What Is a DNS Leak Test?
A DNS leak test checks whether your Internet traffic is sending DNS queries (domain name lookups) outside of your intended DNS server—usually your VPN, proxy, or secure DNS provider.
When a DNS leak occurs, your device continues to use your ISP's DNS instead of your private or encrypted one, allowing your browsing activity to be logged, tracked, or censored.
Try it now: run a live DNS Leak Test using our DNS detection tool to see which resolver your traffic uses.
What Is a DNS Leak?
When you connect to a VPN or proxy, all your Internet requests should be securely tunneled—including DNS lookups. If your operating system or app continues to resolve domain names via your ISP's DNS, this is called a DNS leak.
Example:
You connect to a VPN in Germany.
You visit a website.
Instead of your VPN's DNS, your computer queries your ISP's DNS in Turkey.
→ Your ISP can still see which domains you visit.
Related entities: DNS Resolver, ISP, VPN, Proxy Server, DNS Request, Encryption, Privacy Leak.
How a DNS Leak Test Works
A DNS leak test identifies the DNS resolvers that are actually processing your DNS queries.
The tool loads a series of domain names with unique identifiers.
It checks which DNS servers resolved those names.
If the IPs belong to your VPN provider → safe.
If they belong to your ISP → leak detected.
Related entities: DNS Resolver IP, VPN Tunnel, DNS Query, Anycast Routing, DNS over HTTPS (DoH), DNS over TLS (DoT).
Why DNS Leaks Are Dangerous
DNS leaks can compromise your:
Privacy
ISPs or third parties can see your browsing activity.
Location
DNS requests reveal your real geographic location.
Security
Attackers can intercept unencrypted DNS traffic.
Access
Some websites may be blocked or filtered via ISP DNS.
Even with a VPN, a DNS leak means your online identity isn't fully protected.
Common Causes of DNS Leaks
| Cause | Description |
|---|---|
| VPN Misconfiguration | The VPN doesn't enforce DNS routing. |
| IPv6 Queries | VPN only routes IPv4, leaving IPv6 DNS exposed. |
| Smart Multi-homed Name Resolution (Windows) | Windows queries all available network adapters. |
| Manual DNS Settings | User-configured DNS overrides VPN settings. |
| Transparent DNS Proxy | Some ISPs intercept DNS traffic forcibly. |
| Public Wi-Fi Gateways | Network hijacks DNS for captive portals. |
How to Perform a DNS Leak Test
Step-by-Step Guide
Disconnect from your VPN → note your original IP and DNS via DNS Lookup Tool.
Connect to your VPN.
Visit a DNS Leak Test tool (like dnslookup.pro).
Start the test — the tool resolves multiple hostnames.
Compare results:
✅ If DNS IP = your VPN provider → Safe
⚠️ If DNS IP = your ISP → Leak detected
CLI Option
You can also test manually:
nslookup example.com
Look at the Server and Address values — it shows which DNS server is used.
How to Fix a DNS Leak
| Fix | Description |
|---|---|
| Enable VPN DNS Protection | Use VPNs that provide their own DNS servers. |
| Use Encrypted DNS (DoH / DoT) | Secure queries from interception. |
| Disable IPv6 | Prevent dual-stack leaks if your VPN doesn't support it. |
| Manually Set Trusted DNS | Configure Cloudflare (1.1.1.1) or Quad9 (9.9.9.9). |
| Turn Off Smart Multi-homed Resolution (Windows) | Prevent simultaneous DNS queries. |
| Flush DNS Cache | Clear outdated entries using Flush DNS Guide. |
Secure DNS Providers (for Leak Prevention)
| Provider | IPv4 | IPv6 | Features |
|---|---|---|---|
| Cloudflare | 1.1.1.1 / 1.0.0.1 |
2606:4700:4700::1111 |
Fast, privacy-first |
| Quad9 | 9.9.9.9 / 149.112.112.112 |
2620:fe::fe |
Security filtering |
| Google DNS | 8.8.8.8 / 8.8.4.4 |
2001:4860:4860::8888 |
Global reliability |
| AdGuard DNS | 94.140.14.14 / 94.140.15.15 |
2a10:50c0::ad1:ff |
Blocks ads & trackers |
See DNS Server List for more secure options.
How VPNs Handle DNS Requests
| VPN Behavior | DNS Routing | Example Providers |
|---|---|---|
| Private DNS Servers | Routes all queries internally | NordVPN, ProtonVPN |
| Split Tunneling | Some apps bypass VPN DNS | Windows built-in VPN |
| DoH / DoT Forwarding | Encrypts all DNS traffic | Cloudflare WARP, NextDNS |
Tip: Always choose VPNs that support DNS Leak Protection or Secure DNS over TLS.
DNS Leak Test for Browsers
Modern browsers support secure DNS settings independent of system DNS.
Chrome / Edge
- Go to
chrome://settings/securityoredge://settings/privacy. - Enable Use secure DNS → select Cloudflare or Google.
Firefox
- Go to
about:preferences#general. - Enable DNS over HTTPS (DoH).
- Choose Cloudflare or custom provider.
Test Again
After changing settings, re-run your DNS Leak Test to confirm.
DNS Leak Testing via Command Line (Advanced)
Linux
dig +short whoami.akamai.net @resolver1.opendns.com
If the returned IP = your VPN IP → no leak.
Windows
nslookup myip.opendns.com resolver1.opendns.com
macOS
scutil --dns | grep nameserver
FAQs
1. What does a DNS leak mean?
It means your DNS queries are going through your ISP instead of your VPN or secure DNS.
2. How can I check for a DNS leak?
Use an online DNS Leak Test tool or run nslookup to see which DNS server resolves queries.
3. Can DNS leaks expose my real location?
Yes — they reveal your ISP's DNS IP, which identifies your country or city.
4. Does DNS over HTTPS prevent leaks?
Yes, DoH encrypts DNS requests so ISPs or attackers can't intercept them.
5. Can I fix a DNS leak permanently?
Yes, by using a VPN with DNS leak protection, enabling DoH/DoT, disabling IPv6 if needed, and manually configuring trusted DNS servers.
Related Topics
Ready to Test for DNS Leaks?
Check if your VPN or network is leaking DNS requests. Test now to ensure your privacy is protected.