Privacy Tool

DNS Leak Test

Rate this tool:

3.2/5 · 6 ratings Thanks for rating!

Check which DNS servers your browser is using and whether your VPN is properly routing DNS requests. A DNS leak means your ISP can see every website you visit — even when using a VPN.

🔒 100% private — this test runs in your browser and queries DNS directly. We don’t log, store, or share your IP or DNS results.

Your Connection — Live Results

DNS leak test runs automatically. Results appear below in real time.

Your IP Address

162.159.114.42

Detected via HTTP

DNS Servers Detected

Testing…

Via DNS leak test

ISP / Provider

Detecting…

—

DNS Servers in Use

Checking…

Running DNS leak test…

This may take a few seconds

🔍 What is a DNS leak?

When your DNS queries bypass your VPN tunnel and go directly to your ISP's DNS servers, your ISP can log every website you visit — even if you use a VPN.

🌐 How DNS works

Every time you visit a website, your browser asks a DNS server to translate the domain name (google.com) to an IP address. This lookup reveals your browsing.

⚠️ Why it matters

DNS leaks expose your real location and browsing habits to your ISP — even when you think you're protected by a VPN. Some VPNs have poor DNS leak protection.

🛡️ How to fix it

Use a VPN with built-in DNS leak protection, or manually set your DNS to 1.1.1.1 (Cloudflare), 9.9.9.9 (Quad9), or 8.8.8.8 (Google). Enable DNS over HTTPS in your browser.

🛡️ Privacy-Friendly DNS Servers — Recommended

Cloudflare

1.1.1.1 / 1.0.0.1

Fastest public DNS — privacy-first, no logging

USA

Quad9

9.9.9.9 / 149.112.112.112

Malware blocking + privacy — DNSSEC

Switzerland

NextDNS

Customizable

Ad blocking + logging controls — free tier

Global

AdGuard DNS

94.140.14.14

Ad & tracker blocking via DNS

Russia/EU

OpenDNS

208.67.222.222

Family filter option, Cisco owned

USA

Google Public DNS

8.8.8.8 / 8.8.4.4

Fast and reliable — Google has some logging

USA

What Causes a DNS Leak (and Why Your VPN May Not Stop It)

A DNS leak happens when your device sends DNS queries — the lookups that turn a domain like example.com into an IP address — outside your encrypted VPN tunnel. When that happens, your ISP (or whoever runs the DNS server) can see every website you visit, even though your actual traffic is encrypted. The most common causes are an operating system that ignores the VPN’s DNS settings, a manually configured DNS that overrides the tunnel, or Windows’ "smart multi-homed name resolution" sending queries to every available interface at once.

The test above shows exactly which DNS servers are answering for you right now and who operates them. If you see your ISP’s servers while connected to a VPN, that is a live DNS leak.

How to Run a DNS Leak Test With a VPN (NordVPN and Others)

To confirm your VPN is routing DNS correctly, test with it connected and watch which servers appear:

Connect your VPN and choose a server in another country.
Reload this page so the test runs fresh over the new connection.
Look at the DNS servers detected. If they belong to your VPN provider (or a neutral resolver), you’re safe. If your ISP’s servers show up, DNS is leaking.

NordVPNNordVPN routes DNS through its own servers by default. If a leak appears, enable its DNS-leak protection in Settings and reconnect, then re-run this test.

Other VPNsIf your provider doesn’t offer DNS-leak protection, set a private resolver manually (e.g. Cloudflare 1.1.1.1 or Quad9) so queries never fall back to your ISP.

Router VPNsIf your VPN runs on your router, test every device separately — a leak on one device won’t always show on another.

DNS Leak Test for IPv6

IPv6 is a frequent hidden source of DNS leaks. Many VPNs only tunnel IPv4 traffic, so if your network has IPv6 enabled, DNS queries can escape over IPv6 and reveal your real location — even when the IPv4 side looks perfectly protected. If this test flags IPv6 servers you don’t recognise, the safest fixes are to enable your VPN’s IPv6-leak protection, or disable IPv6 on your device until your provider fully supports it.

Using Cloudflare DNS (1.1.1.1) and Testing for Leaks

Switching to a privacy-focused resolver like Cloudflare’s 1.1.1.1 or Quad9’s 9.9.9.9 stops your ISP from seeing your lookups, but it is not a substitute for a proper VPN DNS setup — the query still needs to travel inside the tunnel. After changing your resolver, re-run this test: you should see Cloudflare or Quad9 answering, not your ISP. If your ISP still appears, something on your system is overriding the resolver and needs fixing.

Frequently Asked Questions

What is a DNS leak and why is it a privacy risk?

A DNS leak occurs when your DNS queries are sent to your ISP's DNS servers instead of your VPN provider's servers, even when you are connected to a VPN. This means your ISP can see every domain name you look up, revealing your browsing activity despite the VPN being active.

How does the DNS leak test work?

The test sends a series of DNS queries to unique subdomains on our test server and checks which DNS resolvers respond. If resolvers belonging to your ISP appear in the results while you are using a VPN, your VPN has a DNS leak.

My VPN is on but the test shows my ISP's DNS — what should I do?

First, disconnect and reconnect your VPN. If the leak persists, check your VPN client settings for a DNS leak protection or kill switch option and enable it. You can also manually configure your system to use your VPN provider's DNS servers rather than your router's default.

What is a DNS leak?

A DNS leak occurs when your DNS requests (domain name lookups) are sent outside your VPN tunnel — typically to your ISP's default DNS servers. This lets your ISP see every website you visit even if you think you're protected by a VPN.

My VPN is on — why am I still leaking?

Some VPN clients don't properly configure the system to use the VPN's DNS servers. Windows Split Tunneling, Smart Multi-Homed Name Resolution, and incorrect routing tables can all cause DNS requests to bypass the VPN tunnel.

What does it mean if I see multiple DNS servers?

Seeing multiple DNS servers is normal — your device may query several. The concern is whether those DNS servers are controlled by your ISP (leak) or by a privacy-focused provider (good).

How do I fix a DNS leak on Windows?

Go to Network Settings → Change Adapter Options → Right-click your VPN adapter → Properties → Internet Protocol Version 4 → Use these DNS servers → Enter 1.1.1.1 and 1.0.0.1. Also disable Smart Multi-Homed Name Resolution in Group Policy.

Does DNS over HTTPS prevent leaks?

DNS over HTTPS (DoH) encrypts your DNS queries and sends them to a specific provider over HTTPS, preventing ISP interception. Enable it in Chrome (Settings → Privacy → Security → Use secure DNS) or Firefox (Settings → Network Settings → DNS over HTTPS).

Is my ISP DNS always a leak risk?

Your ISP DNS being used is only a risk if you intended to use a VPN or different DNS provider. If you're not using a VPN, seeing your ISP's DNS is normal and expected.

Why does my DNS leak test show IPv6 addresses even with a VPN?

Many VPNs only route IPv4 traffic and leave IPv6 unprotected. If your ISP supports IPv6 but your VPN doesn't fully tunnel it, IPv6 DNS queries can bypass the VPN entirely. The fix is to either disable IPv6 on your network adapter or use a VPN with confirmed IPv6 leak protection.

How do I fix a DNS leak on Mac or iPhone?

On Mac, go to System Settings -> Network -> your connection -> Details -> DNS, remove any manually entered servers so it defers to your VPN. On iPhone, check Settings -> VPN and make sure "Connect On Demand" is on and no separate DNS profile is overriding it, then re-run this test with the VPN connected.