DNS Leak Test
Your browser resolves a few single-use hostnames under our test zone. Every recursive resolver that queries our name server for them is listed below.
Your DNS resolvers
Needs JavaScriptYour connection
Frequently asked questions
What is a DNS leak?
On a VPN, your DNS lookups should go through the VPN as well. If the resolvers listed here belong to your ISP instead of the VPN provider, your ISP can still see which sites you visit. That is a DNS leak.
How does the test work?
Your browser looks up a few random hostnames under a DNS zone we operate. No resolver has those names cached, so each one must query our authoritative name server directly, and we record the source address of every query. The record is deleted after two minutes.
Why are there several addresses?
Big public resolvers such as Google Public DNS and Cloudflare send queries out from many machines, so several addresses from one network are normal. The test also checks IPv4 and IPv6 separately, so a resolver with both can appear twice.
What is the client subnet (ECS)?
Some resolvers, Google Public DNS among them, pass part of your IP address on to name servers so a CDN can pick a server near you. If yours does, the subnet it sent is shown.
Why don't the results match my DNS settings?
Browsers with Secure DNS (DNS over HTTPS) turned on skip the system resolver. Routers and ISP resolvers also often forward queries to an upstream resolver, and the upstream is what shows up here.