DNS leak

What a DNS leak is

Before your browser can connect to a website, it has to turn the name into an address. That question goes to a DNS resolver, usually one operated by your internet provider. When you use a VPN or a proxy, you expect that question to travel inside the tunnel so the website operator, and anyone watching, sees only the VPN's resolver. A DNS leak is the situation where the query goes out the normal way instead: your ISP's resolver answers it, and the resolver's address is visible to the authoritative name server of every site you visit.

The website still sees your proxied IP for the page request itself. What leaks is the resolver, and a resolver in a different country than your apparent IP is an obvious contradiction.

Why it happens

• The VPN or proxy does not handle DNS at all. Many HTTP and SOCKS proxies only forward connections, and the browser resolves names locally unless told otherwise.
• The operating system keeps using the resolver it learned from DHCP, even though a tunnel is up.
• Smart multi-homed DNS on Windows sends the same query out of every interface and uses the fastest answer.
• The browser has its own DNS-over-HTTPS setting that bypasses the system entirely.
• IPv6 DNS traffic is not tunneled while IPv4 is.

Why it matters

Fraud systems compare the country of your IP with the country of your resolver. A mismatch is one of the clearest signs of a tunnel, which is why our anonymity score deducts 15 points for it. For privacy users the problem is worse: your ISP sees every domain you visit even though the connections themselves are encrypted.

How to check

The DNS leak test makes your browser request a set of unique hostnames that only our own name server can answer. Whichever resolvers ask our server for those names are, by definition, the resolvers your device is really using. The result lists each resolver's address, network, and country, and tells you whether it belongs to the same provider as your IP. The combined IP leak test runs this alongside the WebRTC and IPv6 checks.

How to fix it

Point the system or browser resolver at the VPN provider's DNS or at a public resolver reached through the tunnel, turn off smart multi-homed resolution on Windows, disable IPv6 if the tunnel does not carry it, and in antidetect browsers set the proxy to resolve names remotely (for SOCKS5, this is often called "proxy DNS" or "remote DNS"). Then run the test again.