DNS Leak Test

When you browse, your device asks a DNS resolver to translate domain names to IP addresses. With a VPN, those queries should use the VPN's protected DNS — not your ISP.

A dns leak test checks whether your visible IP and network signals suggest VPN protection is active, and helps you compare results with VPN on versus off.

Your OS or browser sends DNS queries to a configured resolver (ISP, router, public DNS, or VPN). Answers are cached locally.

HTTPS encrypts page content but not the fact that you queried a domain — unless DNS is encrypted (DoH/DoT) or tunneled inside the VPN.

VPN users expect DNS privacy. Leaks let ISPs or local networks log site names, weakening anonymity and corporate security policies.

Regulated environments and journalists rely on vpn dns leak checks after every network change.

Full-tunnel VPNs route all traffic — including DNS — through the VPN gateway. Some clients push custom resolver IPs.

Kill switches block traffic if the VPN drops, reducing accidental exposure.

• VPN connected but public IP still shows your ISP.
• VPN off and on show the same residential IP when you expect a VPN exit.
• Browser DoH points to a resolver outside the VPN tunnel.
• IPv6 traffic routes outside the VPN while IPv4 is protected.

This tool reports network context to interpret — not a full resolver enumeration:

ISP DNS

When your IP and org match your broadband provider, DNS may still use ISP resolvers if VPN DNS is not enforced.

VPN DNS

Hosting or datacenter ASNs with VPN connected often indicate traffic exiting through the VPN provider.

Third-Party DNS

Public resolvers (1.1.1.1, 8.8.8.8) may appear if configured in OS or browser — verify they route inside the VPN.

Public DNS Services

Encrypted DNS (DoH) can bypass VPN DNS unless the VPN blocks or tunnels it.

• VPN misconfiguration — DNS not pushed to clients.
• Browser settings — Secure DNS enabled outside VPN.
• IPv6 leaks — IPv6 not tunneled while IPv4 is.
• Split tunneling — local DNS used for some apps.
• Router DNS settings — LAN DHCP overrides VPN DNS.

• Enable VPN DNS protection in the client settings.
• Disable IPv6 or route IPv6 through the VPN.
• Configure secure DNS only when your VPN supports it.
• Change VPN provider if leaks persist after correct setup.

• Quick vpn leak test without installing desktop apps.
• Compare VPN on/off from the same browser session.
• Educates teams on dns privacy test basics.
• Part of VSPIC's privacy toolkit alongside IP and SSL checks.

• Use VPN clients with explicit DNS leak protection.
• Disable conflicting DoH in browsers when using VPN DNS.
• Test after firmware or OS updates.
• Prefer DoT/DoH only when you understand resolver trust.

• IETF — DNS Privacy Considerations
• Cloudflare — cdn-cgi/trace