EN
Compare VPNs

Home Tools

DNS leak test

  1. IP address
  2. WebRTC leak
  3. DNS leak

The test only starts when you click. Your browser then looks up a few random names under leak.vpnlookup.com; our own name server notes which DNS resolver asks for them. The resolver addresses stay in memory for 10 minutes and are not logged.

The test shows which DNS resolvers asked for names that your browser looked up a moment ago, and which networks they belong to.

How to test your VPN

  1. Turn your VPN off and click Start the test. The page remembers the resolvers it finds now. This is usually your internet provider.
  2. Turn your VPN on, pick a server and wait a few seconds. Keep this page open.
  3. Click Test again. If a resolver from the first test comes back, the page reports a leak.

The resolvers from the first test are kept only in this page’s memory. They are gone when you close or reload the page.

VPN on: where your DNS lookups go, without and with a leak

No leak

  1. YouEncrypted tunnel
  2. Your networkinternet provider, or the Wi-Fi of work, school or a café

    Sees: only that you are connected to a VPN server, and how much data you send.

  3. DNS resolver of the VPN

    Gets your lookups through the tunnel.

With a DNS leak

  1. YouEncrypted tunnel
  2. Your networkinternet provider, or the Wi-Fi of work, school or a café

    Sees: that you are connected to a VPN server, and also which site names you look up.

  3. DNS resolver of your provider

    Gets your lookups outside the tunnel.

What the result means

ResultMeaning
A resolver of your internet provider, VPN offNormal: this is where your lookups go without a VPN
The same resolver, VPN onA leak: your lookups bypass the tunnel
A resolver of the VPN or of a public service, VPN onNo leak, as long as it is not the resolver from your first test
No resolver at allThe lookups did not reach us: a blocker, a firewall or a browser setting stopped them

What the test does not see

  • Not every leak. Another browser or app on the same device can use a different resolver. The test only covers this browser.
  • Encrypted DNS hides the provider, not the resolver. If your browser uses DNS over HTTPS, you see that resolver, not the one of your system. That is correct, but it says nothing about what the rest of your device does.
  • Not a verdict on your VPN. A clean result holds for this server and these settings, at this moment.

The WebRTC route is a separate test: use the WebRTC leak test. Your normal address is in the IP tool. Which providers mention their own DNS or leak protection is on each provider page in the overview of providers, with a source.

Frequently asked questions

What is a DNS leak?Every time you open a website your device asks a DNS resolver which address belongs to the name. With a VPN those questions should travel through the tunnel to the VPN’s own resolver. If they still go to the resolver of your internet provider, your provider can see every site you visit even though the content is encrypted.
How does the test work?When you click, your browser looks up a few random names that end in leak.vpnlookup.com. We run the name server for that domain, so the resolver that asks for those names reaches us and we note its address. The page then shows you those addresses and the network they belong to. The requests themselves fail on purpose: there is nothing behind the names.
The test shows Cloudflare or Google, not my provider. Is that a leak?Not by itself. Many browsers and systems use encrypted DNS (DNS over HTTPS) with a public resolver such as Cloudflare or Google. Then your provider does not see the lookups either, but the public resolver does. With a VPN on, the question is whether a resolver appears that belongs to your internet provider or to the network you had before the VPN. Run the test without the VPN first so the page can compare.
Why does the test show several resolvers?Large resolvers answer from many servers and a lookup can come from any of them. Several addresses from the same network are normal. Different networks are worth a look.
What do I do if the test shows a leak?Check in your VPN app whether DNS leak protection exists and is switched on. Turn off secure DNS in your browser or operating system if it sends lookups to a resolver outside the tunnel, or point it at the VPN’s resolver. Then test again.
Who sees the resolver addresses during this test?The name server that answers the test names is ours. It keeps the resolver addresses in memory for ten minutes, writes nothing to disk or logs, and only returns them to a page that knows the random name your browser made up. To show the network name, we look up the resolver address (not yours) in the free DNS service of Team Cymru.

All tools