DNS Leak Test

What is a DNS leak?

DNS translates domain names into IP addresses. Those requests are commonly handled by resolvers run by an ISP, VPN provider, public DNS provider, or organization.

When you use a VPN, you may expect DNS requests to follow the VPN's intended DNS path. A DNS leak can occur when requests unexpectedly travel outside that path and reach another resolver. DNS requests can reveal the domain names a connection attempts to resolve, although they do not necessarily reveal the exact page or content viewed.

An unfamiliar resolver does not automatically prove a leak. Forwarding, resolver pools, enterprise DNS, public resolvers, and network design can all produce legitimate differences.

How this DNS Leak Test works

1. Your browser creates a temporary random identifier.
2. It requests temporary test hostnames that include that identifier.
3. Your DNS infrastructure resolves those names.
4. Our authoritative DNS endpoint sees the recursive resolver or forwarder that reaches it.
5. The page displays that address and available network information.

The displayed address is the recursive resolver or forwarder visible to our authoritative DNS server. It is not necessarily the exact DNS server configured directly on your device.

How to read your results

One DNS resolver observed

One address can simply mean the test requests reached one visible resolver path. Compare its network with the DNS service you expect to be used on this connection.

Multiple DNS resolvers observed

Multiple addresses can result from resolver pools, IPv4 and IPv6 infrastructure, forwarding, load balancing, VPN configuration, or enterprise and network policy.

Matching network

When your connection and observed resolver show the same network, that is useful context about the visible DNS path. It does not by itself mean the connection is safe or that no leak exists.

VPN users

Compare the observed resolver network with the DNS service or path your VPN says it uses. An ISP or other unexpected resolver may deserve investigation, but provider, ASN, or country differences alone do not establish a DNS leak.

Unknown network or country

IP intelligence can be incomplete or approximate. An unknown value does not change the observed resolver address or make the test unsuccessful.

No result

Browser or network restrictions, unusual DNS behavior, and temporary network conditions can prevent an observation. No result does not mean there is no DNS leak.

Common causes of unexpected DNS paths

• VPN DNS configuration: a VPN may not use or enforce its intended DNS service.
• Device or router settings: configured DNS, local forwarding, or fallback resolvers can affect the path.
• IPv6 and split tunneling: a separate route may follow different VPN or DNS behavior.
• Enterprise policy: managed networks can forward DNS through organization-operated infrastructure.
• Browser and network behavior: resolver selection, caches, and network policy can change which address is visible.

How to investigate a possible DNS leak

1. Run the test with your VPN disconnected and note the resolver network.
2. Connect the VPN and run it again.
3. Compare the observed resolver and network context with the DNS path you expect.
4. Review the VPN app's DNS or leak-protection settings.
5. Check device and router DNS settings if an unexpected resolver remains visible.
6. Review IPv6 behavior and split-tunneling settings where they apply.
7. Reconnect or restart the VPN after changing a relevant setting, then retest.
8. Consult your VPN provider's DNS documentation if the result remains unexpected.

Do not make broad network changes, such as disabling IPv6, without understanding how they affect your connection and the VPN's documented behavior.

DNS Leak vs WebRTC Leak vs IPv6 Leak

For broader connection context, use the VPN / Proxy / Tor Checker, Is My VPN Working?, Privacy Check, or DNS Lookup when it fits the question you are investigating.

DNS encryption clarification

This test does not determine whether the connection between your device or browser and a resolver uses traditional DNS, DNS over HTTPS (DoH), or DNS over TLS (DoT). Our authoritative endpoint observes the resolver or forwarder that ultimately reaches it. Encrypted DNS and DNS leaks are related but different questions.

Privacy and methodology

Every run uses a fresh random anonymous token to correlate temporary test DNS requests. Resolver observations are held in memory, expire within five minutes, and do not create a durable DNS resolver history. Token and resolver values are not included in analytics events.

Available resolver network information is enriched server-side using this site's existing IP intelligence capability. That can process a resolver address through the site's IP-data provider, but it does not add the token to that lookup.