DNS Leak Test
A DNS leak sends your website lookups to your ISP even when you use a VPN or proxy. This test shows exactly which DNS servers answer for your browser, where they are and who runs them.
What is a DNS leak?
Every time you open a site, your device asks a DNS server to translate the name into an IP address. With a VPN, those requests should travel through the tunnel to the VPN's own resolvers. If they go to your ISP's resolvers instead, your provider can still see every domain you visit, even though the traffic itself is encrypted. That is a DNS leak.
How the test works
Your browser resolves a dozen random host names under a special domain. Our authoritative DNS server (or, as a fallback, a partner test) records which resolver asked. The resolver addresses are then looked up in geolocation and ASN databases so you can see the operator and the country.
How to read the result
If the resolvers belong to the same network as your IP address, nothing leaks. Public DNS such as Google, Cloudflare or Quad9 is fine if you chose it. Resolvers in another country or on a network unrelated to your VPN are the warning sign, especially when the operator is your home ISP.
Fixing a leak
Turn on DNS leak protection in your VPN client, set the DNS servers manually to the VPN provider's resolvers, disable Windows Smart Multi-Homed Name Resolution and prefer encrypted DNS. Then run the test again after reconnecting.
Frequently asked questions
Does a VPN always prevent DNS leaks?
No. Misconfigured clients, IPv6 traffic, split tunnelling and Windows name-resolution features can all send DNS queries outside the tunnel. A test is the only way to be sure.
The test shows Google or Cloudflare DNS — is that a leak?
Not by itself. If you configured a public resolver on purpose, it is expected. It is a leak only if you expected the VPN provider's DNS and see something else.
Why do I see several DNS servers?
Operating systems and ISPs often use more than one resolver, and large public DNS services answer from many machines. Seeing several servers from the same operator is normal.
Does this test work with DNS over HTTPS?
With DoH, your browser sends lookups through an encrypted channel to the DoH provider. The test then shows that provider's resolvers, which is exactly what you want to verify.
Is the test private?
The test names are random and used once. We keep the resolver addresses in memory for a few minutes to show you the result and never write them to logs.