DNS leak test

What is a DNS leak?

Every time your browser opens a site, it first asks a DNS resolver to convert the domain name into an IP address. That request goes out before the page loads. When you use a VPN, those lookups should travel through the VPN too. A DNS leak is when they do not. Your VPN encrypts your web traffic but your DNS queries still go straight to your ISP. Your ISP can see every domain you look up, building a complete picture of your browsing even though your actual traffic is hidden.

Why DNS leaks happen

Most VPN clients route your internet traffic through a tunnel but do not always take control of DNS. If the operating system is still configured to use your ISP's resolver, it will keep using it regardless of the VPN. This often happens after a network change, on reconnect, or when the VPN client does not override the DNS setting explicitly.

IPv6 is another common cause. Many VPN clients only tunnel IPv4 traffic. If your ISP provides an IPv6 address and your OS makes DNS queries over IPv6, those requests skip the tunnel entirely.

How to read the results

If the resolver shown is your ISP and you are not using a VPN, that is completely normal. If the resolver is your ISP while you are connected to a VPN, your VPN is not handling DNS and you have a leak. If the resolver shows your VPN provider's network or a server in a different country, the VPN is routing DNS correctly.

Results can vary because resolvers use pools of servers and anycast routing. Run the test a few times if you want to be sure.

How to fix a DNS leak

Use a VPN that runs its own DNS resolver at every exit node. A properly built VPN routes your DNS queries through the encrypted tunnel and answers them from its own servers. Your ISP never sees the query. Some VPN clients also include a DNS leak prevention feature that blocks any DNS traffic not going through the tunnel, so there is no fallback even during reconnections.