What is a DNS leak?
DNS translates names into addresses. If those lookups skip your VPN or privacy DNS service, an observer who can see the resolver traffic may learn which sites you resolve even while the browser looks connected elsewhere.
Read this page before you interpret a leak-test result. The goal is to understand the difference between web traffic and DNS traffic, and why encrypted browser DNS can still be a leak relative to a VPN.
This is an explanatory page. Running the linked test contacts third-party leak-test services from your browser.
How to use this tool
- Note the public IP your browser uses for websites.
- Run a DNS leak test and list the resolver addresses.
- Compare those resolvers with the DNS servers your VPN or privacy service is supposed to use.
Run a DNS leak test
Why DNS is separate from the VPN tunnel
Applications ask a resolver for an address before they open most connections. Operating systems, browsers, and VPN clients can each pick a different resolver. A tunnel that covers HTTPS does not automatically cover those lookups.
If the OS keeps using the ISP resolver after the VPN connects, the ISP still sees the names you resolve. That is the classic DNS leak.
Encrypted DNS in the browser
Modern browsers can send DNS over HTTPS to a provider they choose. That hides lookups from a local network, but it can also bypass the VPN’s DNS. Whether that counts as a leak depends on which resolver you intended to use.
If you want every lookup to follow the VPN, turn off the browser’s private DNS and test again.
Transparent DNS proxies
Some networks intercept port 53 and answer lookups even when you configured another resolver. A leak test is one way to see whether the addresses you get match the resolver you thought you set.
Frequently asked questions
Is using Cloudflare or Quad9 always a leak?
No. Many VPNs send DNS to those services on purpose. A leak is a resolver you did not choose, most often the access ISP.
Does this prove someone is logging my browsing?
No. It shows which resolvers answered. Logging policy belongs to that resolver operator.
Related tools
