What Is a DNS Leak?
Every time you open a website, your device first asks a DNS server to turn the name (example.com) into an IP address. Whoever runs that server can see every domain you look up.
A VPN is supposed to send those lookups through its encrypted tunnel to DNS servers it controls. A DNS leak happens when they go somewhere else, usually straight to your internet provider. Your traffic is hidden, but your ISP still gets a list of every site you visit, and the VPN's privacy promise quietly breaks.
How This DNS Leak Test Works
The test asks your browser to load names like 3-k2v9x0m4q7r1t8zw.leak.dnsrobot.net. Nobody has looked them up before, so no cache can answer: your DNS server has to ask our nameserver.
We run the nameserver for leak.dnsrobot.net. Each lookup arrives from the DNS server that's really doing your browsing lookups, so we record its IP address.
Every server's IP is matched to its network (ASN), operator and country, then compared with the network of your own IP address.
If the servers belong to your VPN, or to a DNS service you chose, there's no leak. If your own internet provider shows up while you're on a VPN, your DNS is leaking.
Advertisement
What Your Result Means
Every DNS server belongs to the same network as your IP address. On a VPN, your lookups travel through the tunnel. Without a VPN, they go to your ISP, as expected.
Your lookups go to Cloudflare, Google, Quad9 or another public DNS service. That's fine if you or your VPN chose it. If you didn't, a browser setting or app may be bypassing your VPN's DNS.
At least one server sits in a network unrelated to your IP. On a VPN, look for your own ISP's name in the list: if it's there, your VPN is leaking DNS.
Your browser never looked up the test names, usually because an ad blocker, firewall or filtering DNS blocks unknown domains. Allow the page and test again.
Standard or Extended DNS Leak Test?
The standard test sends 6 lookups and takes a few seconds. It's enough to see which provider handles your DNS.
The extended test sends 36 lookups in six rounds. Large providers answer from pools of many servers, and some leaks only show up now and then, for example when Windows sends the same question to every network adapter at once. Run the extended test before you trust a VPN with anything sensitive.
Advertisement
What Causes a DNS Leak?
The VPN doesn't handle DNS. Some VPN apps, and many manual OpenVPN or WireGuard setups, connect the tunnel but leave your system's DNS settings pointing at your router or ISP.
Windows asks every adapter. Since Windows 8, smart multi-homed name resolution sends each lookup to the DNS servers of all network adapters at once and takes the fastest answer, which can be your ISP's.
IPv6 outside the tunnel. If your VPN only tunnels IPv4, lookups sent over IPv6 can reach your ISP's resolver directly. Check with our IPv6 test while connected.
Browser secure DNS. Chrome, Edge and Firefox can send lookups over DNS over HTTPS to Cloudflare, Google or another provider, ignoring the VPN's DNS servers.
DNS set on the router or by hand. A fixed DNS server in your router or network settings can override the VPN, depending on how the VPN app works.
Transparent DNS proxies. Some ISPs intercept every DNS request on port 53 and answer it themselves, even when you picked another DNS server.
How to Fix a DNS Leak
Turn on your VPN's DNS leak protection and its kill switch. Most good VPN apps have both; make sure the app uses its own DNS servers, then run the test again.
Windows Pro and Enterprise: open
gpedit.msc→ Computer Configuration → Administrative Templates → Network → DNS Client, and enable Turn off smart multi-homed name resolution. On Windows Home, set the DWORDDisableSmartNameResolutionto1underHKLM\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient.Disable Teredo if you don't need it: run
netsh interface teredo set state disabledin an administrator command prompt.Fix IPv6: use a VPN that tunnels IPv6, or turn IPv6 off on the network adapter while you're connected.
Check your browser's secure DNS: in Chrome go to Settings → Privacy and security → Security → Use secure DNS; in Firefox, Settings → Privacy & Security → DNS over HTTPS. Turn it off, or point it at your VPN's resolver, if you want the VPN to handle DNS.
Flush the DNS cache after any change so old answers don't linger: see how to flush DNS on Windows, macOS, Linux and browsers.
Advertisement
Test Your DNS Server From the Command Line
You can also check which DNS server your computer uses without a browser. Our nameserver answers the special name whoami.leak.dnsrobot.net with the IP address of the server that asked for it:
dig +short TXT whoami.leak.dnsrobot.netnslookup -type=TXT whoami.leak.dnsrobot.netWhy Do I See Servers I Don't Recognize?
We see the server that contacted our nameserver, which is the last one in the chain. If your router or a local resolver forwards lookups upstream, the result shows the upstream provider, not your router.
Big public resolvers use anycast: Cloudflare, Google and Quad9 answer from data centers close to you, and one lookup can be served by a machine in a neighbouring country. A server in an unexpected country isn't a leak by itself. What matters is who runs it.
Advertisement
DNS Leaks, WebRTC Leaks and IPv6 Leaks
A VPN can reveal you in three main ways, and each one needs its own test:
Your lookups reach a DNS server outside the VPN, usually your ISP's, revealing every domain you visit.
The browser reveals your real IP through WebRTC. Check it with our WebRTC leak test.
IPv6 traffic bypasses a VPN that only tunnels IPv4. Check it with our IPv6 test while connected.
More Privacy and DNS Tools
More free tools to see what your connection reveals and how your DNS performs: