DNS Leak Test
Find out if your DNS queries are sneaking out of your VPN tunnel and being seen by your ISP. The same run checks your IP, WebRTC and IPv6 for leaks too.
DNS leaks: the silent way VPNs fail
Quick version: HTTPS hides what's inside a website connection. DNS reveals which website you opened in the first place. If your DNS leaks, your ISP knows every site you visited - even if the actual page traffic was encrypted through a VPN.
VPN leak test: what one run checks
The widget above is a full VPN leak test, not only a DNS one. With your VPN connected, one run checks the four ways your real identity can slip past the tunnel:
- IP address - which IP and network websites see, and whether it looks like a VPN. This is the IP leak test in the plain sense: if it shows your ISP, the VPN is not carrying your traffic at all.
- DNS - which resolver looks up the sites you open, and whether it belongs to your VPN or to your ISP.
- WebRTC - whether the browser hands your real IP to the page. More in the WebRTC leak test.
- IPv6 - whether IPv6 traffic goes around a tunnel that only covers IPv4. More in the IPv6 leak test.
If no VPN is detected, the three leak checks are skipped: without a tunnel there is nothing to leak around. Turn the VPN on and run the test again.
What DNS does and why it matters
DNS - the Domain Name System - is the phone book of the internet. Every time you type nytimes.com, your computer asks a DNS server "what IP address goes with this name?" and the server replies with something like 151.101.193.164. Your browser then opens an HTTPS connection to that IP. The page contents are encrypted; your ISP can't read them.
But your ISP CAN see the original DNS question - "what's the IP for nytimes.com?" - because by default DNS is unencrypted UDP traffic on port 53. So even with HTTPS everywhere, your ISP can build a complete log of every site you visited just by watching DNS.
A VPN is supposed to fix this by routing DNS through the encrypted tunnel and answering the queries with the VPN provider's own DNS server. The ISP only sees encrypted traffic to the VPN's IP - no more domain logs.
Where DNS leaks come from
Multi-homed name resolution (Windows)
Windows tries to be clever. When you have multiple network interfaces (your Wi-Fi and your VPN's virtual adapter), Windows sends DNS queries out both simultaneously and uses whichever responds first. This is documented as "smart multi-homed name resolution". The VPN tunnel sees the query - good - but so does your ISP - bad.
The fix is a registry entry or Group Policy setting that disables this behavior. Reputable VPN clients do this for you on install. Free or sketchy VPNs often don't.
IPv6 fallback
If your VPN only routes IPv4 and your ISP supports IPv6, DNS-over-IPv6 queries go around the tunnel entirely. We test for this directly in the IPv6 leak row.
Hard-coded DNS in apps
Some apps - notably anti-virus, cloud-storage clients, and a few smart-home integrations - hard-code a DNS server (often 8.8.8.8) into the app rather than asking the OS. These queries can bypass the VPN tunnel even with everything else configured correctly. There's no clean fix short of blocking the app at the firewall.
Captive portal hijacks
Coffee-shop and hotel Wi-Fi often runs a "captive portal" that intercepts all DNS until you log in. If your VPN connects after the portal authenticates, fine. If something goes wrong and the captive portal's DNS handler stays active in the OS, you'll keep leaking until you reboot the network.
How our DNS leak check works
A browser cannot see which resolver your system uses, so a strict DNS leak test - the kind dnsleaktest.com runs, and the one above - watches from the other end:
- The page makes up three random names under our test zone (something like
3f9a1c07b2e4d856.dnscheck.isvpnworking.com) - The browser asks the OS to resolve them; the OS hands them to whatever resolver it uses
- No resolver has those names cached, so it must ask the authoritative server for
dnscheck.isvpnworking.com- which is ours - Our nameserver records the IP that asked - that's the resolver that actually handled your lookups
- The page asks us who came, and we compare that resolver's network with your VPN exit
Same network as your VPN: Safe. A well-known public resolver (Google, Cloudflare, Quad9) or a hosting network we cannot attribute: Public DNS - your ISP did not see the lookups, but your VPN did not serve them either. Anything else, usually your ISP: Leak, and one leak decides the run. Three names rather than one, because a machine with several resolvers only gives that away under several queries. If the probe is blocked or nothing arrives within four seconds, the card says Unable.
The honest limit: we see the last resolver in the chain, the one that reached us, not the address configured on your machine. If your resolver forwards to another, we see the far end.
Reading the results
Whichever DNS leak test you run - ours or an extended one that lists every server - here's how to read it:
- Multiple DNS servers from your VPN provider - safe, you're tunneling correctly
- Cloudflare/Google DNS only - probably safe; many VPNs use these as upstream resolvers
- One ISP-named server (Comcast, Verizon, etc.) - leaking, full stop
- Mix of VPN and ISP servers - intermittent leak, often Windows multi-homed resolution
- Servers in your home country when your VPN says you're abroad - DNS leak, even if the names don't match your ISP
How to fix a DNS leak
If the DNS leak check above says Leak, work through these in order and re-run the test after each step:
- Let the VPN app handle DNS. Remove any custom DNS server in the VPN app and turn on its DNS leak protection if it has a switch for it. The app's own resolver lives inside the tunnel.
- Close the IPv6 gap. If the VPN does not tunnel IPv6, turn on its IPv6 leak protection or disable IPv6 on the adapter. Check with the IPv6 leak test.
- Windows: turn off smart multi-homed name resolution. Group Policy -> Computer Configuration -> Administrative Templates -> Network -> DNS Client -> "Turn off smart multi-homed name resolution" -> Enabled. Up-to-date clients from reputable providers already do this.
- Check the browser's Secure DNS. Chrome, Edge and Firefox can send lookups over DNS over HTTPS to a fixed provider, around the VPN's resolver. That reads as Public DNS, not Leak - turn it off while on the VPN if you want the VPN to answer.
- Hand-made WireGuard or OpenVPN profiles: add a
DNS =line to the WireGuard config; for OpenVPN on Windows push a DNS server and addblock-outside-dns. - Still leaking? Turn on the kill switch, try another protocol, and if nothing helps, switch providers.
Bottom line
DNS leaks are sneaky because everything looks fine from the user's perspective - the VPN is connected, websites think you're in the right country, HTTPS is green. But your ISP is still building a list of every domain you visit. Use a reputable VPN that handles DNS internally, run a strict test once on each new device, and you're done.
Frequently asked
What exactly leaks during a DNS leak?+
Every time you visit a website, your computer first asks a DNS server 'what's the IP address for this domain?'. If your VPN is configured properly, that question travels through the encrypted tunnel and is answered by the VPN's DNS server. If something goes wrong, the question goes to your ISP's DNS server unencrypted. Your ISP doesn't see the page contents (HTTPS protects that), but it sees every domain you visit - and that's enough to build a profile of your browsing.
Why does Windows leak DNS more than other systems?+
Windows has a 'feature' called smart multi-homed name resolution that sends DNS queries simultaneously out every active network interface, supposedly for speed. Your VPN tunnel gets the question, but so does your ISP. Killing this requires either registry edits, a Group Policy change, or - cleanest - a VPN client that disables it for you. NordVPN, ExpressVPN, ProtonVPN and Mullvad all handle this on Windows.
How do I run a DNS leak test manually?+
The classic approach is to visit dnsleaktest.com or our tool, run the standard test, and check whether the listed DNS servers belong to your VPN provider or your ISP. If you see Comcast, Verizon, AT&T, Deutsche Telekom or any consumer ISP name in the DNS results - you're leaking. If you see Cloudflare, Google, or a name like 'NordVPN DNS' - you're fine. The 'extended' test on dnsleaktest.com hammers many DNS servers in parallel and can catch leaks that a single query misses.
What's a 'transparent DNS proxy' leak?+
Some ISPs (especially in restrictive countries or budget mobile networks) intercept all outbound port-53 DNS traffic and redirect it to their own server, even if you specified a different DNS in your settings. Your VPN tunnel can mask this if it's configured to use port 53 only inside the tunnel - but if any query escapes the tunnel, the ISP grabs it. Solution: VPN with built-in DNS over the encrypted channel (any reputable provider) and DoH/DoT enabled in the browser as backup.
Is DoH (DNS over HTTPS) the same as VPN DNS?+
No. DoH encrypts your DNS queries between your browser and the DNS resolver (typically Cloudflare 1.1.1.1 or Google 8.8.8.8). That's good - your ISP can't see the queries. But DoH does NOT hide your IP from websites, and the DoH provider sees every domain you query. A VPN hides both your IP and your DNS lookups (assuming the VPN is configured to handle DNS internally). DoH is a partial solution; a VPN with built-in DNS is a full one.
Does NordVPN pass a DNS leak test?+
It should. NordVPN's apps send DNS through the tunnel to Nord's own resolvers by default, so with the app connected a DNS leak test normally shows no ISP resolver. When it fails, the cause is usually a setting rather than the VPN: a custom DNS server in the app, DNS forced by the router or Windows, or the browser's Secure DNS (DoH) pointed at Cloudflare or Google - not a leak to your ISP, but your lookups are not answered by the VPN either. Connect NordVPN and run the test above. Safe means the lookups came from the same network as your VPN exit; Leak names the resolver that saw them. Nord rents servers in many data centres, so the card can also read Public DNS when its resolver sits on a hosting network we cannot tie to Nord.
Which VPNs pass a DNS leak test?+
Any reputable paid VPN passes in its default setup - NordVPN, ExpressVPN, Surfshark, ProtonVPN and Mullvad all run their own DNS inside the tunnel. Failures depend less on the brand than on the setup: a free VPN, an old client on Windows, a hand-made WireGuard or OpenVPN profile without a DNS line, or an IPv6 route the VPN does not cover. That is why the test is worth running on every device and after client updates, not once per provider.
What does our DNS test actually see?+
We give your browser a name that exists nowhere else - a random token in front of a subdomain served by our own nameserver - and ask it to look that name up. Your machine cannot answer it locally, so the question travels to whichever resolver your system uses, and that resolver comes to us. We record the address it came from and tell you who owns it. What this shows is the last resolver in the chain, the one that reached us, and not the address configured in your operating system: if your resolver forwards to another, we see the far end. That is why a lookup answered from Google or Cloudflare is reported as a public resolver rather than as a pass or a fail. Your ISP did not see it, but your VPN did not serve it either, and from the outside those two cases look the same.