DNS leak test

How this test works

A name lookup is the first thing your browser does when you type an address: it asks a resolver to turn the name into an IP. The resolver is chosen by your operating system, your VPN client, your router or your browser, and it is not always the one you think. The only way to find out for certain is to make your browser look up names that nobody else has ever looked up, and watch which resolvers come asking for them. That is exactly what this page does.

1. When you start the test, the page requests a token from our server. The token is a random string that identifies this one test run.
2. The server builds 6 unique hostnames from it, in the form token-1 through token-6 under dl.ipcheckerpro.com. Nobody has ever resolved these names, so no cache anywhere can answer them; every lookup has to travel all the way to the name server that is authoritative for that zone.
3. Your browser requests each of the 6 names. The requests themselves are allowed to fail; what matters is that your resolver has to find the addresses first.
4. The authoritative name server for dl.ipcheckerpro.com runs on our dedicated probe server. It answers every query and records the address of the resolver that asked, together with the token.
5. The page polls our server for the result, our server asks the probe for the resolver list, and we enrich each resolver address with its network, its country and whether that network is the same autonomous system as your connection's.

The result table has one row per resolver, with four columns: the resolver's IP address, the network it belongs to, the country it is located in, and whether it matches your ISP, meaning the resolver is announced by the same network as your own public address. The status next to the heading summarizes the run: pass when every resolver is in the same country as your IP, and a warning when at least one is somewhere else, which is the condition the anonymity score also deducts for.

Six names are used rather than one because resolvers are clusters. A single lookup might show you one address out of several, and a leak that only affects some queries, as happens with parallel resolution on some systems, would be missed. Six independent names give each resolver in the chain a chance to appear. Tests are limited to 10 per minute per visitor, and the tokens are discarded after 24 hours.

How to read your result

What you want to see depends on what you are using.

The ISP-match column answers a different question from the country column. ISP match yes means the resolver is run by the same network as your public IP. On a home connection that is the normal, boring case. On a VPN it is a problem only if the "ISP" shown at the top of the page is your home ISP, which would mean the VPN is not carrying your web traffic either; if the top of the page shows the VPN's network and the resolver matches it, the VPN is handling DNS and all is well.

The country column drives the score. In the anonymity score, a resolver outside your IP's country costs 15 points, because it is one of the simplest checks a site can run against a visitor: the site owns its name servers and sees which resolver asks for its names, exactly as we do.

Several resolvers in the table

Two or three addresses from one network are the same service answering from different cluster members. Rows from two different networks mean your system is sending queries to more than one resolver, which is where leaks hide. The usual cause on Windows is parallel resolution across all adapters; on phones it is a private DNS setting alongside the VPN; in browsers it is an encrypted-DNS setting that bypasses the system resolver for some queries and not others.

No resolver observed

If the status says the test did not complete, no query for the 6 names reached our name server. Either the browser never issued them, because a content blocker stopped the requests, or your resolver refused to resolve unknown subdomains, which some filtering resolvers and corporate proxies do. Run the test again, try a private window with extensions off, and if it still does not complete, the IP leak test can at least confirm the other channels.

How to fix it

Steps are grouped by what you use. After each change, reload this page and run the test again; the result is live and nothing is cached from the previous run.

VPN clients

1. Open the client's settings and enable the option that routes DNS through the tunnel, usually called DNS leak protection, use VPN DNS, or block outside DNS. Most clients have it off by default on at least one platform.
2. If the client has a kill switch or firewall mode, enable it; it blocks lookups that try to leave outside the tunnel when the connection drops.
3. Disconnect and reconnect so the client reapplies its DNS configuration, then run the test.

Windows

1. Open Settings, then Network and internet, then the adapter you use, then Edit under DNS server assignment. Set it to the resolver your VPN provider gives you, or to a resolver in your exit's country if you use a proxy; leave it on automatic only if the VPN client manages DNS itself.
2. Windows resolves names on every adapter in parallel, so a physical adapter with your ISP's resolver can answer while the VPN adapter is up. Setting the physical adapter's DNS to the same resolver as the tunnel removes that path.
3. Flush the cache in a terminal with ipconfig /flushdns, then run the test.

macOS

1. Open System Settings, then Network, select the active service, then Details, then DNS. Add the resolver you want first and remove the ISP's addresses.
2. If a VPN app manages DNS, leave its entry in place and check that no other resolver is listed above it.
3. Run the test; macOS applies the change immediately.

iOS and Android

1. iOS: a VPN app that provides DNS normally takes over. If you set a DNS profile or an encrypted-DNS app separately, remove it while the VPN is on, as it can override the tunnel's resolver.
2. Android: open Settings, then Network and internet, then Private DNS. Set it to off or automatic while using a VPN, unless the VPN provider tells you to point it at their hostname. A hostname set here is used for every network, including the tunnel, and places a resolver from that service in your results.
3. Toggle airplane mode on and off to clear cached lookups, then run the test.

Proxies

1. For a SOCKS5 proxy in Firefox, open about:config and set network.proxy.socks_remote_dns to true, so names are resolved by the proxy and not by your system. Chrome resolves through a SOCKS5 proxy automatically when the proxy is set at the system level or via an extension that supports it; a plain HTTP proxy resolves on the proxy side by design.
2. For a system-wide proxy, remember that applications outside the browser still use the system resolver; only the browser's own lookups go through the proxy.
3. Run the test from the proxied browser; the resolver should now be near the proxy, not near you.

Antidetect browsers

1. Enable the profile option that resolves DNS through the proxy, which most products turn on by default for SOCKS5 and HTTP proxies.
2. Check the profile's own DNS field; a resolver typed there overrides the proxy setting and is the usual cause of a resolver from the wrong country.
3. Rerun the test inside the profile after every proxy change.

Browser encrypted DNS

1. In Chrome, Edge and Brave, open Settings, then Privacy and security, then Security, and look at Use secure DNS. In Firefox, open Settings, then Privacy and Security, then DNS over HTTPS. With a VPN, set it to use your current provider, or off, so the tunnel's resolver is used. With a proxy, either turn it off or point it at a resolver in the proxy's country.
2. Reload and run the test; browser DNS settings apply without a restart.

Routers

1. If the router runs the VPN, set the router's DNS servers to the provider's resolver in its WAN settings and make sure DHCP hands the router's address, not the ISP's resolvers, to devices on the LAN.
2. Devices with their own DNS settings override the router, so check phones and laptops individually with this test.

Limits of this test

• The test observes resolvers, not settings. It tells you which resolvers reached our name server for these 6 names. It cannot see a resolver that was configured but never asked, nor say why a resolver was chosen; that is for you to work out from the fix list above.
• Only the browser's lookups are tested. Mail clients, games, system updates and other applications may use different resolvers than the browser, especially when a proxy is involved. The test covers what the browser does.
• Country and network of a resolver come from the same data as everything else on this site: the DB-IP Lite database, refreshed monthly, and the public routing table. Large resolver services use anycast, so the country shown is where that address block is registered, which may differ from the physical location of the node that answered you.
• A pass means the resolver countries match the IP country. It does not mean your lookups are encrypted, and it does not mean the resolver operator cannot see them; it means a website would not see a mismatch.
• Some resolvers are invisible. A forwarding resolver on your router or VPN client passes queries to an upstream resolver, and the upstream is what we see. The row shows the resolver that touched the internet, which is the one a website sees too.
• Timing. The test waits a few seconds for queries to arrive. A very slow resolver may show up in a second run rather than the first.

What a DNS leak looks like to a website

Websites that care about where their visitors are from run their own authoritative name servers, or use a service that does. When your browser loads such a site, the site's name server logs the resolver that asked, and the site compares that resolver's network and country with the IP that then connects to the web server. A visitor whose connection arrives from a VPN exit in one country while the lookup came from an ISP resolver in another has, in that one comparison, revealed both the real country and the fact that a tunnel is in use. It costs the site nothing and requires no script in your browser, which is why it is one of the first checks a strict service applies and why the dns leak is scored separately from everything else here.

What is my DNS server, and does it matter which one?

Your DNS server is whichever resolver answered the 6 test names; the table shows it. For privacy, it matters because the resolver sees the name of every site you visit, and so does anyone who can watch the path between you and the resolver if the lookups are not encrypted. For consistency, it matters because sites compare the resolver's location with your IP's. For speed, a resolver near you answers faster, which is the one argument for using the ISP's own. People using a VPN or proxy should let the tunnel decide; people on a plain connection who want privacy from the ISP can pick an encrypted resolver, accepting that its location will then show in tests like this one.

Why the test uses unique hostnames

Resolvers cache answers, and most names you look up are already in a cache somewhere between you and the authoritative server. A test that used ordinary names would be answered from cache and the authoritative server would never see your resolver. Random, single-use names defeat every cache, so each query necessarily reaches the name server that can record who asked. It is the same technique that large sites use to measure their own visitors' resolvers, applied here on your behalf and shown to you rather than kept in a log you never see.