Is Your DNS Leaking to Your ISP?
Your VPN may be hiding your IP - but your DNS queries could still expose your real ISP and location. Test it now.
What is a DNS Leak?
When you use a VPN, your DNS queries should go through the VPN tunnel - not your regular ISP. A DNS leak happens when your device sends DNS requests outside the VPN, revealing your browsing activity to your ISP even though your IP is hidden.
How to fix a DNS leak
- Use a VPN with built-in DNS leak protection (NordVPN, Mullvad, ProtonVPN)
- Enable "DNS leak protection" in your VPN settings
- Use encrypted DNS: DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT)
- Set manual DNS: Cloudflare (1.1.1.1) or Quad9 (9.9.9.9)
Why a DNS Leak Defeats the Point of a VPN
DNS is the internet’s address book. Before your browser can load a page it must convert a name such as example.com into an IP address, and it does that by asking a DNS resolver. That query contains the exact domain you are about to visit - which makes the resolver’s operator the single best-informed party about your browsing habits.
When a VPN is working correctly, those queries travel inside the tunnel and are answered by the provider’s resolver. When it leaks, they go to your ISP’s resolver instead, in plaintext, tagged with your subscriber account. The websites you contact still see only the VPN’s address, so nothing looks wrong - but your ISP retains a complete, timestamped list of every domain you visited, which is usually the precise record the VPN was bought to prevent.
In jurisdictions with mandatory data-retention laws, that list is retained by law and available on request. A DNS leak is therefore not a partial failure of a VPN; for the most common threat model - keeping your browsing private from your ISP - it is a total one.
How to Read Your Results
Expand the DNS row to see every resolver that answered. The organisation name is what matters - not the number of servers.
| What you see | Verdict |
|---|---|
| Resolvers belonging to your VPN provider | Pass - DNS is inside the tunnel |
| Cloudflare, Quad9 or another resolver you configured yourself | Pass - provided this was deliberate |
| Your ISP’s name (Comcast, Deutsche Telekom, Rostelecom, …) | Leak - your ISP is logging your browsing |
| A mix of VPN and ISP resolvers | Leak - partial leaks expose everything eventually |
| Resolvers in a country you did not select | Investigate - often a misconfigured router |
Seeing several resolvers is normal - operating systems query multiple servers for redundancy. The test fails only when at least one of them is outside the tunnel, because a single leaking resolver is enough to reconstruct your history.
Encrypted DNS: DoH and DoT
Classic DNS travels unencrypted over port 53, so anyone on the path can read and modify it. Two protocols fix this: DNS-over-HTTPS (DoH) wraps queries in ordinary HTTPS traffic on port 443, making them indistinguishable from web browsing; DNS-over-TLS (DoT) uses a dedicated encrypted channel on port 853, which is cleaner to administer but trivially blockable.
Encrypted DNS solves eavesdropping, not trust. Your queries become unreadable to your ISP, but the resolver operator still sees every one of them - you are choosing who gets your browsing history rather than preventing anyone from having it. Choose a resolver whose logging policy you have actually read.
One practical warning: browser-level DoH can override your VPN’s resolver. Firefox and Chrome both ship with DoH enabled in some regions, which means the browser may bypass the tunnel’s DNS settings entirely. If this test shows a resolver you do not recognise while your VPN is connected, check your browser’s secure-DNS setting before blaming the VPN. You can inspect any domain’s records directly with our DNS checker.
🧰 Related Leak Tests
Every test runs entirely in your browser - nothing is stored unless you choose to share the result.
DNS Leak Test - FAQ
How DNS leaks happen, how to spot them in your results, and how to close them for good.
What is a DNS leak?
A DNS leak occurs when your device sends domain-name lookups to your ISP’s resolver instead of through your VPN tunnel. The websites you visit still see only your VPN’s IP address, so the connection appears private - but your ISP receives a complete list of every domain you requested, along with timestamps and your subscriber identity.
How do I know which DNS server I am using?
Run the test above and expand the DNS row. It lists every resolver that answered a lookup, together with the organisation that operates it. If any of those names belongs to your ISP rather than your VPN provider or a resolver you deliberately configured, you have a leak.
Why does Windows leak DNS more than other systems?
Because of a feature called Smart Multi-Homed Name Resolution, which sends each lookup to every available network interface simultaneously and uses whichever replies first. That is good for speed and disastrous for privacy: your ISP’s resolver receives the query even when the VPN’s resolver also answers. It can be disabled through Group Policy, and most reputable VPN clients now handle it automatically.
Is it normal to see more than one DNS server?
Yes. Operating systems query several resolvers for redundancy, so two to four entries is entirely ordinary. What matters is who operates them. Several servers all belonging to your VPN provider is a pass; a single ISP resolver mixed in among them is a leak, because that one server is enough to reconstruct your browsing history.
Does DNS-over-HTTPS make me anonymous?
No. DoH encrypts queries in transit, which stops your ISP and anyone else on the network path from reading them. The resolver you send them to still sees every domain you look up. Encrypted DNS changes who holds your browsing history, not whether it exists - so the resolver’s logging policy matters more than the encryption.
Can my browser cause a DNS leak on its own?
It can. Firefox and Chrome enable DNS-over-HTTPS by default in some regions, and browser-level DoH can bypass the resolver your VPN configured for the system. If this test reports an unfamiliar resolver while your VPN is connected, check the secure-DNS setting in your browser before concluding the VPN is at fault.
Which DNS servers should I use?
The simplest correct answer is your VPN provider’s resolvers, since they are already inside the tunnel and require no configuration. If you prefer to choose your own, Cloudflare (1.1.1.1) is the fastest widely available option and Quad9 (9.9.9.9) adds malware-domain blocking. Avoid your ISP’s default resolvers, and avoid free resolvers that fund themselves by monetising query data.
I fixed the leak - do I need to re-test?
Yes, and specifically after reconnecting. DNS settings are applied when the tunnel comes up, so a change only takes effect on the next connection. Disconnect, reconnect, then run this test again. It is also worth re-testing after client updates and OS upgrades, which are the two events that most often silently revert DNS configuration.