DNS Leak Test

DNS Leak Test

Find out which resolvers actually answered for you, who operates them, and where they sit. A DNS leak means your VPN is hiding your traffic but not the names of the sites you visit — the tunnel is working, the lookups are going around it.

The test triggers lookups for unique subdomains and records which resolvers arrive to answer them, so what you see is measured rather than reported by your own machine.

What a leak does and does not expose

What leaks: the domain names you look up, when, and the address that asked. Whoever runs the resolver sees that list, and if it is your ISP they can tie it to your account.

What does not leak: pages within a site, form contents, credentials, or anything inside the encrypted connection. A DNS leak does not decrypt traffic. If you want to know whether something is decrypting yours, that is a different test.

So the exposure is metadata, not content. Whether that matters depends entirely on why you use a VPN — it defeats much of the point for someone avoiding ISP profiling, and matters far less to someone who mainly wants their traffic unreadable on a public network.

Reading the result

The question that resolves most cases is simply: is any resolver here operated by my ISP rather than by my VPN? If so, that is a leak. If it is the VPN provider or a public resolver you chose deliberately, it is not.

Several addresses under one large operator is normal — public resolvers answer from many machines. Several addresses under different operators usually means your system is querying more than one resolver and only some are inside the tunnel.

Location alone never proves a leak. Large providers use anycast, so a resolver appearing far from your VPN endpoint is worth a second look but is not evidence on its own.

The five common causes

  • The OS queries several resolvers at once. Windows has historically used whichever interface replied first, and the physical adapter often beats the tunnel.
  • IPv6 goes around the tunnel. A VPN routing only IPv4 leaves IPv6 to the physical connection, and lookups can travel over it entirely outside the tunnel.
  • The browser has its own resolver. Firefox and Chrome can do DNS-over-HTTPS independently of the operating system, which can bypass the VPN's DNS settings and explains results that seem to contradict each other between browsers.
  • The router hands out its own DNS. If it is set there, it applies to every device by default — which is why a leak affecting several devices at once points at the router.
  • The VPN dropped without you noticing. Without a kill switch, everything reverts to the physical connection and the leak is incidental to a larger exposure.

Encrypted DNS is a separate question

DNS-over-HTTPS and DNS-over-TLS stop the network path reading your lookups, which is genuinely useful on untrusted networks. But the resolver still receives every query — you have changed who can see them, not whether anyone can. Encrypted DNS to a resolver you do not trust is not obviously better than plaintext DNS to one you do.