DNS Leak Test (Security)
See the network your DNS appears to run through. An honest best-effort check, plus exactly what a full DNS leak test needs to be conclusive.
Check your apparent network
We read the public network your connection appears to use — the strongest signal a browser can give about where your DNS goes.
What a DNS leak is — and why it's sneaky
Every site you open starts with a DNS lookup that translates the domain into an IP address. When you're on a VPN, those lookups are supposed to travel inside the encrypted tunnel. A DNS leak is when they don't: your device quietly asks your ISP's resolver instead. The page loads normally, the VPN app still shows “Connected”, and yet your ISP has a tidy log of everywhere you've been. It's the most common privacy gap precisely because nothing visibly breaks.
This page is deliberately honest about what a browser can and can't measure. It reads the public network your connection appears to use — a strong first signal — and then hands you off to a full, server-backed test for a definitive answer.
How to read this best-effort check
| What you see | What it hints at |
|---|---|
| A VPN/hosting owner | Your traffic exits via a VPN — a good sign, but confirm DNS with the full test. |
| Your home ISP | If you expected a VPN, your DNS is very likely leaking to that ISP. |
| Unknown | We couldn't read your network — try again, then use the full test. |
How to use this tool
- 1. Connect your VPN, if you use one.
- 2. Press Check now to read your apparent network.
- 3. If it shows your home ISP while a VPN is on, suspect a leak.
- 4. Confirm with the full DNS leak test and the WebRTC leak test.
Frequently asked questions
What is a DNS leak? +
A DNS leak happens when your device sends its DNS lookups — the requests that turn a domain name into an IP — outside your VPN tunnel, usually straight to your ISP. Your traffic may be encrypted, but your ISP still sees every site you visit. The VPN looks connected the whole time.
Can a browser fully detect a DNS leak? +
Not on its own. Reliable DNS leak detection needs server-side infrastructure: the test generates unique, random hostnames and watches which resolvers ask about them at the authoritative DNS server. A page can't see that directly, so this tool gives you the network context and points you to a full test.
What does this tool show me, then? +
It shows your apparent network — your public IP, the ISP or organisation that owns it, and its location. If that network is your home ISP while you expect a VPN, your DNS is very likely going through them too. It's a strong first signal.
How do I stop DNS leaks? +
Use a VPN that runs its own DNS inside the tunnel and has leak protection enabled, or set a private DNS resolver system-wide. A kill switch helps too, so nothing falls back to your ISP if the tunnel drops. Then confirm with a full unique-hostname DNS leak test.
Why is this tool beta? +
Because true DNS leak detection requires the unique-hostname infrastructure described above, which we're building. For now this page is an honest best-effort: it reads your visible network and explains the rest.
Closing the DNS gap
If your DNS is leaking, the fix is a VPN that runs its own resolver inside the tunnel and keeps a kill switch on, so lookups never fall back to your ISP. Privacy-focused providers and the security suites that bundle them make this the default rather than something you have to remember. Once you've switched it on, re-check here and run the full test to be sure it holds.
Some links on this site are affiliate links — we may earn a commission, at no extra cost to you. It never changes our verdicts or what the test reports.