# Is your VPN leaking your DNS? > Free DNS leak test with WebRTC and IPv6 checks: see which DNS servers handle your lookups, which network owns them and how to fix a leak. In your browser. Free in-browser tool (no upload): https://www.mauriziofonte.it/tools/dns-leak-test A VPN hides your traffic, yet your DNS lookups can still leave through your internet provider and list every site you open. This test checks **DNS, WebRTC and IPv6** in a few seconds and tells you, in plain words, whether something leaks and through which network. ## How the test works 1. **Connect your VPN (if you use one)** - Turn the VPN on as you normally would, then open this page. You can also run the test without a VPN just to learn which DNS you are using. 2. **Start the check** - Your browser looks up a few throwaway domain names created for this test only. The authoritative server for those names records who asked: those are the DNS resolvers working on your behalf. 3. **We compare networks** - Each resolver is mapped to its network (its autonomous system) and compared with the network your traffic exits from. Traffic leaving through the VPN while DNS leaves through your provider is a leak. 4. **WebRTC and IPv6** - In the same run the browser is asked which addresses it would expose to a video call (WebRTC), and whether an IPv6 connection bypasses the VPN tunnel. 5. **Read the verdict** - Every check ends with a clear result and, when something is wrong, the fix for Windows, macOS, Android, iPhone, your browser or your router. ## What a DNS leak gives away Every site you open starts with a DNS lookup: your device asks a **resolver** to turn a name such as *mybank.com* into an IP address. In most setups that question travels in clear text and contains the name of the site. Whoever runs the resolver can keep a timestamped list of the sites you visit, even though the pages themselves are encrypted with HTTPS. Without a VPN the resolver is almost always your internet provider's, handed out by the router. With a VPN you expect the lookups to go through the tunnel to a resolver run by the VPN. When they do not, your traffic exits from one country and network while your DNS exits from another: you are paying to hide, and your provider still knows where you go. That is a **DNS leak**. Most online leak tests show a table of IP addresses and leave the interpretation to you. An address like *2620:171:63::227* means nothing to most people. Here every resolver is traced back to the network that owns it, named, and compared with the network you exit from, so the verdict comes already explained. ## How to read the result **Same network for traffic and DNS.** The usual picture when the VPN works: the resolver belongs to the same autonomous system as the address you exit from. No leak. Without a VPN you will see your provider's network for both traffic and DNS: consistent, just unprotected. **A well-known public resolver.** The resolver belongs to a public service such as Cloudflare, Google, Quad9, NextDNS or AdGuard. That is not necessarily a problem: many VPNs forward lookups to exactly these services, and if you picked one yourself you will find it here. We name the service so you can tell whether it is the one you expect. **A different, non-public network.** Your traffic exits from one network and your DNS from another that is not a public service. If you are on a VPN, that second network is nearly always your home or office provider: the classic leak, shown in red with the fixes below. **Several resolvers at once.** Seeing two or three addresses is normal, since large resolvers run many machines. What matters is the network, not the count. If even one resolver from your provider appears next to the VPN's, some lookups are escaping the tunnel. ## How to fix a DNS leak **In the VPN app.** Look for options named *DNS leak protection*, *use VPN DNS* or similar and turn them on, together with the *kill switch* that cuts the connection if the tunnel drops. If the app offers WireGuard or OpenVPN with its own DNS, prefer that over manual setups. **Windows.** Windows can send the same DNS question over every network adapter at once and use the fastest answer, your provider's included. The feature is called smart multi-homed name resolution. Good VPN clients neutralise it; if the leak persists, disable it with the group policy *Turn off smart multi-homed name resolution*, and make sure no DNS servers are hard-coded on your physical adapter. **macOS and iPhone.** An installed encrypted DNS profile, or an app that sets one, can take precedence over the VPN's DNS. Turn it off while the VPN is on, or let the VPN manage DNS. **Android.** Open *Settings, Network and internet, Private DNS* (the path varies a little between manufacturers). If a specific provider is set, lookups go there instead of the VPN's resolver. Choose *Automatic* or leave DNS to the VPN, and enable *Always-on VPN* with *Block connections without VPN*. **Browser.** Firefox, Chrome, Edge and Brave can use their own secure DNS (DNS over HTTPS), which bypasses the system and the VPN. The test then sees your browser's DoH provider rather than the VPN's resolver. If you want the VPN to decide, switch secure DNS off in the browser's privacy settings. **Router.** Some routers intercept every DNS query on the home network and hand it to the provider's resolver, whatever you configured. If the leak appears only at home and disappears on mobile data, the router is the likely cause. ## WebRTC and IPv6: the other two leaks **WebRTC** powers video calls in the browser. To connect two people it has to discover every address each of them can be reached on, and it does so by asking a STUN server. Any web page can trigger that with a few lines of JavaScript and no permission prompt. If the VPN does not route those requests, the STUN server sees your real address and the page reads it. Modern browsers hide local network addresses behind random names ending in *.local*, so you will rarely see them. The public address is what counts, and it should match the VPN's. **IPv6** is the newer addressing scheme, now enabled on many fibre and mobile connections. Several VPNs encrypt only IPv4: if your line has IPv6 and the VPN ignores it, sites reachable over IPv6 see your real address. The test tries to reach a service available only over IPv6 and tells you whether it succeeds and from which network. ## What we contact and what we keep The test runs in your browser. To see your resolvers it uses domain names served by **ipleak.net**, a public service built for this purpose: your browser looks up a random name and ipleak.net answers with the addresses of the resolvers that asked for it. Your public address and provider name come from **ipwho.is**; each resolver's network comes from **Team Cymru**'s IP-to-ASN mapping, queried through Cloudflare's DNS over HTTPS. The IPv6 check uses **ipify** and the WebRTC check Cloudflare's public STUN server. Those services see the request the way any website you visit would. We never receive the results: there is no server of ours collecting them and nothing is stored. If one of the services is blocked by your own protection, the test says so instead of guessing. ## Glossary - **DNS**: The system that turns site names into IP addresses. Every visit to a site starts with a DNS lookup. - **Resolver**: The server that performs DNS lookups on your behalf and returns the answer. Usually your provider's, your VPN's or a public service. - **DNS leak**: DNS lookups leaving through a network other than the VPN, usually your provider's, which reveals the sites you visit. - **Autonomous system (AS)**: A set of networks run by one operator and identified by a number. Comparing AS numbers tells whether two addresses belong to the same operator. - **WebRTC**: The browser technology behind video calls and peer-to-peer transfers. It can expose your real IP address when the VPN does not cover it. - **STUN**: The protocol WebRTC uses to find out which public address you are seen with on the internet. - **DNS over HTTPS (DoH)**: DNS encrypted inside an HTTPS connection. It protects lookups on the way, but the DoH provider you choose still sees them. - **Kill switch**: A VPN option that blocks all traffic when the tunnel drops, so nothing leaves unprotected. ## Frequently asked questions ### What exactly is a DNS leak? You are connected to a VPN, yet your DNS lookups, the requests that find the address of each site, travel outside the tunnel to your provider's resolver. Your provider then sees the names of the sites you visit, and hiding them was the reason for the VPN. ### Does the test work without a VPN? Yes. Without a VPN it shows which resolver you are using and who owns it: usually your provider, sometimes a public service you or your router picked. That is not a leak, since there is no tunnel to escape from, but it tells you who sees your lookups. ### I use a VPN and see Cloudflare or Google DNS. Is that a leak? Not necessarily. Many VPNs forward DNS to these public services. It becomes a concern if you did not choose it and the VPN advertises its own DNS: check the DNS settings of the VPN app and of your browser. ### Why do I see several different DNS addresses? Large resolvers run many machines, so the same lookup can come from different servers. What matters is the network they belong to. All from the VPN or a public service you chose is fine; if your provider's network shows up too, some lookups escape the tunnel. ### The test says my DNS is my browser's. What does that mean? Your browser is using its own secure DNS (DNS over HTTPS) and bypasses both the system and the VPN, so the test sees the service selected in the browser. If you want the VPN to decide, turn secure DNS off in the browser's privacy settings. ### What is a WebRTC leak and should I worry? A page can silently ask your browser which addresses you can be reached on for a video call. If the VPN does not cover those requests, the page reads your real address. If the test reports a public address different from the VPN's, enable WebRTC protection in the VPN app or use an extension that restricts it. ### My connection has IPv6. Is that a risk with a VPN? It is when the VPN handles only IPv4: sites reachable over IPv6 then see your real address. The test checks this. If it finds an IPv6 connection outside the VPN's network, enable IPv6 protection in the app or disable IPv6 on your network adapter while the VPN is on. ### Do you collect my IP address or the results? No. The test runs in your browser and talks directly to a few public services (ipleak.net, ipwho.is, Team Cymru, Cloudflare, ipify and a STUN server), which see the request like any website would. We do not receive or store the results. ### The test cannot see my resolvers. Why? An ad blocker, firewall or filtering DNS is probably blocking ipleak.net, or a corporate network forbids external DNS lookups. You still get your public address, WebRTC and IPv6 results, and the test states that DNS cannot be verified from this network. ### I changed the settings and still leak. What next? Restart the browser, flush the system DNS cache and test again. If the leak only shows up at home, try another network: some routers intercept DNS queries and answer them themselves. As a last step, send the verdict screenshot to your VPN's support: it names the networks involved. ### Does an all-green result make me anonymous? No. It means DNS, WebRTC and IPv6 do not give away your real network, which is a lot. Sites can still recognise you through cookies, the account you log in with or your browser fingerprint. ## Sources used - [RFC 1034, Domain names: concepts and facilities](https://www.rfc-editor.org/rfc/rfc1034): how name resolution works - [RFC 8484, DNS Queries over HTTPS (DoH)](https://www.rfc-editor.org/rfc/rfc8484) - [RFC 8445, Interactive Connectivity Establishment (ICE)](https://www.rfc-editor.org/rfc/rfc8445): how WebRTC gathers addresses - [RFC 8489, Session Traversal Utilities for NAT (STUN)](https://www.rfc-editor.org/rfc/rfc8489) - [ipleak.net](https://ipleak.net/): public service used to see the resolvers - [Team Cymru, IP to ASN mapping](https://www.team-cymru.com/ip-asn-mapping): network that owns each resolver --- Tool by Maurizio Fonte, senior backend engineer. All tools: https://www.mauriziofonte.it/tools/