What a DNS leak is
Every time you open a site, your device asks a DNS resolver to turn the name into an IP address. On a VPN, that question should travel through the tunnel to the VPN's own resolver. A DNS leak is when the question goes to your ISP's resolver instead — so even though your traffic is encrypted, a record of every site you visit is still visible outside the tunnel.
A proper DNS leak test uses a nameserver under the tester's control: it hands your browser a unique hostname, then reports which resolver IPs asked about it. Comparing those resolvers' networks against your VPN's tells you whether anything escaped.
Who this matters for
- VPN users who assume their browsing history is fully hidden from their ISP.
- Anyone using a custom or encrypted DNS setup who wants to confirm it's actually in use.
How to fix a DNS leak
- Use a VPN that forces its own DNS. The app routes every lookup through its resolvers, so nothing reaches your ISP.
- Enable encrypted DNS (DoH/DoT) in your browser or OS as a second layer, pointed at a resolver you trust.
Common questions
Does the check say "unavailable"?
The resolver-collection step needs a dedicated nameserver that this deployment hasn't enabled yet. Rather than guess, we report the check as unavailable — we never show a green or red result we didn't actually measure.
My traffic is encrypted — why does DNS matter?
Encryption hides the content of your traffic, not necessarily the names you look up. A leaking resolver still sees the list of sites you visit, even if it can't read what you do there.
Related checks
DNS is one channel. These cover the others: