DNS

What a DNS leak test actually checks

A DNS leak test asks one question: when your device looks up a name, which resolver does the asking? If you turned on a VPN so that websites see the VPN’s address, you usually also want name lookups to go to the VPN’s resolver. A leak is a lookup that still goes to the ISP, or to whatever resolver the operating system had before the VPN connected. The website then sees the VPN address, and the resolver operator still sees the names you asked for, often from your real network.

What the test has to observe

The browser will not tell a page which resolver it uses. A real DNS leak test gives you a unique name, your device looks it up, and the operator of that name records the IP address of the resolver that asked. This site does not run that test. Doing it honestly needs a nameserver we operate and a record of who queried it. Inventing a result from the IP address alone would be a guess, so the page you are reading refuses to show one.

What you can check here

The privacy check and the WebRTC leak test compare the address this site sees with addresses the browser offers a peer connection. A second public address is a WebRTC leak, not a DNS leak. The ASN says whether the address looks like a home ISP, a mobile CGNAT network, or a datacenter. A timezone mismatch is a reason to look, not proof. None of those three is a substitute for watching the resolver.

How to read a test you run elsewhere

• Resolvers inside the VPN provider’s network, or a resolver you chose on purpose such as 1.1.1.1, are the expected answers when the VPN claims to handle DNS.
• Your ISP’s resolver, while the VPN is on, is the leak people mean. The ISP can see the names. The VPN’s no-logs page does not cover a query it never received.
• Several resolvers can be normal: the VPN’s, plus a private resolver on your router. Read the list. Do not treat a count of two as an alarm by itself.
• Turn the VPN off and on again and compare. A test run only while the VPN is off just rediscovers your ISP, which is not a leak.

If the VPN has a setting for its own DNS, that setting is the one that matters, and the vendor’s documentation is the source for how it behaves. This site’s VPN comparison quotes published logging policies and labels every affiliate link. It does not score DNS-leak behavior, because we did not run that test against the three networks.