DNS Leak Test: Find the Resolver That Handles Your Lookups
Run a DNS leak test in two steps. Step 1 shows the public IP address and network that websites see and checks whether encrypted DNS is reachable. Step 2 identifies the DNS resolver your device really uses, from one lookup you run yourself. No sign-up: the checks go straight from your browser to an IP-information service and two public DNS resolvers, and this site stores nothing.
A DNS leak test checks which DNS resolver answers your device’s lookups. If you use a VPN and that resolver belongs to your home internet provider instead of the VPN, your lookups are leaking outside the tunnel — the provider can still see every site name you request, even though the traffic itself is encrypted.
How This DNS Leak Test Works
The test has two steps, because a web page can only do part of the job. Page scripts cannot read your operating system’s DNS settings or see which resolver made a lookup. Online tests that list your resolvers automatically do it by making the browser request unique hostnames under a domain whose name server records which resolver came asking, and this page does not run such a server. So step 1 never reports “no leak”: it shows what a browser can honestly measure, and step 2 identifies the resolver itself.
| Check | How it runs | What it tells you | What it cannot tell you |
|---|---|---|---|
| Public IP and network (step 1) | Your browser asks an IP-information service which address it sees | The address and network websites see. With a VPN on, both should be the VPN’s | Which resolver handled your DNS |
| Encrypted DNS reachability (step 1) | Your browser sends one DNS-over-HTTPS query for example.com to two public resolvers | Whether encrypted DNS works from this network | Whether your device actually uses it |
| Resolver identification (step 2) | You look up a diagnostic name; its name server replies with the address of the resolver that asked | The resolver your operating system really used, and who operates it | Lookups made by a browser that has its own secure DNS setting |
How to Run a DNS Leak Test from the Command Line
Akamai runs a diagnostic name, whoami.ds.akahelp.net, whose answer includes an “ns” field: the unicast IP address of the recursive resolver that sent the query. Looking it up from your own computer shows the resolver your system really uses.
- Connect your VPN if you use one, then press Run DNS Leak Test above to record your public IP and network.
- Run the command for your system from the first table below.
- Paste the “ns” address into step 2 of the results and press Check this resolver. The tool looks up who operates that address and compares it with the network of your public IP.
- Read the outcome with the second table. One lookup shows one resolver, so repeat it once or twice to see whether another one appears.
| System | Command |
|---|---|
| Windows (Command Prompt or PowerShell) | nslookup -type=TXT whoami.ds.akahelp.net |
| macOS or Linux (Terminal) | dig +short TXT whoami.ds.akahelp.net |
Worked example: a lookup made through a public resolver returned "ns" "172.217.34.155". Pasting that address into step 2 shows the operator as AS15169 Google LLC. When the public IP from step 1 is on any other network, the tool labels the result “Different network from your public IP” and the table below tells you how to read it.
| VPN | Network of your public IP | Network of your resolver | What it means |
|---|---|---|---|
| On | The VPN | The same network | Lookups stay with the VPN: no DNS leak in that lookup |
| On | The VPN | Your home internet provider | DNS leak: lookups go around the tunnel |
| On | The VPN | A public DNS service | Not your provider, but that service sees your lookups |
| Off | Your internet provider | Your internet provider | Normal: there is no tunnel to leak from |
| Off | Your internet provider | A public DNS service | Your device or router is set to use that service |
Phones have no built-in terminal, so step 2 needs a computer on the same VPN. Step 1 works on any device.
What Is a DNS Leak?
DNS turns names such as example.com into IP addresses. Your device sends those lookups to a recursive resolver, and the IETF’s analysis of DNS privacy notes that the recursive resolver “sees all the DNS traffic” (RFC 9076). A VPN is meant to send lookups through its encrypted tunnel to a resolver the VPN chooses. A DNS leak is when they go to another resolver instead — usually the one your internet provider assigns. Typical causes are VPN software that does not take over the system’s DNS settings, a DNS server set by hand on the network adapter or router, split tunnelling that leaves some apps outside the VPN, and IPv6 traffic on a VPN that only carries IPv4. A WebRTC leak is a different problem: it exposes an IP address, not your lookups, so check it separately with the WebRTC Leak Test.
Why DNS Privacy Matters
Classic DNS is sent unencrypted, so it can be read on the path as well as by the resolver. RFC 9076 says the best place to tap is “between the stub resolvers and the recursive resolvers” — the hop between your device and its resolver. Two standards encrypt that hop: DNS over TLS (RFC 7858) and DNS over HTTPS (RFC 8484). Browsers can do it on their own: Chrome’s help page says secure DNS is turned on in automatic mode by default, and that Chrome falls back to an unencrypted lookup if that mode has a problem. Encryption hides lookups from the network path, not from the resolver you send them to, which is why the choice of resolver still matters. The Encrypted DNS Checker covers that side in more detail.
How to Fix a DNS Leak
- Turn on the DNS leak protection setting in your VPN app (it may be called “use VPN DNS”) and reconnect.
- Remove any DNS server you set by hand on the network adapter, so the VPN can replace it.
- If your VPN does not carry IPv6, switch on its IPv6 leak protection or turn IPv6 off on the device. A 2015 peer-reviewed study of 14 popular commercial VPN services found that the majority leaked IPv6 traffic.
- Check the secure DNS setting in your browser, so you know which provider receives its lookups.
- Run this test again, then check your address with the VPN Leak Test.
Last updated: October 2026
Frequently Asked Questions
What is a DNS leak?
A DNS leak is when your DNS lookups go to a resolver outside your VPN tunnel, usually the one run by your home internet provider. Your traffic is still encrypted, but that provider can see the name of every site you look up.
I am not using a VPN. Should I be concerned about DNS leaks?
Without a VPN there is no tunnel to leak from: your lookups normally go to your internet provider, which is expected. You can still limit who can read them on the network path by turning on encrypted DNS (DNS over HTTPS or DNS over TLS) in your browser or operating system.
How accurate is this browser-based DNS leak test?
Step 1 is exact about what it measures: the public IP and network that websites see, and whether two public DNS over HTTPS resolvers can be reached. It cannot see which resolver your device uses, so it never gives a leak or no-leak verdict by itself. Step 2 identifies the real resolver from a lookup you run on your own computer.
What is the difference between DNS leak and WebRTC leak?
A DNS leak exposes the site names you look up, through DNS queries that go around your VPN. A WebRTC leak exposes an IP address through the WebRTC feature used for video calls and peer-to-peer connections. They are separate mechanisms, so test both: use this DNS Leak Test and the WebRTC Leak Test.
Does using Cloudflare or Google DNS prevent DNS leaks?
Not by itself. A public DNS service only changes which resolver answers your lookups. If the VPN does not route DNS through its tunnel, lookups to any resolver can still travel outside it. DNS over HTTPS encrypts the lookups on the way to the resolver, but the resolver you choose still sees them.
How do I check if my DNS is leaking?
Connect your VPN, then find out which resolver answers your lookups: run nslookup -type=TXT whoami.ds.akahelp.net and read the address in the ns field. Look up who operates that address. If it is your home internet provider rather than your VPN, your DNS is leaking.
Can a website see which DNS server I use?
Not directly. Scripts on a page cannot read your DNS settings. A site can only learn your resolver indirectly, by making your browser look up unique hostnames under a domain whose name server records which resolver asked. This page does not run such a server, which is why step 2 uses a lookup you run yourself.