DNS Leak Test Guide

A DNS leak means DNS queries are resolved outside the VPN path or resolver policy you intended to use. A VPN can change the public IP websites see while the operating system, browser, or an excluded app selects a different resolver.

An IP check answers "what address do websites see?" A resolver-aware DNS test answers "which recursive resolver contacted the test domain's authoritative server?" Resolver ownership is useful evidence, but it does not by itself show the complete packet route between your device and that resolver.

1. Before connecting the VPN, record your public IP, ISP, and ASN on the homepage IP checker.
2. Use a resolver-aware test that generates a unique hostname. Its authoritative DNS service must log the recursive resolver that requests that hostname.
3. Connect the VPN, repeat the unique-hostname test, and compare the observed resolver addresses with the VPN provider's documented DNS behavior. Run several queries because caches, fallback, and multiple resolver endpoints can affect one result.
4. Use ASN Lookup and Reverse DNS only to research an observed resolver IP. A normal DNS record lookupresolves the domain you enter from this site's server; it does not test your device's resolver.

Change settings only after a resolver-aware test repeatedly shows behavior that conflicts with your VPN provider's documentation. A public DNS provider is not automatically a leak, and switching to one changes who handles queries rather than proving that DNS is traveling through the VPN tunnel.

• Enable the VPN app's DNS protection and kill switch, then reconnect so its network rules are applied again.
• Compare operating-system and browser secure DNS settings with the VPN provider's documented configuration.
• Review split tunneling rules for the browser and any app making DNS requests.
• Confirm the VPN supports both IPv4 and IPv6 on the current network, or follow its documented IPv6 fallback guidance.

Repeat the same unique-hostname measurement after each change. Compare the observed resolver with the expected VPN behavior; ordinary DNS record lookups are not a substitute for that retest.

An unexpected resolver can come from VPN configuration, browser policy, split tunneling, or fallback behavior. It is evidence to investigate, not an automatic verdict about the packet route.

• System and VPN DNS settings differ.The VPN may not replace the operating system's resolver, or another network service may change the setting after the tunnel connects.
• Browser DNS-over-HTTPS (DoH). Chrome, Firefox, and Edge can select a DoH resolver instead of the resolver supplied by the VPN. That can bypass VPN-provided resolver selection, but it does not prove the HTTPS packets left the VPN tunnel; routing and split-tunnel rules determine their path.
• Split tunneling misconfiguration. If your VPN excludes a browser or app, its DNS behavior can differ from fully tunneled apps. The exact route depends on the VPN client and operating system.
• IPv6 DNS fallback. Some networks send DNS traffic over IPv6 even when IPv4 is tunneled. If the VPN does not handle IPv6 consistently, investigate the IPv6 path with the IPv6 leak test.

These primary sources define DNS over HTTPS and document browser controls. They explain resolver selection and encryption; they do not replace a resolver-aware measurement of your connection.

• RFC 8484: DNS Queries over HTTPS - the IETF protocol specification for sending DNS queries and responses over HTTPS.
• Mozilla: Firefox DNS over HTTPS - official explanation of Firefox resolver selection, privacy, and configuration controls.
• Google Chrome: Manage safety and security - official Secure DNS behavior and settings guidance.

The patterns below apply only when a test uses a unique hostname and authoritative DNS logging. Resolver ownership is a useful signal, but compare it with the VPN's documented DNS behavior before calling the result a leak.

• ISP resolver before, expected VPN resolver after: consistent with the VPN selecting its documented resolver. It does not independently map every packet in the tunnel.
• ISP resolver before and after:strong evidence of unexpected resolver use if the VPN promises to replace it. Confirm with repeated queries and the provider's documentation.
• Public resolver (Cloudflare, Google) before and after: shows that a third-party recursive resolver handled the query. It is not, by itself, a leak verdict and does not show whether DoH traffic traveled inside or outside the VPN tunnel.
• Mixed resolvers after connecting: investigate browser DoH, split tunneling, fallback, caching, and multiple network interfaces. Mixed results do not automatically prove a partial leak.

This site's DNS Lookup queries public DNS records from the server. Reverse DNS and ASN Lookup can identify an IP already reported by a resolver-aware test, but neither discovers your active resolver.