DNS leak
A DNS-leak test tells you whether your name lookups are travelling through the VPN or escaping to your ISP's resolver. We can explain it, but we will not show you a result we cannot yet measure honestly.
Resolver test
In development, requires our own DNS infrastructure
A real DNS-leak test has to watch which resolver actually performs a lookup, which means running our own authoritative name server and recording the resolver that queries it. We have not built that, and routing your lookups through a third party's widget would betray the same values the rest of this site keeps. So there is no result here, an honest gap, not a broken gauge.
What a DNS leak is
Before your device can reach a website it looks up the name, turning example.com into an address, by asking a DNS resolver. That resolver sees every domain you visit, even when the page contents are encrypted.
On a VPN, those lookups are supposed to run through the provider's resolver inside the tunnel. A DNS leak is when they don't: the request slips out to the resolver your ISP configured instead. Your traffic may be tunnelled, but the list of sites you visit is still handed to your ISP, the exact exposure the VPN was meant to close. It is quieter than an IP leak because nothing on the page looks wrong.
What you can measure here now
Two of the related checks are real and run today:
- WebRTC leak test , gathers ICE candidates in your browser and shows any address it exposes, with nothing sent off-device.
- IP check , the public address a website sees, read back from our own server.
When the resolver test ships it will live here, and it will keep no record of what it reads, the same promise the other tools already make.