DNS Leak Test - Check If Your VPN Leaks DNS

A DNS leak is what happens when your DNS queries leave your connection outside the tunnel you believe you are using. The traffic is encrypted; the question "which domain do you want to resolve" is not. A leak therefore reveals your browsing destinations to your ISP, your network operator, or whoever runs the resolver — even while the pages themselves travel through a VPN.

How the test actually works

A leak test does not read your DNS settings. It watches which resolver shows up. The mechanism:

1. The test page generates a random subdomain under a domain it controls, unique to your session.
2. Your browser (or the system) resolves that name in order to load a resource.
3. The authoritative name server for that domain logs the query: which resolver IP asked, from where, and when.
4. The page receives that log and compares it against the resolver you were expected to use.

The result is therefore evidence, not inference. It shows the actual resolver that handled a real query during your session.

Reading the result

What you see	What it means
Only your VPN provider's resolvers	Clean. Queries follow the tunnel.
Your ISP's resolvers	Leaking. The resolver path bypasses the VPN.
A mix of VPN and ISP resolvers	Partial leak. Usually one stack — IPv4 or IPv6 — is not tunnelled.
Resolvers in a country you are not in	Could be a leak, or a VPN exit in that country. Compare with your IP result.
No queries recorded	The test could not trigger a resolution — encrypted DNS, cached answers, or a blocking extension.

The five common causes

• Split tunnelling — the VPN client excludes some apps or some destinations, and those use the system resolver directly.
• IPv6 bypass — the tunnel handles IPv4 only. IPv6 DNS queries go out on the native connection.
• System resolver preference — the OS keeps a per-interface DNS order and picks the physical adapter before the tunnel adapter.
• Browser-level DoH — the browser resolves through its own encrypted resolver, which may or may not go through the tunnel. This often produces "no queries recorded" rather than a visible leak.
• Captive portal or local DNS rewrite — a hotel or corporate network intercepts and answers queries locally.

Encrypted DNS changes the picture

DoH and DoT encrypt the query itself, so an on-path observer can no longer read the domain. That removes the classic leak, but creates two new questions:

• Where does the encrypted resolver sit? If the browser's DoH endpoint is reached outside the tunnel, the resolver operator still sees every domain — the leak moved rather than disappeared.
• Is your resolver consistent with your IP? A US IP resolving through a European DoH provider is a mismatch that sites can observe indirectly through CDN and latency behaviour.

How to fix a leak

1. Enable DNS handling inside the VPN client rather than at the OS level. Most clients have an explicit "force DNS through tunnel" option.
2. Disable IPv6 in the tunnel, or confirm the client tunnels it. Half-tunnelled dual-stack is the most common single cause.
3. Turn off browser DoH while testing. Re-enable it afterwards, pointed at a resolver you trust, and confirm it is reached through the tunnel.
4. Re-run the test after each change. A leak fix that is not re-tested is a guess.

Leak versus poisoning

These are different failures and they are detected differently:

• Leak — the query reached the wrong resolver. Privacy problem. Detected by watching which resolver asked.
• Poisoning or tampering — the answer came back wrong. Integrity problem. Detected by comparing answers across independent resolvers.

You can have either without the other. Use the DNS integrity check for the second.

FAQ

Does a DNS leak expose my browsing history?

It exposes the domains you resolved during the session to the resolver that handled them. Not full URLs, not page contents — but domain-level history is enough to characterise what you are doing.

Is a DNS leak dangerous on a home connection?

It is the normal state there. The concern is when you believe you are tunnelled and are not.

Why does the test show resolvers I do not recognise?

Public resolvers, ISP CGNAT resolvers, and VPN-provided resolvers all show up as unfamiliar addresses. Match them against your IP result before concluding anything.

Can a browser extension cause a leak?

Yes, if it performs its own resolution or bypasses the tunnel for specific requests.