A DNS leak occurs when your DNS queries — which translate domain names into IP addresses — are sent outside your VPN tunnel to your ISP's DNS servers instead of through your VPN. This means your ISP can see every website you visit even when you're connected to a VPN.

Is Your VPN Leaking? Run a Free DNS Leak Test

Instantly find out if your ISP is tracking your browsing history. This precise tool detects hidden DNS leaks to ensure your VPN is truly private.

Your DNS Leak Test Result

Checking...

Your test results are not stored on my server.

Understanding Your Test Result

Below you can see all possible statuses the DNS Leak test may display, ordered from best to worst protection.

Possible statuses (from best to worst protection)

No DNS leak	Your DNS queries go through your VPN, so your internet provider can't see which sites you visit.
No VPN detected	Standard browsing: your internet provider can see your DNS queries.
DNS servers detected	Found the DNS servers your browser uses, but your VPN status couldn't be verified. If the servers belong to your internet provider, your DNS isn't private.
Unable to check	DNS data couldn't be retrieved. Check your connection and refresh the page.
DNS leak detected	Your DNS queries go outside your VPN, so your internet provider or another resolver can see every site you visit.

What is a DNS Leak?

Every time you visit a website, your device sends a DNS query to translate the domain name (e.g., google.com) into an IP address. When using a VPN, these queries should travel through the VPN tunnel to the VPN provider's DNS servers — keeping your browsing private.

A DNS leak occurs when your DNS queries bypass the VPN tunnel and go directly to your ISP's DNS servers instead. This means your ISP — and anyone monitoring DNS traffic — can see every website you visit, even though you think you're protected by a VPN.

DNS leaks are one of the most common VPN failures. Your traffic is encrypted, but your browsing activity is still visible through DNS — a classic false sense of security.

How Does This Test Work?

This test identifies the DNS servers that actually resolve your browser's queries — the same method used by the most widely used DNS leak tests:

Your browser looks up several unique, randomly generated domain names. Because no one has looked them up before, each lookup has to travel through the DNS resolvers your device really uses — your ISP's, your VPN's, or your browser's secure DNS provider
A dedicated DNS test server (bash.ws) records the IP address of every resolver that asked, along with the network that operates it and its country
At the same time, your public IP address and VPN/Tor status are checked
If you are using a VPN, every resolver should belong to your VPN provider or to a public DNS service reached through the VPN tunnel — if any resolver belongs to your regular internet provider, your DNS is leaking
If you are not using a VPN, the result shows which DNS servers can see the websites you visit

Why Does a DNS Leak Happen?

VPN misconfiguration: Some VPN clients do not force DNS through the tunnel by default
IPv6 DNS: If your VPN only tunnels IPv4 traffic, IPv6 DNS queries can bypass it entirely
Windows DNS Smart Multi-Homing: Windows may send DNS queries to multiple servers simultaneously — including your ISP's — and use whichever responds first
Browser DNS-over-HTTPS (DoH): Some browsers use their own DNS resolver (e.g., Cloudflare) regardless of your VPN settings
Split-tunnel VPN: When split tunneling is enabled, DNS for certain apps may go outside the tunnel

How to Fix a DNS Leak?

Use a VPN with DNS leak protection: Most reputable VPNs (NordVPN, Mullvad, ProtonVPN) include built-in DNS leak protection that forces all DNS through the tunnel
Enable Kill Switch: A VPN kill switch blocks all traffic if the VPN drops — preventing DNS from falling back to your ISP
Disable IPv6 if your VPN doesn't support it: Unprotected IPv6 DNS is a common leak source
Set custom DNS manually: Configure your operating system to use a privacy-focused DNS server (e.g., 1.1.1.1 or 9.9.9.9) — though this does not guarantee protection without a proper VPN
Disable WebRTC in your browser: WebRTC can also expose your real IP independently of DNS (see the WebRTC Leak Test)

To check DNS, WebRTC and IPv6 leaks at once, along with whether your VPN hides your IP at all, run the VPN Test.

The Verdict: Protect Your DNS

DNS leaks silently expose your browsing to your ISP — even when you're connected to a VPN. The fix is simple: use a VPN that enforces DNS leak protection by default.

The VPNs below have been tested for DNS leak protection and passed. They route all DNS through their own servers and include a kill switch to prevent fallback.

View VPNs with DNS Leak Protection

Frequently Asked Questions

What is a DNS leak?

A DNS leak occurs when your DNS queries — the requests that translate domain names like "google.com" into IP addresses — are sent outside your VPN tunnel to your ISP's default DNS servers instead of through your VPN. This means your ISP can see every website you visit even when you're connected to a VPN, undermining the privacy protection the VPN is supposed to provide.

Why is a DNS leak a privacy problem?

Your DNS queries are a digital paper trail of your entire life online. Every site you visit — from health portals to banking and private forums — is visible if your DNS leaks. In the US, ISPs can legally package and sell this browsing history to advertisers since 2017. A DNS leak turns your "private" VPN connection into an open book for your ISP.

Can I have a DNS leak even with a VPN connected?

Yes — DNS leaks are common even with an active VPN connection. They occur when your operating system ignores the VPN's DNS settings and falls back to your system's default DNS (usually your ISP's). This can happen due to Windows Smart Multi-Homed Name Resolution, IPv6 queries bypassing the VPN tunnel (common with ISPs like Comcast or Spectrum, which aggressively push IPv6), or VPN software that doesn't properly override system DNS settings. A green "No DNS Leak" result from this test confirms your VPN is handling DNS correctly.

How do I fix a DNS leak?

The most reliable fix is to use a VPN with built-in DNS leak protection (NordVPN, ExpressVPN, and Mullvad all include this by default). You can also manually set your DNS servers to a privacy-focused option like Cloudflare (1.1.1.1) or Quad9 (9.9.9.9). On Windows, disabling Smart Multi-Homed Name Resolution via Group Policy helps. If using WireGuard, configure it to use DNS = 1.1.1.1 in your tunnel config. Also ensure your VPN client is updated to the latest version — providers frequently release patches to fix DNS routing issues on newer versions of Windows and macOS.

What is the difference between a standard and extended DNS leak test?

A standard DNS leak test makes a small number of DNS requests and checks which DNS resolver answered them. An extended test makes many more queries to increase the chance of catching intermittent leaks or leaks that only occur under load. For most users, a standard test is sufficient. Run an extended test if you suspect your VPN has inconsistent DNS routing or if you see different resolvers at different times.

Does iCloud Private Relay prevent DNS leaks?

Yes, but only partially. Apple's iCloud Private Relay (available to iCloud+ subscribers) encrypts your DNS queries and routes them through Apple's servers — but it only protects traffic within Safari. Other browsers, apps, games, and system-level connections on your device are not covered. For system-wide DNS leak protection across all apps and browsers, you still need a high-quality VPN with dedicated DNS leak protection.