Every time you visit a website, your device first resolves the domain name (e.g. example.com) to an IP address using DNS (Domain Name System). This lookup happens before any data is transferred — and it reveals every domain you visit.

A DNS leak occurs when you are connected to a VPN but your DNS queries are still being sent to your ISP's resolver instead of through the VPN tunnel. This means your internet provider can see every domain you visit, even though your traffic appears encrypted.

The test works by exploiting the fundamental mechanics of DNS resolution:

1. 1Generate unique probes. The test generates 10 unique hostnames under dns.networktests.com (e.g. a1b2c3d4e5f6g7h8-1.dns.networktests.com). Each hostname is used only once and expires after 90 seconds.
2. 2Trigger DNS queries. Your browser fetches each hostname, forcing the operating system to resolve it through whatever DNS resolver your device is configured to use — your ISP's resolver, a VPN DNS server, or a public resolver like 1.1.1.1.
3. 3Capture at the authoritative DNS server. networktests.com operates its own authoritative DNS server. When your resolver looks up the probe hostname, it must query this server. The server records the IP address of each resolver that contacts it.
4. 4Enrich and analyse. Each resolver IP is looked up to determine the organisation (ASN), country, and whether it belongs to a known encrypted DNS provider. The results are cross-referenced with your VPN detection status.

This is the primary signal. It compares the organisation (ASN) of your DNS resolver against your detected VPN or public IP to determine whether DNS queries are reaching the right destination.

Traditional DNS operates in plaintext over UDP port 53. Anyone on the network path between your device and the resolver — including your router, ISP, or a network operator — can read every DNS query you send.

The test checks whether your resolver belongs to a known provider that supports encrypted DNS:

• DNS-over-HTTPS (DoH) — DNS queries sent over an encrypted HTTPS connection
• DNS-over-TLS (DoT) — DNS queries sent over an encrypted TLS connection on port 853

This signal compares the physical location of your DNS resolver against your own detected country.

A foreign resolver is not necessarily a problem. Global DNS providers like Cloudflare (1.1.1.1) and Google (8.8.8.8) route queries through anycast networks, so the server that responds may be in a different country than your device.

The resolver table lists every unique DNS resolver that responded to the test probes, along with:

• IP address — the resolver's public IP
• Organisation — the ISP, cloud provider, or DNS service operating the resolver
• ASN — the Autonomous System Number (network identifier)
• Country — where the resolver is physically located
• Encryption — whether the resolver supports DoH or DoT

Multiple resolvers appearing in the table is normal — large providers like Google and Cloudflare use multiple servers, and each of the 10 probe queries may be handled by a different node.

If the test shows "No DNS Queries Captured", there are several possible explanations:

• Browser-native DoH. Chrome, Firefox, and Edge can be configured to use DNS-over-HTTPS directly within the browser, bypassing the operating system resolver entirely. The browser resolves hostnames itself and never contacts the system's configured DNS server — so the OS resolver (and your VPN's DNS) never see the query.
• Aggressive DNS caching. DNS responses are cached by the OS, browser, or resolver. Although each probe uses a unique hostname, some caching layers may pre-emptively block or discard lookups for unfamiliar domains.
• Firewall or security software. Some security products intercept or block DNS queries to unknown domains, preventing the probes from reaching the authoritative server.

If a DNS leak is detected while using a VPN, try the following steps:

1. 1Use your VPN's built-in DNS. Most reputable VPN clients configure DNS automatically and route queries through their own servers. Ensure you are using the official VPN application rather than a manual OpenVPN or WireGuard configuration.
2. 2Enable DNS leak protection. Many VPN apps include a specific 'DNS leak protection' or 'private DNS' setting. Enable it if available.
3. 3Disable browser-native DoH. In Chrome: Settings → Privacy and security → Security → Use secure DNS → Off. In Firefox: Settings → General → Network Settings → Enable DNS over HTTPS → Off. When browser-native DoH is active, the browser resolves DNS independently using an encrypted channel to a public resolver such as Cloudflare or Google, bypassing the VPN tunnel entirely. Because the VPN cannot intercept these queries, VPN providers typically recommend disabling DoH so that all DNS traffic passes through their servers and remains within the tunnel. Our recommendation: if you are comfortable with your VPN provider not having visibility into your DNS queries, keeping DoH enabled is a valid alternative — your queries will be encrypted and routed to the resolver of your choice rather than your VPN provider's DNS servers.
4. 4Set DNS manually to your VPN's servers. If your VPN provides DNS server IPs, configure them explicitly in your operating system's network settings.
5. 5Use a VPN with full-tunnel mode. Split-tunnel VPNs route only some traffic through the VPN. Ensure full-tunnel mode is enabled so all DNS queries are captured by the VPN.