Free Tool

DNS Leak Test

See which DNS servers answer your lookups, and whether your VPN is leaking them

Running DNS leak test…

This takes about 10 seconds

What Is a DNS Leak?

Before your device can open a website, it asks a DNS server to turn the name, such as example.com, into an IP address. Whoever runs that DNS server sees the name of every site and app your device connects to, and when.

A VPN should send those lookups through its encrypted tunnel to a DNS server it trusts. A DNS leak happens when some of them go around the tunnel to your internet provider instead. Your traffic is encrypted, but your provider can still list the sites you visit.

This test makes your device look up a few random names that only our DNS server can answer. Your device's DNS server has to ask ours, so we can see which DNS servers did the lookups and who runs them. If you're on a VPN and one of them belongs to your internet provider, your DNS is leaking.

How to Fix a DNS Leak

Change the setting that applies to you, then run the test again

Android

Open Settings → Network & internet → Private DNS and choose Automatic or Off while you use a VPN, so lookups go to the VPN's DNS. If you use split tunnelling, keep your browser inside the tunnel.

Windows

Windows can send lookups to every network adapter at once, so some skip the VPN. Use a VPN app that sets its own DNS and routes all traffic, and remove custom DNS servers from your Wi-Fi or Ethernet adapter.

Browser

Chrome, Edge, Firefox and Brave have a Secure DNS (DNS over HTTPS) setting that can send lookups to a provider of their own choosing. Set it to use your current provider, or turn it off, if you want the VPN's DNS to answer.

Router

A router set to use your provider's DNS doesn't cause a leak by itself: with a full-device VPN, lookups go through the tunnel first. It matters only on devices without a VPN.

On Android, the SafePassVpn app sends your lookups through the WireGuard tunnel to the VPN server's own DNS when ad blocking is on, or to Cloudflare's 1.1.1.1 inside the tunnel when it's off. Either way, your internet provider can't see them. To check the rest of your connection, run the WebRTC leak test and the IP checker. Want to switch resolvers? See our list of public DNS servers.

Need Help?✨

DNS Leak FAQs

Common questions about DNS leaks and how to keep your lookups private.

It shows which DNS servers answer your device's lookups and which network each belongs to. If you're on a VPN and one of them is your internet provider's, your DNS is leaking.

Not necessarily. Many VPNs, including SafePassVpn with ad blocking off, use a public DNS service through the tunnel. It's a leak only when the lookups reach a DNS server outside the VPN, usually your internet provider's.

Large DNS services answer from many machines, so one test often shows several addresses from the same company. That's normal. What matters is who runs them.

Not directly. It reveals the sites you look up to whoever runs the DNS server, usually your internet provider, which already knows who you are. To check your IP, use the IP checker and the WebRTC leak test.

Yes. It's free, needs no sign-up, and runs in your browser. The list of DNS servers is deleted from our server two minutes after the test.

Private DNS on Android

Keep Your Lookups Private with SafePassVpn

SafePassVpn sends your whole device, DNS included, through an encrypted WireGuard tunnel, so your internet provider can't see the sites you visit.

Download SafePassVpn Free View Plans