Feature to look forVPN with its own DNS servers
Sends every lookup through the encrypted tunnel to the VPN’s resolvers, so your provider doesn’t get them.
Proton VPNAvailable soon
DNS leak test
Check whether your DNS lookups go through your VPN or to your internet provider. Free, about 5 seconds, nothing to install.
DNS leak test
Your connection
- Public IP address
- Checking…
- Location
- Checking…Approximate, from the IP address
- Network owner
- Checking…
Test type
Standard runs 6 lookups in about 5 seconds. Extended runs 36 lookups in about 20 seconds.
We see your IP address and the resolvers that answer, only to run this test. Nothing is written to disk, and each test is deleted from memory after 10 minutes. Privacy policy · IP Geolocation by DB-IP
VPNs with built-in DNS leak protection
Try the free steps under “How to fix a DNS leak” first: most leaks are a setting. If your VPN doesn’t offer these features, they’re what to look for.
We may earn a commission from links on this page. How this works
Feature to look forVPN with IPv6 leak protection
Tunnels or blocks IPv6, so lookups over IPv6 don’t slip around the VPN.
NordVPNAvailable soon
Feature to look forVPN with an always-on kill switch
Blocks the connection if the tunnel drops, so nothing falls back to your provider.
SurfsharkAvailable soon
How it works
Your device never tells a website which DNS resolver it uses, so we make it show us.
- 1Your browser looks up test namesIt loads a few addresses on our domain that have never existed before, such as 7f3a9c-1.t.dnsleakscan.com. Nothing is installed.
- 2Your resolver asks our serverNo resolver has these names cached, so whichever one your device uses has to ask our DNS server directly. We note its IP address.
- 3We compare networksWe look up who runs each resolver and compare it with who runs your public IP. A resolver on a different network, usually your internet provider, is a possible leak.
The test checks your browser’s DNS, including the browser’s own secure DNS if that is on. Other apps on your device may use different settings.
Worked example: a VPN user in Lisbon
They connect to a VPN server in Amsterdam and run the Standard test.
Public IP203.0.113.45 · the VPN provider's network, Netherlands
Answered by the VPN's resolver2 of 6 lookups
Answered by their home internet provider, Portugal4 of 6 lookups → Possible leak
After turning on “Use VPN DNS”6 of 6 from the VPN's resolver → Looks fine
The VPN was working the whole time. Only the name lookups were going outside it, and one setting fixed that.
How to fix a DNS leak
Most leaks come from a setting, not from the VPN itself. Try these in order, running the test again after each one.
- 1Use the VPN's own DNSIn the VPN app, turn on the option usually called “Use VPN DNS” or “Prevent DNS leaks”, and remove any custom DNS servers you entered there.
- 2Turn on leak protection and the kill switchThese stop lookups and traffic from falling back to your provider if the tunnel drops for a moment.
- 3Disable IPv6 if the VPN doesn't support itSome VPNs only tunnel IPv4, so IPv6 lookups go around them. If the VPN's help pages don't mention IPv6, turn it off in your network settings.
- 4Check your system and browser DNSA DNS server set by hand on your computer or router, or the browser's own “secure DNS” option, can bypass the VPN. Set them to automatic while the VPN is on.
Still leaking after all four? The VPN may not route DNS at all. That's when the features listed under the test result are worth comparing.
Frequently asked questions
What is a DNS leak?
Every time you open a site, your device asks a DNS resolver for its address. With a VPN on, those questions should go through the VPN. A leak is when they go to your internet provider’s resolver instead, so the provider can see the names of the sites you visit.
Does a leak mean my VPN is useless?
No. Your traffic is still encrypted and websites still see the VPN’s IP address. A leak shows your provider the names you look up, not what you do on those sites. It’s worth fixing, and usually takes one setting.
What’s a resolver?
The server that turns names like example.com into IP addresses. It’s usually run by your internet provider, your VPN, or a public service.
Why do I see Cloudflare or Google in the results?
Some VPNs, browsers and routers send lookups to public resolvers such as Cloudflare, Google or Quad9. That isn’t a leak to your provider, so the verdict can still be “Looks fine”, but that company does see the lookups.
Does this test work without a VPN?
Yes. Without a VPN you’ll usually see your provider’s resolvers on the same network as your IP, so the verdict is “Looks fine”: there’s nothing to leak around. The test is most useful with the VPN switched on.
Why does it say “Possible leak” when my VPN’s DNS is on?
The test compares networks. Some VPNs run their DNS servers on a different hosting network from the server you connect through, and that looks the same as a leak from here. If the resolver’s owner in the table is a hosting company rather than your internet provider, check the VPN’s help pages for its DNS servers before changing anything.
What does the test check, exactly?
It sees the IP address of the resolver that finally asks our server, and compares its network with the network of your IP address. It tests your browser’s DNS, including the browser’s own secure DNS if that is on, not every app on your device. It can’t see the route between your device and the resolver.
Do you store my data?
Your IP address and the resolver addresses are held in memory only while the test runs, and each test is deleted after 10 minutes, or as soon as you cancel. Nothing is written to disk, linked to an account or sold. The privacy policy lists everything.