How this DNS test works
When you press the button, the test creates unique hostnames that have never been looked up before and asks your browser to load them. Because nobody has looked those names up, the lookup must reach the test service's own DNS servers, which record which resolver asked. For about ten seconds the page collects every resolver that answers, so a second, slower resolver is not missed.
Reading your result
| What you see | What it usually means |
|---|---|
| Only your VPN's resolver, or one it documents | DNS is following the VPN's intended path. |
| Your ISP's resolver while the VPN is on | A likely DNS leak. See how to fix it below. |
| A public secure-DNS provider | Probably your browser's secure DNS setting rather than the VPN. |
| Resolvers from several operators | Several resolver operators were observed. This can reflect shared infrastructure or different DNS settings; it does not by itself establish separate traffic paths. |
| No resolvers observed | The test did not complete. That is not a clean result; run it again. |
Compare before and after connecting
- With the VPN off, run the test. You will usually see your ISP's resolver.
- Connect the VPN and run it again.
- If your ISP's resolver still appears, DNS is likely bypassing the tunnel.
A resolver run by an unfamiliar company is not automatically a leak. VPN providers often use partner infrastructure, so compare the result with your provider's documentation before deciding.
If you find a leak
Work through how to fix a DNS leak, which covers VPN, browser and operating-system settings one step at a time. For background, read what a DNS leak is.
Limits of any browser DNS test
The result shows which resolver handled this browser's lookups during the test. Other apps can use different resolvers, and browsers with secure DNS turned on may use their own. The test does not read your past DNS history. On a work or school network, DNS is often managed deliberately, so do not change those settings without the administrator's permission.