A DNS leak test shows which DNS servers resolve your lookups while your VPN is on. If you see your ISP's DNS servers instead of your VPN's, your browsing is leaking. Below you learn what DNS does, what causes DNS leaks, how to test for them and how to fix them. For the overview of where DNS leaks fit among other privacy threats, see our online privacy check.

What is DNS?

DNS stands for Domain Name System. It is the internet's address book. When you type "speediq.org" into your browser, your device sends a DNS query to a DNS server and asks: "What is the IP address for this domain name?" The DNS server answers with an IP address, and your browser connects to it.

By default, your device uses the DNS servers of your Internet Service Provider (ISP), usually handed out by your router. This means your ISP sees a log of every domain you query. That is effectively a record of every website you visit, even if the connection itself is encrypted with HTTPS.

What is a DNS leak?

A DNS leak occurs when your DNS queries travel outside your VPN tunnel, typically to your ISP's DNS servers, even though you are connected to a VPN. The result: your ISP can see which websites you visit, which defeats the core privacy purpose of your VPN.

DNS leaks are among the most common VPN privacy failures. They are easy to miss because everything looks normal: your IP address shows the VPN's IP, pages load, nothing seems wrong, but your browsing history is visible to your ISP. A related problem is a transparent DNS proxy: some ISPs intercept DNS traffic on port 53 and answer it themselves, even if you set a different DNS server.

What causes DNS leaks?

Most DNS leaks come from the operating system choosing a DNS server outside the tunnel, from IPv6 traffic the VPN ignores, or from a VPN client without leak protection.

Operating system DNS handling

Windows 10 and 11 have a feature called "Smart Multi-Homed Name Resolution". According to Microsoft, it issues parallel DNS, LLMNR and NetBIOS queries across all networks to speed up name resolution. With a VPN active, this can send DNS queries through your normal network adapter as well, which causes DNS leaks.

IPv6 DNS leaks

If your network uses IPv6 and your VPN only handles IPv4 traffic, IPv6 DNS queries can bypass the VPN entirely. See our IPv6 leak test guide for detection details.

Manual DNS settings and VPN clients

A DNS server set by hand on the device or router can override the VPN's DNS. VPN apps without DNS leak protection, or manual VPN setups without a DNS entry, keep using the old server too.

How does a DNS leak test work?

A full DNS leak test makes your browser look up several unique, random hostnames under a test domain. The test operator runs the authoritative DNS server for that domain, so it sees which resolvers ask for these hostnames. The resolver IPs and their owners are your result. If an ISP resolver shows up while your VPN is on, you have a DNS leak.

The SpeedIQ DNS check is simpler. It looks up the provider behind your IP address through ipinfo.io. This gives a useful hint, but it is not a full DNS leak test, because it does not see which resolver answers your lookups. Use it together with a dedicated leak test, for example dnsleaktest.com.

How to test for DNS leaks

  1. Disconnect from your VPN. Run a DNS leak test and note which DNS servers appear. These are usually your ISP's.
  2. Connect to your VPN. Run the DNS leak test again.
  3. Analyze the results. If you still see your ISP's DNS servers after connecting to your VPN, you have a DNS leak. If you only see servers of your VPN provider or of the resolver your VPN uses, you are fine.

Repeat the test after app updates, on every device you use, and on new networks such as hotel Wi-Fi. While you are at it, also check for a WebRTC leak, which exposes your IP in a different way.

How to fix DNS leaks

Turn on DNS leak protection in your VPN app first; then fix the operating system and add encrypted DNS as a backstop.

Enable DNS leak protection in your VPN

Most reputable VPN clients have a built-in DNS leak protection setting. Enable it, and also enable your VPN's kill switch, which blocks traffic if the tunnel drops.

Fix DNS leaks on Windows

Press Win + R, type gpedit.msc, go to Computer Configuration → Administrative Templates → Network → DNS Client, and set "Turn off smart multi-homed name resolution" to "Enabled". The Group Policy editor is available in Windows Pro, Enterprise and Education editions. This setting stops the parallel queries; it does not replace leak protection in the VPN app.

Use encrypted DNS as a fallback

DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt your DNS queries, so your ISP cannot read them on the way. Many browsers and operating systems support them. Encrypted DNS does not hide your traffic from the DNS provider you choose, so pick one you trust.

FixWhat it doesLimit
VPN DNS leak protectionForces DNS through the tunnelOnly works while the VPN app runs
Kill switchBlocks traffic if the tunnel dropsMust be enabled by you
Windows group policyStops parallel multi-homed queriesNot in Windows Home editions
DoH / DoTEncrypts DNS queriesDNS provider still sees your queries

Summary: why run a DNS leak test?

DNS leaks silently expose your browsing activity to your ISP, even when your VPN appears to work correctly. Test regularly with a full DNS leak test, use the SpeedIQ DNS check as a quick provider hint, enable DNS leak protection in your VPN client, and consider encrypted DNS (DoH or DoT) as a fallback layer.

Try it free: You can run the SpeedIQ privacy checks directly in your browser, with no account and no ads.

FAQ

What does a DNS leak test do?

It makes your browser look up unique test hostnames and shows which DNS resolvers asked for them. If your ISP's resolver appears while the VPN is on, your DNS leaks.

Is the SpeedIQ DNS check a full DNS leak test?

No. It shows the provider behind your IP address as a quick hint. To see which resolvers answer your lookups, use a full DNS leak test.

Does a VPN prevent DNS leaks?

Only if it routes DNS through the tunnel. Enable DNS leak protection and the kill switch in your VPN app, then confirm with a DNS leak test.

Can my ISP see my browsing if my DNS leaks?

Yes. A DNS leak sends your queries to your ISP's servers, so your ISP sees which domains you visit, even with HTTPS.

Does encrypted DNS stop DNS leaks?

DoH and DoT stop your ISP from reading your DNS queries, but the DNS provider you use still sees them. They work best as an extra layer next to a VPN with leak protection.

Sources