A DNS leak occurs when your device sends DNS queries — the requests that translate domain names like google.com into IP addresses — to your ISP's DNS server instead of your VPN's private resolver. See our guide to how DNS actually works for the full mechanics. Your VPN encrypts your web traffic, but your ISP can still see every domain you visit through the leaked DNS queries. The VPN shows "Connected" and appears to be working normally, making DNS leaks particularly dangerous.

DNS Leak Test

Q: How does a DNS leak affect my privacy?

Your ISP's DNS resolver logs every domain you look up — including the timestamp and frequency. This log reveals your browsing habits in detail even if the actual content of your web traffic is encrypted. ISPs in many countries are legally required to retain these logs for up to 12 months and may share them with government agencies or sell the data to advertisers.

Q: My VPN says it's connected — how can I still have a DNS leak?

A VPN encrypts your internet traffic tunnel but DNS is handled separately by your operating system's network stack. Some VPN implementations only route TCP/UDP web traffic through the tunnel without configuring the OS-level DNS resolver. Your browser's DNS queries then use whatever DNS server Windows, macOS, or Linux has configured by default — which is almost always your ISP's resolver.

Q: What does a "safe" DNS test result look like?

A clean result shows only DNS resolvers that belong to your VPN provider — the ISP / organisation field should show your VPN's company name, and the country should match the VPN server location you chose. If you see your home country's ISP listed in any row, that resolver is outside the VPN tunnel and you have a confirmed DNS leak.

Q: Can I fix a DNS leak without changing VPN provider?

Yes — in many cases. First, check your VPN app's settings for a "DNS leak protection" toggle and enable it. If that doesn't resolve it, manually set your OS DNS to a non-ISP server like Cloudflare (1.1.1.1) or Quad9 (9.9.9.9). On Windows, you may also need to disable Smart Multi-Homed DNS via Group Policy. Always re-run this test — or check the resolver directly with our DNS lookup tool — after making changes to confirm the fix worked.

Q: Does this DNS leak test store my IP or DNS server information?

No. The test queries external DNS APIs to discover which resolvers your browser is using, but no results are logged, stored, or associated with your device on PrivacyTestLab's servers. The resolver IPs are only used to display your results and are discarded when you close the page.

Check whether your DNS queries are leaking to your ISP — even when your VPN is connected. See exactly which DNS resolvers your browser is using, their ISP attribution, and their location. If you spot your ISP's name, your VPN is leaking.

DNS Leak Test

Queries real DNS resolvers — not cached results — via multiple detection APIs

Run the test to check for DNS leaks

Click the button above to begin

Resolvers ISP Location

Your DNS servers will appear here after running the test

Standard test complete. Run an extended test for more thorough detection using additional DNS query methods.

Scored using our published, open-source methodology. View methodology

What this test checks

DNS resolver identification

The test identifies every DNS server handling your domain lookups — IP address, hostname, country, and ISP — so you can see immediately whether they belong to your VPN provider or your ISP.

Geolocation of each resolver

Each DNS server is geolocated so you can verify the resolver is in the country your VPN server is located in. An ISP resolver appearing in your home country is the clearest sign of a DNS leak.

ISP / organisation attribution

We show the ASN and organisation name behind each resolver. If you see your ISP's name (BT, Comcast, Vodafone, etc.) here while your VPN is connected, you have a confirmed DNS leak.

Leak verdict per resolver

Each resolver row gets an individual verdict — VPN resolver (safe), ISP resolver (leaked), or third-party resolver (warning). The overall verdict summarises all detected servers.

How a DNS leak bypasses your VPN

Your device

Visit example.com

VPN tunnel

Encrypted traffic

or if leaking

VPN DNS server

Safe — ISP blind

ISP resolver

Leaked — ISP sees all

When a DNS leak occurs, DNS traffic skips the VPN tunnel entirely (the red branch above). Your web traffic stays encrypted but your ISP's DNS logs reveal every domain you visit, when you visit it, and how often.

What causes DNS leaks

VPN misconfiguration

The VPN client routes your web traffic through the tunnel but fails to redirect DNS queries. DNS runs on UDP port 53 and some VPN implementations only intercept TCP connections, leaving DNS exposed.

Windows Smart Multi-Homed DNS

Windows 8, 10, and 11 send DNS queries to all available network interfaces simultaneously and use the fastest response. Your VPN adapter may respond first, but Windows also accepts the ISP response.

IPv6 DNS not tunnelled

Many VPNs only tunnel IPv4 traffic. If your ISP provides IPv6, DNS queries over IPv6 travel completely outside the VPN tunnel — invisible to the VPN application and unencrypted to your ISP.

VPN reconnection gap

When a VPN connection drops and reconnects, there is a brief window where DNS queries revert to the system default — typically your ISP's resolver. This is why a kill switch is essential.

Browser DNS-over-HTTPS override

Chrome and Firefox have built-in DNS-over-HTTPS (DoH) settings that can override the system DNS. If configured incorrectly, the browser may query a specific DoH provider that bypasses the VPN's DNS.

Router-level DNS override

Some routers are configured to intercept and redirect all DNS queries to the ISP regardless of what the device requests. This is common on ISP-provided routers and transparent DNS proxies.

How to fix a DNS leak

Step-by-step fix guide

Switch to a VPN with DNS leak protection built in

The most reliable fix. Mullvad, ProtonVPN, and ExpressVPN all operate their own DNS resolvers and route all DNS queries through the encrypted tunnel by default — no configuration required. Mullvad's resolver blocks ads and trackers as a bonus.

Best fix — zero configuration

Enable DNS leak protection in your VPN settings

Most modern VPN clients have a "DNS leak protection" toggle. In NordVPN: Settings → DNS → enable custom DNS. In ExpressVPN: Options → DNS → Use ExpressVPN DNS servers. In Mullvad: this is enabled automatically and cannot be disabled.

Configuration fix

Disable Windows Smart Multi-Homed DNS via Group Policy

Open Group Policy Editor (gpedit.msc), navigate to Computer Configuration → Administrative Templates → Network → DNS Client → "Turn off smart multi-homed name resolution" and set it to Enabled. Restart required.

Windows 8 / 10 / 11

Set a manual privacy-respecting DNS server

Even if your VPN leaks, setting your OS-level DNS to Cloudflare (1.1.1.1), Quad9 (9.9.9.9), or NextDNS prevents your ISP's resolver from being used as a fallback. This doesn't fix the leak source but limits its impact.

Fallback mitigation

Enable the VPN kill switch

A kill switch blocks all internet traffic if the VPN connection drops, preventing DNS queries from reverting to your ISP resolver during reconnection gaps. This is the most underused safety feature in VPN apps — enable it in advanced settings.

Prevents reconnection leaks

Frequently asked questions

“What is a DNS leak?”

“How does a DNS leak affect my privacy?”

“My VPN says it's connected — how can I still have a DNS leak?”

“What does a "safe" DNS test result look like?”

“Can I fix a DNS leak without changing VPN provider?”

“Does this DNS leak test store my IP or DNS server information?”