Every site you open begins with a DNS lookup, the step that turns a domain name into an address your device can reach. When a VPN is connected, that lookup should travel inside the tunnel and be answered by the VPN's own resolver. A DNS leak is when it escapes and goes to your access provider instead.
The traffic itself stays encrypted, so nothing looks wrong on the surface. What leaks is the list. Your provider ends up with a record of every site you visited, even with the VPN running.
Why a DNS leak is hard to spot
A DNS leak cannot be detected from inside your browser. The browser never gets to watch which resolver handled its lookup, so any test running purely in the page is making an educated guess. That is why plenty of people run a VPN for months without realising their DNS was leaking the whole time.
A reliable test has to work from the outside. Instead of asking the browser what it thinks happened, it needs to watch which resolver actually shows up to do the lookup.
A test that sees the real resolver
Our DNS leak test does this by handing your browser a one-off hostname that the site is authoritative for, then recording which resolver comes asking about it. That resolver is the one your connection genuinely uses, no guessing involved.
For each resolver that answers, the test lists its IP address, the network it belongs to, its ASN, and its country. If the resolver sits with your VPN provider, your DNS is travelling inside the tunnel the way it should. If it belongs to your home access provider, you have a leak.
Reading the table
A few details help when you look at the results.
- Large resolvers query from many addresses, so several entries can appear for a single test. All of them are listed.
- If your browser uses encrypted DNS, the test shows that provider's resolver rather than the one your operating system would normally use. That is correct for the browser, but it does not confirm the rest of your device is safe.
- The test only ever sees the resolvers, never your actual DNS queries. The one-off hostname is the only name looked up, and resolver addresses are held in memory for a few minutes rather than written to logs.
Fixing a leak once you find one
Use a VPN that runs its own resolvers and turns on DNS leak protection by default, then keep that protection switched on. Avoid setting a third-party resolver by hand while the tunnel is up, since that can pull your lookups back out of it.
On desktop, closing and reopening the VPN client after you change networks clears most leaks. Once you have made a change, run the test again to confirm the resolver answering for you belongs to the VPN and not your provider.