DNS Leak Test — Check Your VPN for DNS Leaks

What is a DNS leak?

Every time you open a website, your device asks a DNS resolver to turn the name (like example.com) into an IP address. When you use a VPN, those DNS requests should travel through the VPN’s encrypted tunnel. A DNS leak happens when they escape the tunnel and go to your ISP’s resolver instead — so even though your traffic looks hidden, your provider can still see every domain you visit. The test above shows which resolver actually handled the request: if it belongs to your VPN or a public DNS like Cloudflare or Google, you’re safe; if it belongs to your ISP, you have a leak.

FAQ

How do I fix a DNS leak?

Enable your VPN’s built-in DNS leak protection (most apps have it in settings). If it persists, set your system DNS manually to a public resolver like 1.1.1.1 (Cloudflare) or 8.8.8.8 (Google), disable IPv6 if your VPN doesn’t support it, and flush your DNS cache — on Windows run “ipconfig /flushdns”, on macOS “sudo dscacheutil -flushcache”.

Why does a DNS leak happen?

Common causes are a VPN that only tunnels IPv4 while your OS still sends IPv6 DNS queries directly, Windows “smart multi-homed name resolution” querying every adapter at once, or manually configured DNS that overrides the VPN. A dropped VPN connection with no kill-switch also exposes your real resolver.

Is a DNS leak dangerous?

It doesn’t expose the content of your traffic, but it defeats much of the point of a VPN: your ISP (or anyone running the resolver) can log every website you look up, tie it to your account, and in some countries hand it over or sell it. If you use a VPN for privacy, a DNS leak is worth fixing.

What’s the difference between a DNS leak and a WebRTC leak?

A DNS leak exposes which domains you resolve; a WebRTC leak exposes your real IP address directly through the browser, bypassing the VPN. They’re separate problems — you can check both on this site.