DNS Leak Test
$ dnsleakA free, in-browser DNS leak test that probes your live connection to find every resolver answering for your device. We compare the resolver IPs, ISPs, ASNs, and countries — if any sit outside your VPN's exit, your DNS path is leaking and your real ISP can still see the domains you visit.
What is a DNS leak?
A DNS leak happens when your device sends DNS queries outside the VPN tunnel — usually to your ISP's default resolver — even though the rest of your traffic is routed through the VPN. The result: your VPN hides your IP from the websites you visit, but your ISP (and anyone else watching the network) still sees the full list of domains you request. A working VPN should send DNS queries through its own resolvers; a leak defeats one of the main reasons to run a VPN in the first place.
How this DNS leak checker works
When you press Run, this DNS leak checker fires six probes to uniquely-named subdomains and records the resolver IP that asks to look each one up. We enrich every resolver with its ISP, organisation, ASN, and geographic origin from a public IP intelligence database. Four checks run on the collected resolvers: single resolver path, ISP isolation, country consistency, and ASN consistency. Any divergence indicates that part of your DNS traffic is escaping the VPN tunnel.
How to test for DNS leaks
- Connect to your VPN — make sure the kill switch (sometimes called "Network Lock" or "Always-on") is on.
- Press Run DNS leak test above. The probes complete in a few seconds.
- Review the verdict. Privacy score 4/4 means every check passed. Anything lower means at least one resolver is answering from outside your VPN.
- If the test fails, enable your VPN's built-in DNS leak protection, block IPv6 at the OS level, or hard-code your VPN's DNS servers system-wide. Then re-run the test.
What this DNS leak tester checks for
- Single resolver path — every probe should be answered by the same resolver. Multiple resolver IPs is the clearest signal of a leak.
- ISP isolation — every resolver should belong to a single network operator. If your home ISP shows up alongside your VPN provider, queries are being answered outside the tunnel.
- Country consistency— resolvers should all be located in your VPN's exit country. A mismatched country means a resolver request travelled across borders the VPN wasn't supposed to expose.
- ASN consistency — every resolver should share an Autonomous System Number with your VPN provider. Mixed ASNs almost always indicate a partial leak.
Free DNS leak checker — no install, no account
This DNS leak tester runs entirely in your browser. There's no software to install, no sign-up, and we don't log the results. The probes use uniquely-named subdomains so caching never hides a leak; each test sees the live resolver path your device is using right now. Run the test once with your VPN off and once with it on — the difference will tell you whether DNS leak protection is working. For a complete privacy snapshot, pair this DNS leak checker with our browser fingerprint test and IP address checker.