DNS Leak Test Guide

A DNS leak occurs when web traffic uses a proxy, VPN, or another tunnel while domain lookups still use the network's default resolver. A site may see the proxy egress while an ISP, router, or company network can still see the domains you requested. When the DNS path and web egress differ, the proxy's DNS handling should be reviewed.

What is DNS?

The Domain Name System translates a domain name into an IP address that a device can connect to. A browser or application normally asks a recursive resolver before connecting to a domain that is not already cached. The resolver may be supplied by an ISP, router, or organization, or configured as a public or encrypted DNS service.

DNS queries do not contain page contents, but they can reveal the domains you requested and their timing. That can affect privacy, availability, or risk checks for streaming, AI services, cross-border commerce, and proxy-based access.

How DNS leaks happen

Browser proxies commonly handle HTTP(S) only, and some VPN clients change routing without taking over DNS. The operating system can still use the resolver supplied by the adapter or router before a connection is made. Local lookups used to match IP-based routing rules, an unmanaged IPv6 path, or a browser's independent secure DNS setting can also bypass the proxy.

FakeIP modes return a placeholder address locally and perform the real lookup at the proxy. They reduce local exposure, but the routing rules and fallback resolvers still need to be checked.

How this page tests DNS

A browser cannot directly read the computer's DNS configuration. This page creates a 12-character random token and a fresh subdomain for each probe, then requests it through browserleaks IPv4 and IPv6 probe endpoints. Because the names are not cached, the recursive resolver must query the authoritative probe. The probe returns the resolver IP, location, and provider it observed; the page merges duplicate records and displays them.

The “likely ISP resolver” label is a provider-name heuristic and an investigation hint. It is not confirmation of a leak. A Google, Cloudflare, or other public resolver is not an absolute safety guarantee either. The result describes this browser run and does not replace packet capture or a review of the system and proxy configuration.

Reading the result

• A resolver and the web egress follow the same expected path: there is no obvious detour, but verify that the proxy actually handles DNS.
• A local ISP or broadband resolver appears while the web egress is elsewhere: this is the main DNS leak signal; review VPN DNS forwarding and split-routing rules.
• Only public DNS providers appear: the query was delegated to them, and those providers can still see it. This is not an automatic safety verdict.
• No resolver is observed: network restrictions, extensions, a probe outage, or a timeout may be responsible. An empty result does not prove that every DNS path is protected.

Prevention

1. Prefer a VPN TUN mode or a proxy client's Tun + FakeIP mode so the real lookup happens at the proxy.
2. Prefer domain-based routing. When IP matching is required, use no-resolve where supported so a local lookup is not triggered to evaluate a rule.
3. DoH or DoT can encrypt the connection to a resolver and reduce observation or tampering in transit. They do not hide the query from the final resolver or guarantee that the proxy performs it.
4. Review nameserver-policy, IPv6, browser secure DNS, and router DHCP settings so a fallback path cannot bypass the proxy.

Frequently asked questions

Why can DNS still use the ISP while a VPN is connected?

Many browser proxies and some VPNs handle web connections while leaving DNS on the adapter or router configuration. A full-tunnel mode that also takes over DNS is more likely to keep lookup and web egress consistent.

Does seeing 8.8.8.8 or 1.1.1.1 mean there is no leak?

Not by itself. The probe sees the address used by the recursive resolver when it queries the authoritative service, which may differ from the resolver IP configured on the device. Public DNS reduces reliance on the local ISP, but the provider can still see the query and the route still needs to match your expectation.

Do I still need a test when DoH or DoT is enabled?

Yes. DoH and DoT mainly encrypt the connection between the device and the resolver. They do not guarantee that the proxy performs the lookup or hide the final recipient of the domain query.

Does no observed resolver mean that I am safe?

No. It means that this run did not observe a response. Network blocking, extensions, a probe outage, or a timeout can all produce an empty result.

Does IPDO store the DNS test result?

No. Random probes and result aggregation run in this browser. IPDO cannot read the system DNS configuration and does not upload the lookup history. The probe service can see the network egress that performs the lookup; refer to that provider's policy for retention details.