 address between many customers. Your router's "WAN IP" is then a private address (often in 100.64.0.0/10), and no forwarding rule on your router can make you reachable from outside.
Compare the WAN IP in your router with the IP shown on our homepage. If they differ, you're behind CGNAT. Options are asking your ISP for a public IP (sometimes paid), using IPv6 if your ISP provides it, or using a tunnelling service.
Why does my speed test show different results each time?
Every test measures one path at one moment. Wi-Fi signal and interference are the biggest variable — a wired result can be double a Wi-Fi one. Other devices downloading, the time of day (evening congestion), the test server's location and VPNs all change the result too.
For a reliable number, test over Ethernet with other devices paused, run three tests and take the middle one, and repeat in the evening. The Speed Test also shows ping and jitter, and the speed test guide explains what each number means.