What Is a DNS Leak and How Do I Check for One?
DNS turns domain names into network addresses. A DNS leak generally means DNS requests are reaching a resolver you did not expect while using a VPN or another privacy setup.
What DNS does
When you type a site name, your device first asks a DNS resolver for that name's network address, much like looking up a number in a phone book. The resolver answering that question learns which domain names you look up and when, even if it never sees the pages themselves. Normally your ISP runs this resolver, unless you, your browser or your VPN chose another.
What a DNS leak is
When a VPN is connected, it usually routes DNS lookups through its own resolver or a resolver it documents. A DNS leak happens when lookups bypass that intended path and go to another resolver, most often your ISP's. The rest of your traffic is tunnelled, but the list of sites you visit is still visible to the party you wanted to hide it from.
Common causes
- Manually set DNS servers on the device or router, which some VPN apps do not override.
- IPv6 lookups leaving outside a tunnel that only handles IPv4.
- Several network connections at once. Some versions of Windows can send lookups through more than one network adapter, including the one outside the VPN.
- Split tunnelling that excludes the browser or app doing the lookup.
- Browser secure DNS, which sends lookups to a resolver the browser chose. That is not necessarily a leak, but it is not the VPN's resolver either.
- Network interception. A small number of networks redirect DNS traffic to their own resolver.
How a DNS leak test works
The test creates unique, never-used hostnames and asks your browser to load them. Because nobody has looked those names up before, the lookup must travel to the test service's DNS servers, which record which resolver asked. That resolver is the one handling your browser's lookups. Our DNS leak test watches for about ten seconds, so a second resolver that answers slowly is still caught.
Reading the result
| What you see | What it usually means |
|---|---|
| Only your VPN provider's resolver, or one it documents | DNS is following the VPN's intended path. |
| Your ISP's resolver while the VPN is connected | The classic DNS leak. Investigate the causes above. |
| A public secure-DNS provider | Probably your browser's secure DNS setting. Decide whether that is what you want. |
| Several different operators | Lookups are split between paths. Check for more than one active network adapter or IPv6. |
| No result | The test did not complete. That is not a clean result; run it again. |
A resolver run by an unfamiliar company is not automatically a leak. VPN providers and ISPs often use partner or upstream infrastructure, so compare the result with your provider's documentation before deciding.
Encrypted DNS is not the same as a VPN
DNS over HTTPS and DNS over TLS encrypt the lookup on its way to the resolver, so your ISP cannot read it in transit. The chosen resolver still sees every name you look up, and your ISP still sees which sites you connect to afterwards. Encrypted DNS is a useful layer, but it does not replace the VPN routing check.
What to do next
If the test shows your ISP's resolver while connected, work through how to fix a DNS leak, which covers VPN, browser and operating-system settings one step at a time. To understand exactly how our check measures resolvers, read how NetPrivacyScan performs the DNS check.
Reviewed October 8, 2026 · Methods and limitations · Report a problem