DNS leak test
Find out which DNS servers answer your lookups and whether they belong to your VPN, a public resolver or your internet provider. The test uses unique hostnames under our own DNS zone, so every resolver that handles your queries has to reveal itself to our server.
Each hostname exists only on our nameserver; every resolver that asks for it is recorded.
Checking
| Resolver IP | Network / operator | Country | Type | Lookups | Transport | EDNS / DNSSEC | Client subnet |
|---|---|---|---|---|---|---|---|
| 203.0.113.53 | Example Telecom · AS64496 | Germany | type | 6 | udp | flags | prefix |
Why this verdict
- Each hostname exists only on our nameserver; every resolver that asks for it is recorded.
What the verdicts mean
- No leak
- Every resolver belongs to your VPN's network, is a public resolver reached through the tunnel, or — without a VPN — is simply your provider's.
- Possible leak
- A third-party resolver answered and we cannot tell whether it is your provider's (a leak) or your VPN's own DNS (fine). The operator name usually settles it.
- Leaking
- An ISP resolver outside the VPN handled your lookups, a public resolver forwarded your real network prefix, or the resolver seen before you connected the VPN is still answering.
- Review
- The verdict needs to know whether you are on a VPN. Pick an option above; the resolver list is re-evaluated without new lookups.
Run a DNS leak test
Press Start test. Your browser requests six unique hostnames (36 in the extended test) that exist only on our nameserver; we record which resolver asked for each one, look up its network and operator, and show the list within a few seconds. Tell the page whether you are on a VPN for a precise verdict — the same resolver list means different things with and without a tunnel.
Standard test
Six lookups. Enough to catch the common case where a VPN leaves the system resolver in place and every query goes to your ISP.
Extended test
Thirty-six lookups over a longer window, which also surfaces resolvers that only handle some of your queries — load-balanced ISP resolver pools, a second DNS server configured on the device, or Windows querying all interfaces at once.
Your DNS servers
Each row is one resolver that reached our nameserver on your behalf: its address, the network and operator it belongs to, its country and how many of the lookups it handled. The verdict compares these networks with the network your HTTP traffic comes from.
Resolver IP, ISP and country
A resolver in your VPN provider's network, or at the same address as your VPN exit, means DNS is inside the tunnel. A resolver in your home ISP's network while the VPN is on is a leak. A public resolver (Cloudflare, Google, Quad9 and others) is fine as long as the query reached it through the tunnel — which we can confirm when the resolver forwards your network prefix (EDNS Client Subnet) and it matches your VPN address.
Encrypted DNS (DoH/DoT) detected
If your browser or system uses DNS over HTTPS or DNS over TLS, our server sees the encrypted resolver's address (for example Cloudflare's or Google's), not your ISP's. Encryption hides the content of queries from your network; it does not by itself route them through a VPN, so the verdict still checks the network the query exited from.
What is a DNS leak?
Before your browser can connect to a website it asks a DNS resolver for the site's address. A VPN is supposed to carry those queries through the tunnel to the VPN's own resolver. When the operating system keeps sending them to the resolver it learned from your home network instead, your ISP still sees every domain you visit — and the website operator can tell your real location from the resolver's network — even though the connection itself is tunneled. That is a DNS leak. The guide what is a DNS leak goes into the mechanics.
How to fix a DNS leak
The fix is to make the device use the VPN's resolver, or a public resolver reached through the tunnel, and nothing else.
Windows
Turn on the VPN app's DNS leak protection. If leaks continue, open the adapter settings for your physical network connection and set the DNS servers manually to a public resolver, and disable Smart Multi-Homed Name Resolution (Group Policy › Administrative Templates › Network › DNS Client) so Windows stops querying every adapter in parallel. Flush the cache with ipconfig /flushdns and re-run the test.
macOS
Use the VPN app's DNS protection setting. Otherwise set DNS servers for the active network service in System Settings › Network › Details › DNS, or configure encrypted DNS (DoH/DoT) with a profile. Re-run the test; a resolver in the VPN's network or a public resolver with a matching prefix means the leak is closed.
Android and iPhone
Both systems support Private DNS (Android: Settings › Network › Private DNS; iOS via a configuration profile) which sends queries over TLS to the resolver you name. Combine it with the VPN app's leak protection. On iOS, the VPN app must include DNS settings in its configuration for queries to use the tunnel.
Router
If the VPN runs on the router, set the router's DNS servers to the VPN provider's resolvers and make sure the router does not hand out your ISP's resolvers to devices through DHCP. Run this test from any device behind the router to confirm.
DNS leak test with a VPN
Run the test once without the VPN and note the resolver's network — that is your baseline. Connect the VPN and run it again. If the same network appears, the leak is certain; the page remembers the baseline for a few minutes and marks it. If a public resolver appears both times, look at the EDNS Client Subnet column: with the VPN connected it must show the VPN's network, not your home prefix. The VPN test runs this together with the WebRTC and IPv6 checks.
Frequently asked questions
How bad is a DNS leak?
It undoes the privacy part of a VPN: your provider (or whoever runs the leaking resolver) still sees every domain you look up, and websites can infer your real location from the resolver's network. It does not expose your traffic content, which stays encrypted.
How do I check if I have a DNS leak?
Run this test with the VPN connected. If any resolver belongs to your internet provider, or a public resolver forwards your home network prefix, you have a DNS leak. Without a VPN, seeing your ISP's resolver is the normal, expected result.
How do I fix a DNS leak?
Force DNS through the tunnel: enable the VPN app's DNS leak protection, set a public resolver manually on the device, enable the kill switch and, on Windows, disable Smart Multi-Homed Name Resolution. The per-system steps are above.
Is DNS leak test legit?
This test is genuine in the sense that matters: the hostnames are unique per session and exist only on our authoritative nameserver, so the only way a resolver appears in your result is by actually asking our server. Nothing is inferred from your browser alone, nothing is stored beyond the ten-minute session, and the design is documented on the methodology page.
Is 8.8.8.8 the fastest DNS?
Not necessarily. 8.8.8.8 (Google) is fast from most places, but the fastest resolver for you is the one with the nearest server and a warm cache — often Cloudflare 1.1.1.1, Quad9 or your ISP's own. Our DNS speed test measures them from your location.
How do I check my DNS on my phone?
Open this page on the phone and run the test: the resolver list is what your phone actually uses, on Wi-Fi or mobile data. To see the configured value, check the network's details (Android: Private DNS setting; iOS: the Wi-Fi network's DNS section).
Is it a good idea to flush DNS cache?
Yes, it is harmless. Flushing removes cached answers so the next lookups go to the resolver again; it fixes stale records after a site moves and makes this test reflect the current configuration. Windows: ipconfig /flushdns; macOS: sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder.
Resolver addresses: our authoritative nameserver for dnstest.checkmyip.com; network and operator: CheckMyIP lookup service / iptoasn; nothing is stored beyond the ten-minute session.