DNS Leak Test

What this checks

• HTTP exit IP, resolver IPs, countries, ASNs, organizations, and hostnames.
• Resolver-to-exit consistency signals such as country, ASN, and owner matches.
• Resolver classification, leak risk, and IPv6-aware context when available.

How to interpret results

• Safe usually means resolver ownership and routing are aligned with the expected VPN, proxy, or trusted DNS path.
• Warnings mean resolver geography or ownership differs enough that the DNS path deserves another check.
• Leaking means the resolver appears to bypass the privacy path and expose an ISP or unexpected operator.

Common issues

• Anycast and managed public resolvers can appear in different cities or countries even when they are intentional.
• Browsers, operating systems, VPN clients, and IPv6 paths can all influence which resolver handles the lookup.

How a DNS leak test works

The test creates short-lived tokenized hostnames and watches which recursive resolvers ask for them. That lets the page compare the DNS path with the HTTP exit IP your browser is using instead of guessing from one resolver setting alone.

Resolver IPs are then enriched with country, ASN, owner, and network-type context so you can tell whether the resolver belongs to your VPN, a trusted public DNS network, your ISP, or another unexpected path.

How to interpret DNS leak results

A clean result means the observed resolvers look consistent with the privacy path you expected. A warning means the country, ASN, or organization differs enough that the path deserves another look. A leaking result means the resolver appears to bypass your VPN or proxy and expose an ISP or different network operator.

IPv6 is a common source of confusion here. A VPN can protect IPv4 while IPv6 DNS still follows the normal ISP route, which is why DNS Leak Test and IPv6 Test work best together.

Common causes of DNS leaks

DNS leaks are usually caused by configuration rather than one dramatic failure. Split tunneling, secure-DNS browser settings, old ISP resolvers left behind by the operating system, router overrides, and IPv6-only bypasses are the most common sources.

Retest after reconnecting the VPN, clearing stale DNS settings, and checking whether the browser is using a separate DNS provider on its own.

Privacy note

The DNS leak test uses short-lived session tokens and resolver observations. It is designed to avoid storing permanent DNS test history for normal checks.

Frequently Asked Questions

What is a DNS leak?

A DNS leak happens when domain lookups use a resolver outside your expected VPN, proxy, or secure DNS path, which can expose browsing destinations to an ISP or another network operator.

How do I know if my DNS is leaking?

Compare the DNS resolver IPs with the HTTP exit IP. A resolver in the same VPN network, same organization, same country, or a trusted public DNS network is usually expected; a mismatched local ISP resolver is a strong leak signal.

Is using Google DNS or Cloudflare DNS a DNS leak?

Not always. Public resolvers such as Google DNS or Cloudflare DNS can be intentional and safe, but they may still reveal DNS queries to that resolver instead of to your VPN provider.

Can a VPN still leak DNS?

Yes. DNS leaks can happen when the operating system keeps old DNS servers, IPv6 bypasses the tunnel, split tunneling is enabled, or the browser uses a separate secure DNS setting.

How do I fix a DNS leak?

Start by enabling your VPN provider's DNS protection, checking browser secure-DNS settings, clearing stale ISP resolvers from the operating system, and retesting with IPv6 enabled and disabled so you can see whether only one stack is escaping.

Why does my DNS resolver show a different country?

Many DNS providers use anycast and route you to a nearby or regional node. A different country is a warning sign only when it conflicts with your VPN or proxy expectations and resolver ownership also looks wrong.

Why does an IPv6 DNS leak matter?

A VPN can protect IPv4 while IPv6 DNS still follows the normal ISP route. That means the visible website IP can look protected while domain lookups still reveal a different resolver path through your ISP or another network.

Does this test store my DNS queries?

This test uses a short-lived random token and in-memory observations. It does not persist resolver results, tokens, or full user IP addresses in a database.