What is a DNS Leak?

What is a DNS leak?

A DNS leak means DNS traffic bypasses an intended protection path, such as a VPN tunnel. With unencrypted DNS, observers on that path can see queried domain names. A query does not reveal the complete URL or prove an actual website visit, for example because of prefetching or background services.

Possible causes

Incorrect routes, split tunneling, uncovered IPv6 connections or a VPN disconnect can create unexpected DNS paths. Browsers may use their own encrypted resolver. A different resolver is therefore not automatically a leak. The question is whether the actual connection matches the intended protection model.

How does a reliable test work?

The browser resolves random test names. An authoritative DNS service observes which recursive resolver queries them. It sees the resolver's exit address, not necessarily the DNS-server address configured on your device. An HTTP request to a web server cannot replace this observation. Our test explicitly reports when verified DNS collection is unavailable.

Results and remedies

Compare results with your VPN provider's documented resolvers and repeat after connection changes. DoH and DoT encrypt traffic to the resolver but do not force it through the VPN. Review DNS routing, IPv6 and kill-switch settings together. No observed resolvers mean an incomplete result, not confirmed safety.