A DNS leak happens when your device sends DNS queries through your ISP's resolver instead of the VPN tunnel — exposing every website you visit even though your traffic is encrypted.

How does this DNS leak test work?

We trigger DNS lookups for unique subdomains and ask an authoritative server which resolvers asked for them. The resolvers returned are the real DNS servers your device is using.

How do I fix a DNS leak?

Enable your VPN's built-in DNS leak protection, disable IPv6 if your VPN doesn't tunnel it, and turn off Windows' Smart Multi-Homed Name Resolution.

All Tools

DNS Leak Test

See which DNS servers your device is really using — and whether your VPN is leaking DNS to your ISP.

Connect your VPN before running the test

What is a DNS leak?

Every time you visit a website, your device asks a DNS server to translate the domain name into an IP address. A DNS leak happens when those queries bypass your VPN tunnel and go straight to your ISP's resolver — meaning your ISP (and anyone monitoring it) can still see every site you visit, even though your traffic is encrypted.

Why DNS leaks happen

IPv6 not tunneled — your VPN only routes IPv4, so IPv6 DNS queries leak.
Windows Smart Multi-Homed Name Resolution sends queries to every available interface in parallel.
Transparent DNS proxies at the ISP intercept port 53 regardless of which resolver you configure.
Misconfigured VPN client without built-in DNS leak protection.

How to fix a DNS leak

Enable your VPN's "DNS leak protection" or "block IPv6" option.
Manually set a public resolver like Cloudflare (1.1.1.1) or Quad9 (9.9.9.9).
Disable IPv6 on your network adapter if your VPN doesn't tunnel it.
On Windows, disable Smart Multi-Homed Name Resolution via Group Policy.