DNSLab Privacy Policy

The short version

• You can use every tool without an account. We keep a record of each lookup, including your IP address, but not the result itself.
• As Turkish law (Law No. 5651) requires, we keep access logs of requests to our servers for two years.
• Google Analytics and Google AdSense are used only if you allow them in the cookie banner.
• If you create an account, we keep what's needed to run it: your name, email address, sign-in sessions, monitors, alert contacts and status pages.
• We don't sell personal data.

Who is responsible

DNSLab is operated by ICM, the data controller for the processing described here. For any question or request about your personal data, write to hello@icm.sh or use the DNSLab contact form.

If you run a status page, you decide who is on its subscriber and access lists; for those people's email addresses we act on your behalf (see Status pages).

Using the tools and the API

Lookup records. For each lookup, whether on the website, through the API or through the MCP server, we record the tool, what you looked up (a domain, host, IP address or URL), the time, how it went and your IP address. If you're signed in, the lookup is also linked to your account and appears in your history. The result itself is not stored: a shared result link runs the lookup again.

Running a lookup. To answer a query, DNSLab contacts the services involved: public DNS resolvers and name servers, DNS blacklist operators, domain registries (RDAP and WHOIS, including TRABIS for .tr domains), certificate services such as crt.sh and certificate authorities' OCSP responders, and the host you're testing. They receive what you entered and our server's address. The DNS propagation tool asks 20 public resolvers around the world, some of them outside Türkiye and the European Union.

Your own IP address. The What Is My IP page asks a few public services (icanhazip.com, ident.me, ipwho.is and geojs.io) for your address and its location directly from your browser, so they see your IP address. When you look up your own address, it is also sent to rdap.org to find the network it belongs to.

Tools that run in your browser. The certificate, key, CSR, password, subnet and other tools marked as running in your browser work entirely on your device. What you paste into them is not sent to us.

SMTP test. For an authenticated SMTP test, the credentials you enter are sent to the mail server you name, only to run the test. We don't save them in our database, our logs or the result link.

Abuse prevention. To keep the service fair, we count requests per IP address in memory for about a minute.

Access logs (Law No. 5651)

As Turkish law requires of content and hosting providers, we log every request to the DNSLab API, including lookups made from the website: the time, your IP address (and source port, where available), the address requested, the tool and target, the response, and your browser's user agent, language and referring page. Values that look like secrets are removed before saving.

Each entry is chained to the previous one with a cryptographic hash, so the log can't be changed unnoticed. We keep these logs for two years and then delete them automatically. Only authorized staff can view them, every view is itself recorded, and we disclose them to public authorities only when the law requires.

Your account

When you create an account on console.dnslab.io, we collect your first and last name, email address and password, and your phone number if you add one. The phone country is preselected from your IP address's country. Passwords are stored only as a secure hash (Argon2id).

We use your email address to verify your account and to send you messages about it and about your monitors. Accounts that aren't verified within seven days are suspended.

To protect your account, we record the IP address and browser of each sign-in session and when it was last used. If you turn on two-factor authentication, we store its secret key. Your dashboard shows statistics of your own lookups.

Uptime monitoring and alerts

Monitors. For each monitor we store its settings: its name, the address it checks and the options you choose, such as request headers or a request body. Treat headers and bodies like passwords and add only what the check needs.

Check results. Each check's status, response time and the reason for a failure are kept for up to 90 days, hourly summaries for 35 days and daily summaries for about 13 months, along with the incidents they open.

Alert contacts. We store the email addresses, webhook URLs and chat details you add. Webhook URLs and Telegram bot tokens are stored encrypted, and email contacts must confirm a link before they receive alerts.

Alerts. Alerts go to the channels you choose. Slack, Discord, Telegram or your own webhook receive the monitor's name, its target and the reason for the alert, and handle them under their own policies.

Status pages

Status pages are published at status.dnslab.io and are public unless their owner protects them with a password or an email list. What an owner publishes, such as service names, incidents and updates, can be seen by anyone who can open the page.

Visitors can subscribe to a page's updates with their email address. They confirm the subscription by email and can unsubscribe with one click from any update. Visitors of a protected page sign in with a password or an emailed code; their session lasts 14 days and records their email address and IP address.

Subscriber and access-list email addresses are processed on behalf of the page's owner, who decides who is on these lists.

Contact form

When you send us a message on dnslab.io, we receive your name, email address, subject and message, together with your IP address and browser's user agent to help prevent abuse. Cloudflare Turnstile checks that a person is sending the form. We use your message only to answer you.

Cookies, analytics and advertising

DNSLab uses necessary cookies for your language, sign-in and security. Only if you allow them in the cookie banner do we use Google Analytics, to understand how DNSLab is used, and Google AdSense, to show the ads that keep the tools free. Without your consent neither is loaded.

With your consent, Google Analytics receives the addresses of the pages you open, which for a result page include what you looked up. You can change your choice at any time with Cookie settings at the bottom of every page. Details and durations are in the DNSLab cookie policy.

Legal bases

• Running the tools and the API, lookup records and abuse prevention: our legitimate interest in providing a reliable, secure service (KVKK Article 5(2)(f), GDPR Article 6(1)(f)).
• Access logs: our legal obligation under Law No. 5651 (KVKK Article 5(2)(ç), GDPR Article 6(1)(c)).
• Accounts, monitors, alerts and status pages: providing the service you signed up for (KVKK Article 5(2)(c), GDPR Article 6(1)(b)).
• Contact messages: answering your request and our legitimate interest in supporting users.
• Analytics and advertising cookies: your explicit consent, which you can withdraw at any time (KVKK Article 5(1), GDPR Article 6(1)(a)).

Who receives it

• Contabo — hosts our servers in the European Union.
• Cloudflare — delivers and protects the site, and runs Turnstile.
• Our email provider — sends verification, alert and status page emails.
• Google — Google Analytics and Google AdSense, only with your consent.
• Services you choose — Slack, Discord, Telegram or your own webhooks receive the alerts you set up.
• Services a lookup needs — DNS resolvers, blacklists, registries and certificate services, as described above.
• Public authorities — only when the law requires.

Some of these providers process data outside Türkiye, including in the European Union and the United States. We do not sell personal data.

How long we keep it

• Access logs: two years, then deleted automatically.
• Check results: up to 90 days; summaries up to about 13 months.
• Account, monitors, alert contacts and status pages: until your account is deleted.
• Lookup records and contact messages: as long as they're needed for the purposes above, then deleted.
• Google Analytics: event and user data are kept for 2 months.
• Cookies: see the durations in the DNSLab cookie policy.

Your rights

Under Article 11 of KVKK and the GDPR you can ask whether we process your personal data, get a copy, have it corrected or deleted, object to its processing and learn who received it. Deleting an account and getting a copy of your data aren't self-service yet: write to hello@icm.sh from your account's email address and we'll answer within 30 days. You also have the right to complain to the Personal Data Protection Authority (KVKK) or to your local data protection authority.

Changes

We may update this policy. The date above shows when it was last changed.