What is a DNS leak?
Every time you type a website name, your device asks a DNS server to translate it into an IP address. By default that server belongs to your internet provider. It therefore sees every domain you look up, even when the pages themselves are encrypted with HTTPS.
A VPN is supposed to send those lookups through its encrypted tunnel to the VPN's own DNS servers. A DNS leak happens when some or all lookups bypass the tunnel and still go to your ISP or router. Your IP address looks hidden, yet your ISP keeps a running list of the sites you visit.
How this test works
We run our own authoritative DNS server for a special sub-domain. When you press the button, your browser looks up several hostnames that have never existed before, such as 3-9f2c1a7b04de under that domain. The only way those lookups can reach us is through the DNS resolver your device is really using, so we see exactly which resolver asked.
We then look up whose network each resolver belongs to and compare it with your own connection. We store the resolver addresses for ten minutes against a random test code and then delete them. Nothing about you is logged.
How to read your result
| Result | What it means | What to do |
|---|---|---|
| No DNS leak detected | Lookups were answered by resolvers on your VPN's network. | Nothing. Re-test after changing VPN settings. |
| Possible DNS leak | You look like a VPN user, but a resolver on a different network answered. | Turn on the VPN's DNS-leak protection and test again. See do VPNs leak DNS? |
| Public DNS provider | Google, Cloudflare, Quad9 or similar answered. | Not a leak of your network, but that provider sees your lookups. |
| Your internet provider | No VPN: the default setup. | Optional: change your DNS server. |
Common causes of DNS leaks
- The VPN only changes your IP. Some apps and manual configurations do not override the system's DNS servers.
- IPv6 is not tunnelled. If the VPN handles only IPv4, IPv6 lookups can go straight out. Read IPv4 vs IPv6.
- Smart multi-homed name resolution. Windows can send a query to every network adapter at once and use the fastest answer.
- Router or browser DNS-over-HTTPS. A browser configured to use its own encrypted DNS provider ignores the VPN's resolver.
Limits of this test
From the outside we can see which network a resolver is on, but not what you intended. Treat a "possible leak" as a prompt to check your settings, not as proof. If the result says no requests were seen, try again in a private window with extensions disabled, because privacy extensions and strict firewalls sometimes block the lookups.
Last reviewed 2026-10-26. Found a mistake? Report a correction (how we handle them).