DNS Leak Tester

DNS Leak Tester

The test runs as soon as the page opens. It finds out which DNS resolver your browser actually uses, names the service and network behind it, and compares that with the network your connection comes from. If you’re on a VPN and your DNS goes somewhere the VPN doesn’t cover, that’s a leak, and the page lists how to fix it. Run again repeats the test, for instance after switching your VPN on.

What a DNS leak is

Every time you open a site, your device first asks a DNS resolver for the site’s address. Whoever runs that resolver sees the name of every site you visit.

A VPN is supposed to send that question through the tunnel too, to a resolver inside or chosen by the VPN. A DNS leak happens when the questions go outside the tunnel instead, usually to your internet provider’s resolver. The sites you visit are hidden from your provider, but the list of their names isn’t.

How the test works

The page asks your browser to look up four names that didn’t exist a moment ago, under a domain whose nameserver we run. No resolver can know the answer in advance, so whichever resolver your browser uses has to ask our nameserver. The nameserver notes the address that asked.

That address belongs to your resolver, and nothing else in the world can see which resolver looked up those names. The page then looks up whose network the address is in and judges the result.

The nameserver forgets the test after fifteen minutes, and nothing is stored on the site.

The verdicts

The heading of the result tells you which case you’re in:

When the testing service itself is down, the page says The DNS test is not available right now instead. Try again later.

Example: a public resolver

A home connection where the browser uses Cloudflare’s resolver:

• Your connection: 203.0.113.42, Example Broadband (AS64500), US. Looks like an ordinary internet provider.
• Resolvers that asked our nameserver: Cloudflare DNS (1.1.1.1), AS13335, public resolver service. 11 queries, over UDP, from three IPv4 addresses in Cloudflare’s network.
• 4 of 4 names reached the nameserver, 11 queries in all.

Verdict: “Your DNS queries go to Cloudflare DNS (1.1.1.1)”. This is a public resolver service rather than your provider’s, so Cloudflare sees the names you look up, not your provider.

Three details in this result confuse people:

• 11 queries for 4 names. Browsers ask for both the IPv4 and the IPv6 address of each name. Resolvers also retry, and modern resolvers ask about a name step by step, revealing only as much as each server needs.
• Several addresses for one service. Big resolvers run many servers, and any of them can do the asking.
• The resolver’s country. It’s where the service’s network is registered. Cloudflare answers from a data center near you, whatever the country says.

What a leak looks like

The same person turns on a VPN. The site now sees an address on the VPN’s hosting network, but the lookups still go to the resolver of the home provider, Example Broadband. The connection and the resolver are on unrelated networks, so the verdict is red.

The page lists the fixes that apply:

1. Turn on DNS leak protection in your VPN app. Most have it, sometimes switched off by default.
2. Set your device’s DNS servers to your VPN’s, or to a public resolver, instead of “automatic”, which usually means your provider’s.
3. On Windows, deal with “smart multi-homed name resolution”. It sends each query to every network at once and uses the fastest answer, which can be your normal connection rather than the VPN. Your VPN app’s protection, or the Group Policy setting “Turn off smart multi-homed name resolution” (under Network → DNS Client), switches it off.
4. Turn on secure DNS in your browser. The browser then sends its lookups encrypted to the service you choose, instead of to whatever resolver the device was given.
5. Change the resolver on your router if several devices leak. The router may be handing out your provider’s DNS servers to everything on the network, including over IPv6.

Click Run again after each change until the verdict turns green.

Why a public resolver can’t be judged further

When you use a service like Cloudflare or Google, the address that reaches our nameserver is the service’s, not yours. That shows which service you use, but not how your queries got there: inside a VPN tunnel or outside it. So with a public resolver the verdict stays green, with that note attached.

If you’re on a VPN and want to be sure, look at whether your connection itself shows the VPN’s network. Then make sure your VPN app routes DNS through the tunnel.

Client subnet

Some resolvers pass part of your address, typically the first three numbers of an IPv4 address, to the nameservers they ask. This is called EDNS Client Subnet, and it helps CDNs pick a nearby server for you. Google Public DNS does it. Cloudflare’s 1.1.1.1 doesn’t, and nor does Quad9’s main service.

When a resolver sends it, the page shows the subnet. On a VPN, check it: if the subnet belongs to your home connection rather than the VPN, your real network is reaching the outside world through DNS.

What the test covers

The test sees the DNS your browser uses. If the browser has DNS over HTTPS turned on, that’s the service you’ll see here, even if the rest of your device uses something else. Other apps on the same device may still use the system’s resolver. Most VPN apps protect both, but this page can only check the browser.

FAQ

Is using Google or Cloudflare DNS a leak?

No. A leak is DNS going somewhere your VPN doesn’t cover. Without a VPN, a public resolver simply means that service sees your lookups instead of your provider.

Does a DNS leak reveal my IP address?

Usually not your exact address. It reveals which provider you use and, to whoever runs the resolver, every name you look up. With client subnet, a resolver can also pass on which part of the internet you’re in.

Does DNS over HTTPS stop leaks?

It encrypts your lookups, so your provider can’t read them on the way. But they still go to the DNS over HTTPS service, so you’re choosing who sees them, not hiding them. With a VPN, make sure that service is one you’re happy with.

Does private or incognito mode help?

No. Private windows use the same DNS settings.

What else can leak on a VPN?

Your browser can reveal your address through WebRTC: check with the WebRTC Leak Test. Your IPv6 address can bypass a VPN that only carries IPv4: What’s My IP shows both. To see whose network an address belongs to, use ASN Lookup.