DNS Leak Test: How to Check and Fix DNS Leaks

What is a DNS leak?

Every visit to a website starts with a DNS lookup that turns a name like example.com into an IP address. Normally your internet provider's DNS server answers. With a VPN, those lookups should travel through the encrypted tunnel to the VPN's own DNS server.

A DNS leak happens when lookups go to your provider's DNS server outside the tunnel. Websites still see the VPN's IP, but your provider can see every domain you visit, and its DNS filtering or blocking still applies.

How a DNS leak test works

A browser can't report which DNS server it uses. A leak test therefore makes your browser look up several unique, random hostnames on a domain whose DNS server the tester runs. That server records which resolver IP addresses asked for them. If those resolvers belong to your internet provider while your VPN is connected, your DNS is leaking.

The test above does exactly that: it lists each resolver with its provider, network and country, and compares them with the IP websites see. Test names and resolver IPs are deleted after 10 minutes.

Check your DNS server manually

Run one of these commands in Terminal (macOS, Linux) or Command Prompt (Windows, nslookup only). Each asks a public service to tell you the IP address of the DNS resolver that contacted it:

nslookup -type=txt o-o.myaddr.l.google.com
dig +short TXT o-o.myaddr.l.google.com
dig +short whoami.akamai.net

How to read the result

Look up who owns the returned address with any WHOIS or IP lookup service.
If it belongs to your internet provider while the VPN is connected, your DNS is leaking.
If it belongs to your VPN provider, or to a resolver you chose such as Cloudflare (1.1.1.1) or Google (8.8.8.8), there is no leak to your provider.
These commands test your operating system's DNS. If your browser has "Secure DNS" (DNS over HTTPS) turned on, the browser sends its lookups to that provider instead.

How to fix a DNS leak

Turn on your VPN app's DNS leak protection (sometimes called "use VPN DNS") and its kill switch.
Make sure the VPN also handles IPv6, or turn IPv6 off on your network adapter. IPv6 lookups can bypass IPv4-only VPNs.
Turn on encrypted DNS: "Secure DNS" in Chrome, Edge or Brave, or "DNS over HTTPS" in Firefox, using your VPN's resolver or a provider you trust.
Check that your router or a manually set network DNS isn't overriding the VPN's settings, then test again.

Frequently asked questions

›Why does the test find several DNS servers?

Large DNS services such as Google, Cloudflare and most ISPs run pools of servers, so different lookups can come from different addresses. What matters is which network they belong to.

›Is a DNS leak the same as an IP leak?

No. With a DNS leak, websites still see your VPN's IP, but your internet provider (or whoever runs the leaking resolver) can see which domains you look up.

›Does HTTPS prevent DNS leaks?

No. HTTPS encrypts the page content, but classic DNS lookups are sent unencrypted before the connection starts. Encrypted DNS (DNS over HTTPS or TLS) fixes that part.

›Can I have a DNS leak without a VPN?

Without a VPN, your lookups are expected to go to your provider's DNS server or one you chose, so it isn't a leak. The term matters when you use a VPN or proxy.

›Does private or incognito mode stop DNS leaks?

No. Private windows use the same DNS settings as normal windows.

›The test found no DNS servers. Why?

An ad or content blocker can stop the random test requests before your browser looks them up. Pause it for this site and run the test again.

DNS leak test