DNS Leak Test
Check if your DNS requests are going through your VPN tunnel or leaking to your ISP.
DNS Leak Test
Your IP: 216.73.216.193
This test cannot determine your DNS servers right now
A DNS leak test has to find out which resolvers your device uses. That is fundamentally not measurable from a web server: every DNS query made here goes through the resolvers of our host, not yours. An earlier version of this tool displayed exactly those foreign servers as "yours" and therefore warned almost every visitor about a leak that did not exist. We removed it rather than show a number that means nothing. A real result needs our own authoritative nameserver that logs which resolver queries a random subdomain — we are working on it.
How to check it yourself
On Windows, ipconfig /all shows the "DNS Servers" line; on macOS and Linux use scutil --dns or resolvectl status. Compare the result with and without your VPN active: if the addresses of your provider remain while the VPN is running, your DNS queries are bypassing the tunnel.
Articles related to this tool
How the DNS Leak Test Works
A DNS leak means your name resolution bypasses the VPN tunnel and goes straight to your internet provider – your traffic is encrypted, but your provider still sees which sites you visit. Measuring this requires an authoritative nameserver of our own that logs which resolver queries a random subdomain. We do not operate that infrastructure at present, so instead of a measurement you will find a guide here: how to read out your DNS servers on Windows, macOS and Linux and compare them with and without an active VPN.
What exactly is a DNS leak?
A VPN tunnel is supposed to route all your internet traffic encrypted to the VPN server — including DNS queries, which translate domain names into IP addresses. A DNS leak means: despite an active VPN connection, DNS queries bypass the tunnel and go directly to your ISP. The consequence: your provider sees which sites you visit even when the VPN is active. Your IP is hidden, but your browsing pattern is not.
How the test works
We resolve several randomly generated subdomains of our domain and log on our side which DNS resolvers spoke to us. We then check whether those resolvers:
- belong to the same provider as your VPN server (= all good, tunnel works) or
- are operated by your ISP (= classic leak),
- are public DNS resolvers like Cloudflare 1.1.1.1 or Google 8.8.8.8 (= partial leak, acceptable depending on your threat model).
The test covers both IPv4 and IPv6 resolvers — important because many VPNs tunnel IPv4 cleanly but pass IPv6 through unencrypted. Verify your IPv6 setup separately with the IPv6 Test.
What to do about a leak
Three levers, check in this order: (1) VPN app setting — almost all apps have a "DNS leak protection" or "Use VPN DNS" toggle that is often off by default. (2) OS setting — Windows had historical issues with IPv6 smart multi-homed resolution; Linux with `systemd-resolved` must explicitly route via the tunnel. (3) Configure your own DNS resolvers — e.g. Cloudflare 1.1.1.1 or Quad9 9.9.9.9 instead of your ISP DNS, if you don't want to use a VPN. Deeper background in the article DNS Explained.
When is a leak actually critical?
If you use a VPN solely for geo-unblocking, a DNS leak is usually unproblematic — the streaming service sees your VPN IP anyway. It becomes critical in whistleblower/journalist scenarios, in censored networks, or when banking from public Wi-Fi. When in doubt: close the leak, better over-react than under-react.
Frequently Asked Questions about DNS Leak Test
What is a DNS leak?
A DNS leak occurs when DNS requests are sent through your ISP's default DNS server instead of the VPN tunnel, even with an active VPN. This allows your provider to see which websites you visit – even if the rest of the traffic is encrypted.
How can I prevent a DNS leak?
Use a VPN service with built-in DNS leak protection. Alternatively, manually set your DNS servers to trusted providers like Cloudflare (1.1.1.1) or Google (8.8.8.8) and disable IPv6 if your VPN does not support it.
Is a DNS leak dangerous?
A DNS leak is not a security risk in the strict sense, but a privacy issue. Your ISP and potentially third parties can track your browsing behaviour. This is especially problematic in countries with strict internet monitoring.