NetTools

DNS leak test

A VPN can hide your browsing traffic and still leave your DNS queries exposed: if your device keeps asking your ISP's DNS servers to resolve names, your ISP can see every site you visit even while the VPN is on. This test finds out which DNS servers your browser really uses by asking your resolver to look up fifty unique hostnames (25 IPv4-only, 25 IPv6-only) that only our test server can answer, then reporting which servers came asking.

How this test works

When the page loads (or you press Re-run), your browser tries to load fifty images from fifty hostnames that have never existed before, such as a random token plus a number under our test zone. Half of them answer only IPv4 queries and half only IPv6 queries, so the test also reveals whether IPv6 resolvers are in your path. Those names can only be resolved by our own authoritative test server, so whichever DNS servers show up asking for them are the servers your browser's lookups actually travel through — whether that is your system resolver, your VPN provider's resolver, or an encrypted DNS service your browser is configured to use. The images themselves do not load; only the DNS lookups matter, and they are the whole measurement.

Reading the results

The table lists every distinct DNS server observed during the test. If you are not using a VPN, expect to see your ISP's servers or a public resolver you configured — that is normal. If you are using a VPN, the servers listed should belong to your VPN provider. If they belong to your ISP instead, your DNS traffic is bypassing the VPN: that is a DNS leak, and your ISP can log the domains you visit even though your browsing itself is tunnelled. Multiple servers are normal — large resolvers answer from several addresses, and your device may query more than one resolver.

What this test does not do

This test observes the resolvers your browser uses at this moment, on this network, with this configuration. It cannot see DNS queries made by other apps on your device. The ISP and country shown for each server come from reverse DNS and a public IP database: usually right, but best effort, not a guarantee — a resolver run by a VPN provider may still show under its hosting company. Results can also vary between runs if your device switches networks or your VPN reconnects, so re-run the test after changing any DNS or VPN setting.

Data handling

Each test run generates a random token that exists only for that run. Our test server records, under that token, only the IP addresses of the DNS servers that queried it, plus a reverse hostname and ISP/country lookup for each address so the table can name the provider, and deletes the record automatically after ten minutes. No domain names you visit, no browsing history and no personal data are logged by this test.

Frequently asked questions

No DNS servers were detected. Is something broken?

Not necessarily. The lookups may have been blocked by your browser, an extension, or your network, or the answering servers may not have been reached in the time allowed. Try again, and if the result repeats, test with the VPN disconnected to compare.

Why do I see servers I do not recognise?

Public resolvers and VPN providers operate many addresses, and your device may fall back to a secondary resolver. Unfamiliar addresses are usually infrastructure, not intruders — but if you are on a VPN and none of the addresses belong to your provider, treat that as a leak.

Does this test work if my browser uses encrypted DNS?

Yes. Whether your browser resolves names through the system resolver or an encrypted DNS service, the queries still end up at our test server, and the servers that ask for them are what this test reports.

How is this different from the DNS lookup tool?

The DNS lookup tool asks a public resolver for the published records of a domain you name. This test does the reverse: it watches which servers resolve names on your behalf. One shows what DNS says, the other shows who your DNS is.

Related tools