--- title: "DNS Leak Test: How to Run One and Fix a VPN DNS Leak" description: "Run a DNS leak test, read whose servers answered, and fix browser, IPv6 and WebRTC leaks so your website lookups stay inside the VPN tunnel." url: "https://tunnelverdict.com/blog/dns-leak-test/" lang: "en" published: "2026-02-05" modified: "2026-10-29" tags: ["privacy","troubleshooting","computer","guide"] image: "https://tunnelverdict.com/blog/dns-leak-test/featured.jpg" alternates: es: "https://tunnelverdict.com/es/blog/prueba-de-fuga-dns.md" --- Guide # How to Run a DNS Leak Test and Fix a Leak Run a DNS leak test, read whose servers answered, and fix browser, IPv6 and WebRTC leaks so your website lookups stay inside the VPN tunnel. Tunnel Verdict Published February 5, 2026 ![A desk lamp lighting a home office desk with a laptop and a cup of tea at night](https://tunnelverdict.com/blog/dns-leak-test/featured.jpg) Connect your VPN, note the server location and public IP shown by the app, then run a DNS test at `dnsleaktest.com` or BrowserLeaks. If the result shows your regular ISP, review the VPN app, browser DNS, IPv4 and IPv6 settings before trusting the connection for ordinary browsing. A clean DNS result means the tested requests went through the displayed resolvers at that moment. It does not prove that your public IP, WebRTC traffic, accounts, cookies or device signals are hidden. Run separate IP-address and WebRTC checks, and repeat the DNS test after changing networks, browsers, protocols or split-tunneling settings. Key takeaways - Connect the VPN and compare the DNS organizations with your ISP and VPN location. - Use the Standard test for a quick result and the Extended test for more resolver entries. - Remove manual DNS settings and review browser Secure DNS, IPv6 and kill-switch controls. - Test each browser you use because browser DNS and WebRTC behavior can differ. - Read the provider’s privacy policy, logging terms and current platform support before paying. ## What A DNS Leak Test Can Tell You DNS, or the Domain Name System, translates a name such as `example.com` into an IP address. A DNS leak happens when a VPN-connected device sends those lookups outside the VPN tunnel, often to the internet service provider’s resolver. The ISP or another DNS operator may then see the domains being resolved. A DNS leak test identifies the resolvers that answer its requests. If the result names your actual ISP or recognizable ISP DNS infrastructure, the requests may be reaching the ISP. If it shows the VPN provider or an infrastructure company associated with the VPN server, the result is consistent with the VPN handling DNS. A third-party resolver needs more context. It may be part of the VPN’s infrastructure, or it may be receiving requests through a separate browser or operating-system setting. Identify the resolver’s organization and compare it with the VPN provider’s documentation before treating the result as clean. The result is limited to the requests made during that test. It does not prove total privacy, anonymity or protection from every tracking method. Websites can still recognize you through an account, cookies, browser signals, device information or details you enter. The FTC says a VPN app can intercept internet traffic and does not automatically make a person anonymous. ## How To Run A DNS Leak Test On Your VPN Start with the VPN’s official app on a supported, updated version of your device’s operating system. Check that the app shows a connected status, note the selected VPN server location and record the public IP shown by the app or an IP-address checker. Then open the DNS test in the browser you normally use. ![A laptop and a phone side by side on a kitchen table beside a mug](https://tunnelverdict.com/blog/dns-leak-test/kitchen-table-laptop-phone.jpg) For a quick check, use the Standard test at `dnsleaktest.com`. The site sends six DNS queries in one round and lists the servers that resolve them. Select the Extended test when you want more entries. It sends 36 queries in six rounds and can take 10 to 30 seconds longer. BrowserLeaks uses a different method. Its DNS test resolves 50 randomly generated domains, including 25 IPv4-only names and 25 IPv6-only names. That makes it useful when you want to see whether IPv6 behaves differently from IPv4. Standard, Extended and BrowserLeaks DNS tests | Test | What it sends | Fits when | | --- | --- | --- | | dnsleaktest.com Standard | Six DNS queries in one round | You want a quick check | | dnsleaktest.com Extended | 36 queries in six rounds; can take 10 to 30 seconds longer | You want more resolver entries | | BrowserLeaks | 50 randomly generated domains, 25 IPv4-only and 25 IPv6-only | You want to see whether IPv6 behaves differently from IPv4 | Read the organization, IP address and location shown for each resolver. Compare those details with the ISP you use when disconnected and with the VPN server location. Do not rely on the country label alone. A hosting or infrastructure provider may appear instead of the VPN brand. Repeat the process while disconnected if you need a baseline. Then reconnect and test each browser you use regularly. Repeat the check after changing Wi-Fi or mobile networks, VPN protocols, IPv6 settings or split-tunneling rules. A browser can use its own DNS behavior, so one browser’s result does not represent every application on the device. Run a DNS leak test 1. Connect the VPNUse the official app on a supported, updated version of your operating system, and check that it shows a connected status. 2. Record the detailsNote the selected VPN server location and the public IP shown by the app or an IP-address checker. 3. Run the testOpen the DNS test in the browser you normally use. Choose Standard for a quick check or Extended for more entries. 4. Read each resolverCompare the organization, IP address and location with your ISP and the VPN server location. 5. Set a baselineRepeat the process while disconnected if you need one. 6. Test each browserReconnect and test each browser you use regularly, then repeat after changing networks, protocols, IPv6 settings or split-tunneling rules. No paid VPN plan is needed to run these tests. Before buying, check the provider’s current United States pricing, renewal terms, refund rules and supported devices directly. A free tier, a free trial and a money-back window are different arrangements, so confirm which one the provider actually lists. ## How To Read The DNS Servers In Your Result The organization field is usually the most useful starting point. If it identifies your home ISP, mobile carrier or familiar ISP DNS infrastructure while the VPN is connected, DNS requests may be bypassing the VPN. Proton VPN says that seeing an IP belonging to the real ISP indicates a DNS leak. A VPN result may list the provider’s own DNS service or a hosting company connected with the VPN location. Proton VPN says its apps route DNS through the tunnel to Proton’s DNS servers, while also noting that infrastructure partners may appear in results. The organization does not have to match the VPN brand exactly. A third-party DNS provider is not automatically proof of a leak. The requests could be traveling inside the VPN tunnel to a resolver the provider uses. They could also be bypassing the VPN because of a manually configured resolver, browser Secure DNS or DNS-over-HTTPS. Identify the resolver’s organization and confirm whether the VPN provider documents it as expected infrastructure. Run the same test with the VPN disconnected if you want a clear comparison. Look for changes in the listed organizations, IP addresses and locations. If the connected result still resembles the disconnected ISP result, continue with the configuration checks below. ## How To Fix A DNS Leak In The VPN App, Browser And Device Begin with the VPN provider’s official app rather than a manually configured connection. Sign in, update the app when an applicable version is available and turn on its DNS leak protection if the setting is separate from the main connection control. Proton VPN says manually configured DNS settings can override its built-in protection. ![A desktop computer and monitor on a tidy desk with a hand resting on the mouse](https://tunnelverdict.com/blog/dns-leak-test/desktop-tower-mouse.jpg) Check the network adapter next. Remove DNS addresses entered manually and select automatic DNS for IPv4. Proton’s Windows instructions also say to repeat the process for IPv6 when it applies. Restart the VPN connection and run the test again after changing these settings. Review browser DNS controls because they can create a path outside the VPN client. `dnsleaktest.com` says browser Secure DNS can bypass DNS managed by the operating system or VPN app. Chrome, Brave, Opera and Edge provide Secure DNS controls, while Firefox provides DNS-over-HTTPS modes. Google says Chrome Secure DNS encrypts lookups, but automatic mode can fall back to unencrypted DNS when lookups fail. A custom provider prevents that fallback, but it may send DNS requests to a resolver separate from the VPN. Microsoft says Edge Secure DNS encrypts DNS queries. Mozilla documents Default, Increased, Max, Custom and Off DNS-over-HTTPS modes. Default protection can turn off DNS-over-HTTPS when a VPN or network policy signals that it should not be used. Max or Custom protection can force a selected resolver. If the VPN provider says its own DNS must handle requests, disable a browser-level resolver that bypasses the VPN, then retest. Review IPv6 as well. Proton VPN documents platform-specific IPv6 behavior and says some of its apps disable IPv6 to prevent accidental exposure. Other providers may support IPv6 and require it to be enabled in the app. Follow the provider’s current platform-specific IPv6 instructions instead of applying one setting to every device. Turn on the VPN kill switch if the provider supplies one. Proton VPN says a connection interruption can send DNS requests to the system’s normal resolver and recommends the kill switch for that risk. A kill switch can block internet access during an interruption and may interfere with local-network use, so check the setting’s behavior before relying on it. If the ISP still appears, look for other software managing the connection. Another VPN, antivirus product, parental-control tool or DNS filter can change the resolver path. Disable conflicting controls one at a time, reconnect the VPN and retest. If the result remains unchanged, contact the provider with the app version, operating system, browser and resolver entries. Fix a DNS leak 1. Use the official appSign in, update the app and turn on its DNS leak protection if the setting is separate. 2. Check the network adapterRemove manually entered DNS addresses and select automatic DNS for IPv4, then repeat for IPv6 when it applies. Restart the VPN connection and retest. 3. Review browser DNSCheck Secure DNS or DNS-over-HTTPS. If the provider says its own DNS must handle requests, disable a browser-level resolver that bypasses the VPN, then retest. 4. Review IPv6Follow the provider's current platform-specific IPv6 instructions. 5. Turn on the kill switchUse it if the provider supplies one, and check how it behaves before relying on it. 6. Look for conflicting softwareDisable another VPN, antivirus product, parental-control tool or DNS filter one at a time, reconnect the VPN and retest. Nettitude’s April 8, 2024 penetration-test report examined DNS leakage involving split tunneling in specific ExpressVPN Windows application versions on Windows 10 and 11. It reported a vulnerability in older versions, followed by remediation and later retesting. That report applies to the tested versions and configurations, not every VPN or current release. If you use split tunneling, review the provider’s current rules carefully. ## DNS, IP And WebRTC Leaks Are Different Tests A DNS test identifies the servers handling domain lookups. An IP-address test shows the public IP that websites can see. A WebRTC test checks whether browser communications can expose an address through browser networking features. What each leak test identifies | Test | What it identifies | | --- | --- | | DNS | The servers handling domain lookups | | IP address | The public IP that websites can see | | WebRTC | Whether browser communications can expose an address through browser networking features | These paths can produce different results. Your IP-address test may show a VPN server while DNS requests still go to the ISP. DNS may use the VPN’s resolver while an IPv6 or WebRTC path exposes a separate address. A clean DNS result does not replace the other checks. ExpressVPN’s WebRTC documentation explains that browsers can expose public IPv6 addresses through ICE, STUN or TURN mechanisms, and browser behavior can differ. Run an IP-address check and a WebRTC check separately after the DNS test. The VPN changes the public IP websites normally see and encrypts the connection between your device and the VPN server. It does not stop a website from recognizing an account, cookie, browser pattern or device signal. For the separate IP question, use [Does a VPN Change Your IP Address and Location](https://tunnelverdict.com/blog/does-a-vpn-change-your-ip-address/). ## The Settings And Software Conflicts That Can Cause A Leak Manual DNS entries are a common cause because they can override the VPN app’s expected resolver. Browser Secure DNS and DNS-over-HTTPS can create another path, even though they encrypt the lookup between the browser and its selected resolver. Encryption alone does not prove that the VPN handled the request. ![A bedroom desk with a laptop, headphones and a stack of textbooks](https://tunnelverdict.com/blog/dns-leak-test/teen-desk-textbooks.jpg) IPv6 can behave differently from IPv4. A VPN provider may disable IPv6 on some platforms to prevent accidental exposure, while another provider may support it through an app setting. Check the provider’s current instructions for your operating system rather than assuming that an IPv4 result covers IPv6. A VPN connection can also conflict with another VPN, antivirus filter, parental-control service or custom DNS tool. Split tunneling adds another configuration decision because selected applications may use a different route. Nettitude’s report shows why software version and configuration matter when interpreting a documented DNS issue. A kill switch changes the tradeoff during a connection failure. It can block traffic until the VPN reconnects, reducing the chance that traffic returns to the normal network path. It can also prevent local-network access or ordinary browsing while the connection is down. Browser settings may differ from one browser to another. Test Chrome, Edge, Firefox or another browser separately if you use more than one. After changing a setting, reconnect the VPN and run the DNS, IP-address and WebRTC checks again. ## What A VPN Does Not Hide And What Services May Block A VPN does not hide activity from every service. Search engines and websites can associate activity with accounts, cookies, browser identifiers and information you provide. The VPN provider may also receive traffic routed through its servers, subject to its technical design, logging practices and privacy policy. ![A home office desk seen through a frosted glass partition with a laptop and a mug](https://tunnelverdict.com/blog/dns-leak-test/frosted-glass-office.jpg) Your ISP can normally see that the device is connecting to the VPN service, even though the VPN can change the public IP presented to websites. A VPN works alongside software updates, account security and phishing protection. It does not replace those controls. Streaming and banking services may treat a VPN connection differently. Netflix says VPN or proxy use can cause its location or proxy error, and that VPNs are unsupported for live events and ad-supported experiences. If Netflix shows a proxy message, work through the [Netflix proxy error fixes](https://tunnelverdict.com/blog/netflix-vpn-proxy-error/). Confirm the current terms of the website, network or service you are accessing, as well as the law that applies where you are. ## What To Check Before Buying A VPN Check that the provider documents DNS leak protection, IPv6 handling, kill-switch behavior and browser compatibility for your device. Read the privacy policy, logging terms, permissions and service terms because the VPN receives access to traffic that would otherwise pass through the ISP or local network. Confirm the provider’s current United States price and renewal amount at checkout. Also check the billing term, amount due upfront, effective monthly cost, bonus time if any, refund window and supported devices. A free tier, free trial and money-back window are separate things. A conditional pick is simple: choose a provider whose app supports your device and whose DNS, IPv6 and kill-switch controls match how you plan to use it. If you need a phone setup, use [How to Use a VPN on an iPhone](https://tunnelverdict.com/blog/vpn-on-iphone/). If the issue is a failed connection rather than DNS settings, use [VPN Not Connecting? Fixes for Phone, PC and Wi-Fi](https://tunnelverdict.com/blog/vpn-not-connecting/). **Quiz: Comprueba lo aprendido** 1. ¿Qué envía la prueba Standard de dnsleaktest.com? - Seis consultas de DNS en una sola ronda **(correct answer)** - 36 consultas en seis rondas - 50 dominios generados al azar 2. Tu prueba de dirección IP muestra un servidor de VPN. ¿Eso demuestra que las consultas de DNS también usan la VPN? - Sí, las dos pruebas siempre coinciden - No; las consultas de DNS pueden seguir yendo al ISP mientras la prueba de IP sale limpia **(correct answer)** - Solo si el interruptor de emergencia de la VPN está desactivado 3. Aparece un proveedor de DNS de terceros en tu resultado mientras la VPN está conectada. ¿Qué significa? - Es automáticamente una fuga - Es automáticamente un resultado limpio - Necesita contexto, porque puede ser infraestructura de la VPN o una ruta que evita la VPN **(correct answer)** ## Frequently asked questions ### What is a DNS leak? A DNS leak occurs when a VPN-connected device sends domain lookups outside the VPN tunnel, commonly to the ISP’s resolver. The DNS result can show which organizations answered those requests, but it does not measure every privacy or tracking path. ### How do I run a DNS leak test? Connect the VPN, note its server location and public IP, then run the Standard or Extended test at `dnsleaktest.com`, or use BrowserLeaks. Test each browser you use and compare the connected result with a disconnected baseline. ### What does a DNS leak test result mean? The result lists the DNS resolvers that answered the test queries. An ISP organization suggests that requests may be reaching the ISP, while a VPN or documented infrastructure partner is consistent with the VPN handling DNS. ### How do I fix a DNS leak? Use the VPN provider’s official app and DNS protection, remove manual DNS entries, review IPv4 and IPv6 settings, and check browser Secure DNS or DNS-over-HTTPS. Enable the kill switch if available, then reconnect and repeat the test. ### What is the difference between a DNS leak test and an IP leak test? A DNS test identifies the resolvers handling domain lookups. An IP test identifies the public IP visible to websites, so one can appear clean while the other exposes a separate path. ### Does a VPN hide your IP address from your ISP? A VPN usually changes the public IP websites see, but the ISP can still see that the device is connected to the VPN service. The FTC says a VPN does not make the user entirely anonymous. ### Can VPNs see what you search? A VPN provider can receive traffic routed through its servers, depending on its technical design, logging practices and privacy policy. Search engines and websites can still associate searches with accounts, cookies, browser signals or information entered by the user. ### How do I know if my VPN is on? Check for the connected status in the VPN app, compare the public IP with the address shown before connecting and run a DNS test. A connected indicator alone does not prove that DNS, IPv6 and WebRTC traffic use the VPN. ### Can someone be tracked while using a VPN? Yes. Accounts, cookies, device signals, browser behavior and details you enter yourself can identify activity. A VPN reduces what the ISP or local Wi-Fi operator sees, but it does not make a person untraceable. ## Glossary **DNS:** The Domain Name System, which translates a name such as example.com into an IP address. **DNS leak:** DNS lookups sent outside the VPN tunnel, often to the ISP's resolver. **Resolver:** A DNS server that answers the lookups a device sends. **Secure DNS:** A browser setting that encrypts DNS lookups. It can bypass DNS managed by the operating system or VPN app. **DNS-over-HTTPS:** The Firefox form of encrypted browser DNS, with Default, Increased, Max, Custom and Off modes. **IPv6:** An address format that can behave differently from IPv4, so it needs its own check. **WebRTC:** Browser communication features that can expose an address through ICE, STUN or TURN mechanisms. **Kill switch:** A VPN setting that can block internet access during an interruption so traffic does not return to the normal path. Find more VPN guides on [Tunnel Verdict](https://tunnelverdict.com/). Have a question about your own setup? [Contact us](https://tunnelverdict.com/contact/) and include your device and the VPN you use. - Privacy - Troubleshooting - Computer - Guide Keep reading ## More VPN guides and reviews Guide ### [Do Laptop and Phone Privacy Screens Work?](https://tunnelverdict.com/blog/laptop-privacy-screen/) Privacy screens darken side views, not the view from in front. Compare clip-on filters with Lenovo PrivacyGuard and HP Sure View, costs and fit. [Read Do Laptop and Phone Privacy Screens Work?](https://tunnelverdict.com/blog/laptop-privacy-screen/) Guide ### [Why Your VPN Slows Down Your Internet and What Helps](https://tunnelverdict.com/blog/vpn-slowing-down-internet/) VPN slowing down internet? Compare speed, fix the main causes, choose the right protocol, and check plans, renewals, devices, and limits. [Read Why Your VPN Slows Down Your Internet and What Helps](https://tunnelverdict.com/blog/vpn-slowing-down-internet/) Guide ### [VPN Not Connecting? Fixes for Phone, PC and Wi-Fi](https://tunnelverdict.com/blog/vpn-not-connecting/) Fix VPN not connecting problems on phones, Windows 11 and Wi-Fi with server, protocol, kill switch and network troubleshooting steps. [Read VPN Not Connecting? Fixes for Phone, PC and Wi-Fi](https://tunnelverdict.com/blog/vpn-not-connecting/)