DNS leak test: is your VPN hiding lookups?

1The one-line answer

A DNS leak happens when the name lookups for the sites you open go to your normal internet provider while the rest of your traffic is in the tunnel. To test it, connect, run a DNS leak test page, and read the owner of every resolver in the list. If any belongs to your home or mobile operator, you have a leak.

The result should show resolvers that belong to the server side of the tunnel and not to the line you started with.

2Running the test

1. 1

   Note your normal resolvers first: run the test with the tunnel off and write down the owners shown.

2. 2

   Connect with the key from the bot and wait for the client to report a live session.

3. 3

   Close other tabs, open the test page fresh and start the longer version if there is one.

4. 4

   Read the list by owner, not by country. A resolver in a data centre is a good sign, and your own operator's name is not.

5. 5

   If anything looks wrong, change one thing at a time and run the test again.

3What DNS is, in plain words

Before a page opens, your device asks a resolver which number matches a name such as example.org. That question travels in the clear in many setups. Whoever runs the resolver can see the names you ask for, even if the page itself is protected by HTTPS. HTTPS hides what you do on a page, not which site you contacted.

This is why a tunnel that carries only the web traffic but leaves DNS outside still lets your operator keep a list of site names.

4Frequent causes of a leak

• The browser has secure DNS turned on and sends lookups to its own chosen resolver, not through the tunnel.
• The operating system keeps a manual DNS setting that overrides the client.
• IPv6 lookups go out of the normal line because the profile covers IPv4 only.
• A router or a mobile hotspot forces its own resolver for devices connected to it.
• The client works in a per-app mode and the browser is not on its list.

5Fixing it without guesswork

Start with the browser: check whether it has its own DNS setting and, if the test shows the browser's chosen resolver, decide whether you want that or the one from the tunnel. Next, look in the client for a setting about DNS or remote lookups. Then disable IPv6 on the device briefly to see whether the leak disappears. Change one item per run, because otherwise you will not know what helped.

If you still see your own operator after these, contact support through the bot and tell them the client you use and a list of the resolvers you saw.

6What a clean test means and what it does not

It means lookups were in the tunnel during that run. It does not prove anything about what a provider stores, and a different network or browser can behave differently tomorrow. We sell a VPN, so we point you to a test that anyone can run instead of asking for trust. Our editors checked this page against the service facts, and an AI model helped draft it, so read it the way you would read any guide: with the test open in the next tab.

Servers are in Stockholm, Zurich, Osaka, Rotterdam and Singapore, so those are the only countries a clean result should hint at.

7Questions