Is Your DNS Leaking to Your ISP?
Your VPN may be hiding your IP - but your DNS queries could still expose your real ISP and location. Test it now.
What is a DNS Leak?
When you use a VPN, your DNS queries should go through the VPN tunnel - not your regular ISP. A DNS leak happens when your device sends DNS requests outside the VPN, revealing your browsing activity to your ISP even though your IP is hidden.
How to fix a DNS leak
- Turn on your VPN app’s own DNS, or its “DNS leak protection”, so lookups go to its resolver inside the tunnel
- Remove any resolver you set by hand while on the VPN - a public one such as 1.1.1.1 sends your lookups to that network instead, and this test reports it as outside the tunnel
- Check your browser’s secure DNS (DNS-over-HTTPS) setting: it can send lookups past the resolver your VPN set
- On Windows, turn off “Smart Multi-Homed Name Resolution”
- Step by step, per operating system: how to fix a DNS leak
Why a DNS Leak Defeats the Point of a VPN
DNS is the internet’s address book. Before your browser can load a page it must convert a name such as example.com into an IP address, and it does that by asking a DNS resolver. That query contains the exact domain you are about to visit - which makes the resolver’s operator the single best-informed party about your browsing habits.
When a VPN is working correctly, those queries travel inside the tunnel and are answered by the provider’s resolver. When it leaks, they go to your ISP’s resolver instead, in plaintext, tagged with your subscriber account. The websites you contact still see only the VPN’s address, so nothing looks wrong - but your ISP retains a complete, timestamped list of every domain you visited, which can be the very record the VPN was bought to prevent.
In jurisdictions with mandatory data-retention laws, that list is retained by law and available on request. A DNS leak is therefore not a partial failure of a VPN; if your goal is privacy from your ISP, it is a total one.
How to Read Your Results
Expand the DNS row to see every resolver that answered. The organisation name is what matters - not the number of servers.
| What you see | Verdict |
|---|---|
| Resolvers in the same network as your VPN exit | Pass - DNS is inside the tunnel |
| Cloudflare, Quad9 or another resolver you configured yourself | Fail - outside the tunnel, even if deliberate: your lookups go to that operator |
| Your ISP’s name (Comcast, Deutsche Telekom, Rostelecom, …) | Leak - your ISP can log your browsing |
| A mix of VPN and ISP resolvers | Leak - partial leaks expose everything eventually |
Seeing several resolvers is normal - operating systems query multiple servers for redundancy. The test fails only when at least one of them is outside the tunnel, because a single leaking resolver is enough to reconstruct your history.
Encrypted DNS: DoH and DoT
Classic DNS travels unencrypted over port 53, so anyone on the path can read and modify it. Two protocols fix this: DNS-over-HTTPS (DoH) wraps queries in ordinary HTTPS traffic on port 443, making them indistinguishable from web browsing; DNS-over-TLS (DoT) uses a dedicated encrypted channel on port 853, which is cleaner to administer but trivially blockable.
Encrypted DNS solves eavesdropping, not trust. Your queries become unreadable to your ISP, but the resolver operator still sees every one of them - you are choosing who gets your browsing history rather than preventing anyone from having it. Choose a resolver whose logging policy you have actually read.
One practical warning: browser-level DoH can override your VPN’s resolver. Firefox and Chrome both ship with DoH enabled in some regions, which means the browser may bypass the tunnel’s DNS settings entirely. If this test shows a resolver you do not recognise while your VPN is connected, check your browser’s secure-DNS setting before blaming the VPN.
🧰 Related Leak Tests
The tests run in your browser. Where one needs to know whose network an address is on, our server looks it up and keeps no address. Nothing is stored unless you choose to share the result.
📚 Read next
The longer version: what this test is looking for, and what to do with the answer.
DNS Leak Test - FAQ
How DNS leaks happen, how to spot them in your results, and how to close them for good.
What is a DNS leak?
A DNS leak occurs when your device sends domain-name lookups to your ISP’s resolver instead of through your VPN tunnel. The websites you visit still see only your VPN’s IP address, so the connection appears private - but your ISP receives a complete list of every domain you requested, along with timestamps and your subscriber identity.
How do I know which DNS server I am using?
Run the test above and expand the DNS row. It lists every resolver that answered a lookup, together with the organisation that operates it. If any of them sits outside the network of your VPN exit - your ISP’s, or a public resolver you set yourself - the test reports a leak.
Why do DNS leaks happen on Windows?
One known cause is Smart Multi-Homed Name Resolution, which sends each lookup to every available network interface at once and uses whichever replies first, so your ISP’s resolver can receive it even when the VPN’s also answers. It can be disabled through Group Policy.
Is it normal to see more than one DNS server?
Yes. Operating systems query several resolvers for redundancy, so several entries are ordinary. What matters is who operates them. Several servers all in your VPN exit’s network is a pass; a single ISP resolver mixed in among them is a leak, because that one server is enough to reconstruct your browsing history.
Does DNS-over-HTTPS make me anonymous?
No. DoH encrypts queries in transit, which stops your ISP and anyone else on the network path from reading them. The resolver you send them to still sees every domain you look up. Encrypted DNS changes who holds your browsing history, not whether it exists - so the resolver’s logging policy matters more than the encryption.
Can my browser cause a DNS leak on its own?
It can. Firefox and Chrome enable DNS-over-HTTPS by default in some regions, and browser-level DoH can bypass the resolver your VPN configured for the system. If this test reports an unfamiliar resolver while your VPN is connected, check the secure-DNS setting in your browser before concluding the VPN is at fault.
Which DNS servers should I use?
Your VPN provider’s resolvers: they are inside the tunnel and need no configuration, and this test passes only resolvers in the same network as your VPN exit. A public resolver such as Cloudflare (1.1.1.1) or Quad9 (9.9.9.9) takes your lookups away from your ISP but sends them outside the tunnel, and this test reports that. Avoid resolvers that fund themselves by monetising query data.
I fixed the leak - do I need to re-test?
Yes, and specifically after reconnecting. DNS settings are applied when the tunnel comes up, so a change only takes effect on the next connection. Disconnect, reconnect, then run this test again. It is also worth re-testing after client updates and OS upgrades, two events that can silently revert DNS configuration.