Security Tool
DNS Leak Test
Run a free DNS leak test in your browser and see which network answers your lookups: your internet provider, a public resolver, or the VPN you connected to. The test says plainly which one it is, and this page shows you how to fix a leak if you find one.
Your browser looks up three names that only our name server can answer; we record which resolver asked. Nothing else is stored.
Understanding
What Is a DNS Leak?
DNS turns a site name into an address. By default your internet provider's resolver does that, so it sees the name of every site you visit, even over HTTPS.
A DNS leak is when you are connected to a VPN but those lookups still go to your provider instead of through the tunnel. This test shows which network actually answered yours.
Fix
How to Stop DNS Leaks
Connect with a VPN app that sends DNS through the tunnel, then run this test again
Or set a public resolver such as Cloudflare (1.1.1.1) or Quad9 (9.9.9.9) on your device
Turn off IPv6 on the device if your VPN does not carry it
Test again after changing network settings or Wi-Fi
Your result
What each result means
The test reports the network that answered, not only an address, so you can tell these four cases apart.
Your internet provider answered
Your lookups went out on the network you are connected to, so that provider can read the name of every site you open, even over HTTPS. The VPN is either off, or it is connected but not carrying DNS.
A public resolver answered
Cloudflare, Google or Quad9 handled the lookup. Your provider is out of it, but that resolver now sees your browsing, and it saw the address you came from. Many VPN apps use a public resolver inside the tunnel, which is fine when the lookup enters the tunnel first.
Another network answered
Usually your VPN server's own resolver. This is what a tunnel that carries DNS looks like: the network you are sitting on cannot read the names you look up.
Nothing was observed
The lookups never reached our name server, so the page says so instead of showing a pass you did not earn. A firewall, a filtering resolver or a network that blocks unknown names does this.
Fix
How to fix a DNS leak on Windows, macOS, Android, iPhone and iPad
Work through these in order and run the test again after each one. When the answer changes from your provider to your VPN, the last change you made was the fix.
Connect the VPN first
A result without the VPN on only describes your normal network. Connect, then test again.
Windows
Open Settings, Network and Internet, then the active adapter and its DNS server assignment. If your provider's servers are listed, set it to Automatic so the VPN app can set DNS. If the app offers split tunnelling, turn it off while you test.
macOS
Open System Settings, Network, your connection, then Details and DNS. Remove any provider servers listed there and let the VPN app set DNS.
Android
If the app lets you choose which apps use the tunnel, keep every app inside it while you test. Any app left outside uses the network's own DNS, whatever the VPN is doing.
iPhone and iPad
Turn iCloud Private Relay off while you test. It answers DNS itself, so the result will not show what your VPN does.
Questions
DNS leaks, answered
What is a DNS leak?
A DNS leak is when a VPN is connected but the lookups that turn a site name into an address still go to the network you are on, usually your internet provider. The traffic is encrypted, but the names of the sites you visit are not hidden from that network.
How do I check if my VPN leaks DNS?
Connect the VPN, run the test on this page, then read which network answered. Your VPN's own resolver means the tunnel is carrying DNS. Your internet provider means it is not.
Is a DNS leak dangerous?
It does not expose the content of a page served over HTTPS, but it does show every site name you open to the network that answers. That list is the browsing history a VPN is meant to keep to yourself.
Does changing my DNS to 1.1.1.1 fix a leak?
It moves your lookups from your provider to Cloudflare, so your provider stops seeing them and Cloudflare sees them instead. That hides them from your network, but not from the resolver. Only a tunnel that carries DNS keeps the names away from every network you use.
What about WebRTC and IPv6 leaks?
They are separate from DNS. WebRTC can reveal your real address to a page even behind a VPN, and a tunnel that carries IPv4 only can let IPv6 traffic go around it. Test both after you change a VPN server or a network.
How often should I test for DNS leaks?
After you change VPN server or protocol, switch networks, or change any DNS setting. A leak that appears on one Wi-Fi network and not another is usually that network, not the app.
Two other checks worth running after this one: what is my IP address shows the address sites see, and the email leak checker shows whether an address of yours appears in a breach.
Stop DNS Leaks
GhostShield VPN sends your DNS lookups through the encrypted tunnel on every connection.
Get Protected