reflect.dnsp.co
Returns the IP address that asked the question, which is not always yours.
What it does
Ask for reflect.dnsp.co and the answer is the source address of the packet we received. Ask us directly and that is your own address. Ask through a resolver and you see the resolver's egress address instead, which is the machine that actually talks to the internet on your behalf.
Example
$ dig @dnsp.co reflect.dnsp.co +short
198.51.100.24
;; your own address
$ dig reflect.dnsp.co +short
203.0.113.7
;; your resolver's egress address
Reading the answer
your own public IP
You are talking to us directly and nothing re-originated the query.
a different public IP
A resolver or proxy is asking on your behalf, which is normal when you did not use @dnsp.co.
an address in your own network
Something inside your network is terminating DNS and forwarding it itself.
a new address each try
You are behind a resolver fleet. Repeat a few times before concluding anything.
Notes
- IPv6 queries reflect the IPv6 source. A v4 answer over a v6 transport means something re-originated the query.
- The reply is always in the family we saw, whatever type you asked for, so an A query that reached us over IPv6 comes back as an AAAA record. Through a recursive resolver that is a type mismatch and many of them strip it, which is why asking for AAAA can come back empty when the resolver reached us over IPv4. That is the resolver filtering, not a broken v6 path. Aim at ipv4.dnsp.co or ipv6.dnsp.co directly to take the resolver out of it.
- The answer carries a zero lifetime, so it is never usefully cached.