DNS Leak Test
Understand DNS leaks and run a best-effort check of the resolver your browser reaches and the public IP it exposes.
Best-effort leak check
We run a live DNS-over-HTTPS query and show the public IP a major resolver sees for you. Read the note below on what this can and cannot prove.
Results will appear here.
Beta & honest limits: this runs over DNS-over-HTTPS, which bypasses your system resolver, so it cannot detect the leak your other apps might have. For a full test, use our Security DNS Leak Test.
What a DNS leak is
When you turn on a VPN, you expect everything — including the DNS lookups that translate site names into addresses — to travel through the encrypted tunnel. A DNS leak is when those lookups slip out to a different resolver, usually your ISP's. Your pages still load, so nothing looks wrong, but the resolver answering your queries can build a complete list of the domains you visit. That is why a "connected" VPN icon is not the same as being private: the tunnel can be up while your DNS quietly goes around it.
How to read this check
The check shows the public IP a major resolver observes for your connection and confirms that live resolution works from your browser. If that IP is your VPN's exit address, your browser's DNS-over-HTTPS path is going through the tunnel. The important caveat: because this tool uses DNS-over-HTTPS, it deliberately skips your operating system's resolver — so it cannot reveal a leak in your other apps. A proper leak test relies on unique, single-use hostnames on a server that records which resolver asked for them; you cannot reproduce that from JavaScript alone. Treat this as a quick sanity check, then confirm with the dedicated tool.
Frequently asked questions
What is a DNS leak?
A DNS leak happens when your device sends its DNS lookups to a resolver outside the private tunnel you expected — for example your ISP's resolver instead of your VPN's. The page still loads, but whoever answers those lookups can see every domain you visit.
Why does my VPN's green icon not prove I'm safe?
A connected indicator only means the tunnel is up. If your operating system keeps using its own resolver, your browsing destinations can still leak. That gap is exactly what a leak test is for.
Can a browser fully detect a DNS leak?
Not on its own — and we are honest about that. A browser-based check uses DNS-over-HTTPS, which bypasses your system resolver, so it cannot see the leak your applications would. A true test needs server-side infrastructure with unique hostnames that records which resolver actually queried it.
How do I fix a DNS leak?
Enable your VPN's built-in DNS leak protection and kill switch, turn off split tunnelling for DNS, and consider disabling IPv6 if your VPN does not handle it. Then re-test with a dedicated leak tool to confirm.
Disclosure: some VPN links in our guides are affiliate links. If you subscribe through them we may earn a commission, at no extra cost to you — and it never affects what these tools report. A leak is a leak regardless of which VPN you use.
Worried about more than DNS?
DNS is one way your identity leaks. Check the others too — the full DNS leak test and WebRTC leak test — or run the connection check-up to see the whole picture.