DNS leak test
Your VPN can be connected, your IP hidden, and every domain you visit still going to your ISP. This finds out — by running our own nameserver and telling you exactly which resolvers came looking.
Free, no sign-up, nothing stored. Part of our VPN tool set · data from tests run September 4, 2026.
Connect your VPN before you run it. A test on an unprotected connection has nothing to leak from, and the tool will tell you so rather than showing you a meaningless pass.
- Connect your VPN first, then start the test
- Your device looks up names on our nameserver
- We show which resolvers answered, and who runs them
- Our own nameserver
- Sees every resolver
- Token dropped after 10 min
- Resolvers that answered
- —
- Country of each
- —
- Who operates them
- —
- Leak verdict
- —
Runs against our own nameserver, so it sees the resolver your device actually used.
Check where your DNS lookups actually go
Connect your VPN first, then run the test. It asks your device to look up a handful of one-time names on a domain we run the nameserver for, and reports which resolvers turned up to ask. Takes about ten seconds.
About this tool
A VPN moves your traffic through an encrypted tunnel, but before any of that can happen your device has to turn a name like example.com into an address. That lookup goes to a DNS resolver, and the resolver it goes to is decided by your operating system — not by the VPN, unless the VPN takes the trouble to override it. When it does not, you get the situation this page exists for: a working tunnel, a hidden IP, and your internet provider still holding a list of every domain you visited.
Why the browser cannot answer this on its own
Nothing in a web page can see which resolver handled a lookup. The only vantage point is the other end — the authoritative nameserver being asked. So this test gives your device a handful of names that have never existed before, on a domain we are authoritative for, and watches which resolvers arrive to ask about them. Those addresses are the answer. It is more machinery than a browser-side test like the WebRTC check needs, and it is the reason a real DNS leak test cannot be a static page.
What counts as a leak, and what does not
A resolver on a consumer ISP network appearing while you are connected is the finding that matters. Your provider is seeing your lookups and the tunnel is not stopping it. A public resolver — Cloudflare, Google, Quad9 — is a softer result: your ISP is out of the picture, but so is your VPN, and someone else is seeing the queries. A resolver in a different country from your exit server is, on its own, nothing. Anycast is normal. Tools that flag it teach people to ignore their leak tests, which is worse than not testing.
Fixing one
Turn on the VPN app's DNS leak protection and kill switch and run this again — that is the whole fix in most cases. Windows has a behaviour of its own worth knowing about, covered in the Windows 11 setup guide. If it still leaks after that, the implementation is at fault rather than your settings, and the five-check routine covers the other ways an address escapes a tunnel that looks fine. We ran 40 leak tests across the ten VPNs we rate — Windows, macOS, iOS and Android, kill switch on and off — and the results are in each review. The method is on the how we test page; we earn a commission if you buy through a link here and it plays no part in the scoring (disclosure).
Questions people ask
What is a DNS leak?
It is when your VPN carries your traffic but your device keeps asking your ISP's DNS resolver where each site lives. The tunnel works, your IP is hidden from the sites you visit, and your ISP still receives a list of every domain you look up — which is most of what people buy a VPN to prevent.
How does this test work?
Your browser is asked to look up several one-time names on a domain we run the authoritative nameserver for. Your device sends those lookups to whichever resolver it is configured to use, that resolver comes to our nameserver to ask, and we record its address. It is the only way to see which resolver you are using, because the browser itself cannot.
Is a resolver in another country a leak?
Usually not, and most leak tests get this wrong. Plenty of providers run anycast resolvers, so the address that reaches us can sit in a different country from your exit server without anything being wrong. The finding that matters is a resolver on a consumer ISP network turning up while you are connected — that is your ISP watching your lookups.
What if the resolvers are Cloudflare or Google?
That is not the classic leak — your ISP is not seeing your lookups — but your VPN is not handling your DNS either, so whoever runs those resolvers does. Some people set that up deliberately for speed or filtering. If you did not choose it, your VPN's DNS is being bypassed and turning on its DNS leak protection will bring it back inside the tunnel.
How do I fix a DNS leak?
Turn on the VPN app's DNS leak protection and its kill switch, then re-run this test — that clears most cases. On Windows, check that smart multi-homed name resolution is not sending lookups out of every adapter at once. If it still leaks after that, the provider's implementation is the problem rather than your settings.
Do you store any of this?
No. Each test uses a one-time token, results live in memory on the nameserver for a few minutes and are then dropped, and nothing is written to disk. That is also why the service needs no database — there is nothing to keep. Speed and leak figures elsewhere on the site come from our own monthly tests, last run 2026-09-04.
More free tools
- AI VPN finder (chat)Describe what you need in your own words and Emilia picks one, using our own test data. Ask follow-ups until you're sure.
- What is my IP address?See the IP, location and ISP every site you open can read right now — and whether a VPN is actually hiding them.
- WebRTC leak testYour browser can hand out your real IP behind a working VPN. This runs the check in your browser and tells you if yours does.
- VPN speed testMeasure your line, connect the VPN, measure again. The number that matters is how much of your speed survives — judged against the ten we test.
- VPN finderFive questions about how you'll actually use it, scored against our test data. One recommendation, one runner-up, and why.
- VPN price calculatorWhat a VPN really costs once the intro deal ends. Pick a term, see the total and the renewal for every VPN we rate.
- VPN server location pickerWhich country to connect to for what you're actually doing — and why the answer is the nearest server more often than you'd think.