DNS 泄漏检测

DNS leak test — you connected a VPN, but is your browser's DNS query actually going through the tunnel? The check below measures the recursive DNS server that really resolves for you and tells you whether it fell back to your local ISP.

What is a DNS leak

Every site you open starts with a DNS query that resolves the domain to an IP. Behind a VPN, that query should also travel the encrypted tunnel and be answered by the VPN's resolver. A DNS leak is when your web traffic uses the VPN but the DNS query bypasses the tunnel and falls back to your local ISP's resolver — exposing your real ISP, your region, and which domains you visit to that ISP.

Why a DNS leak matters

• Reveals your real region and ISP: a resolver on your local ISP tells the other side where you are and whose network you use.
• Your browsing is visible to the local ISP: even when page content is HTTPS, the domain in the DNS query is plaintext, so the ISP can log which sites you visit.
• Geo-unblocking / split routing breaks: many services judge region by DNS resolution; a leak causes failures or detection.
• Risk-control flags: a mismatch between exit and DNS region is a common proxy-detection signal in account / payment risk control.

How this tool detects it

We trigger resolution of a one-time random subdomain and let our own authoritative DNS record the recursive resolver IP that actually queries on your behalf, then decide whether it sits outside the tunnel:

• You are behind a VPN / proxy (a tunnelled / datacenter exit) but the resolver is on a consumer ISP (residential / mobile) network → DNS fell back to the local ISP, flagged as a leak — this catches even same-country leaks;
• or the resolver is in a different country than your exit → your real location leaks;
• the resolver is public DNS (e.g. Google, Cloudflare) or a VPN-provider resolver (datacenter / anycast) → treated as a normal path and not flagged, to avoid false positives.

How to fix a DNS leak

• Enable "DNS leak protection / force tunnel DNS" in your VPN client so every query goes to the VPN's resolver;
• Turn off custom local DNS set in the OS or browser (unless it is itself tunnelled);
• Mind IPv6 leaks: many VPNs only tunnel IPv4 while IPv6 DNS still goes local — either confirm IPv6 is tunnelled or disable IPv6;
• Check whether router / system-level DNS is hard-coded to the local ISP;
• Point the browser's "Secure DNS / DoH" at a trusted resolver rather than overriding the VPN's setting.

FAQ

Is a DNS leak the same as an IP leak?

No. An IP leak exposes your real exit IP (often via WebRTC or dual-stack split routing); a DNS leak is the resolution step bypassing the tunnel. They happen independently — to see everything at once, run the full deep check.

Can a DNS leak happen within the same country?

Yes, and it is the most subtle case. This tool handles it: whenever the recursive resolver sits on a consumer ISP network (your local ISP), it is flagged as a leak even if it is in the same country as your exit.

Why does a DNS leak still happen on a VPN?

Usually because DNS leak protection is off, the OS hard-codes a local DNS, or IPv6 is not covered by the tunnel.

Can it be detected with DoH / DoT on?

Not always. If the browser or OS uses DNS-over-HTTPS (e.g. Firefox's default Cloudflare DoH), DNS goes over an encrypted direct connection that bypasses the system resolver, so a "recursive-resolver capture" test may not observe the local ISP — a blind spot shared by all tools of this kind.

If a leak shows up and you want to know whether your exit is seen as a proxy, whether AI is usable, or whether there is a WebRTC / dual-stack leak, run the full deep check, or do the split-routing diagnosis on its own.