DNS leak test
This test shows which DNS resolvers your lookups really go to and compares them with the network your traffic uses. If you're on a VPN and they belong to your internet provider, your VPN is leaking DNS.
Your result
Looking up four one-time names and watching which resolvers ask for them. This takes about five seconds.
How the test works
Every time you open a site, your device asks a DNS resolver for the site's address. Whoever runs that resolver sees each name you look up, and a VPN only hides your browsing if those lookups travel through it too.
The test makes your browser look up four random one-time names under dl.iplogs.com. Our own nameserver answers for that zone, so it sees which resolvers ask for the names, and some resolvers also pass on part of your address (EDNS client subnet). The page then compares those networks with the one your traffic uses.
Your browser can leak your address another way too: the WebRTC leak test checks that, and the VPN check on the homepage shows how sites see your connection.
How to fix a DNS leak
- Your VPN app: Turn on its DNS leak protection or "use VPN DNS" setting, then run the test again.
- Secure DNS in the browser: Chrome and Edge (Use secure DNS, under Privacy and security) and Firefox (DNS over HTTPS) can send lookups to their own provider whatever your VPN does. Switch it off to use the VPN's DNS, or choose a provider you trust.
- IPv6: A VPN that only carries IPv4 can let IPv6 lookups go out directly. Turn on the app's IPv6 leak protection, or turn off IPv6 while connected.
- Windows: Smart multi-homed name resolution sends lookups to every network adapter's DNS server at once. The Group Policy setting "Turn off smart multi-homed name resolution" (Network, DNS Client) stops it.
Questions
What is a DNS leak?
A DNS leak is when the lookups for the sites you visit go to a resolver outside your VPN, usually your internet provider's. The traffic itself is encrypted, but the provider still sees every site name you look up.
Is it a leak if my DNS goes to Google or Cloudflare?
Not to your internet provider: a public resolver such as Google Public DNS or Cloudflare's 1.1.1.1 sees the names instead. Whether that's acceptable depends on whom you trust; many VPN apps run their own resolvers so no third party sees them.
What does subnet passed on mean?
Some resolvers add the first part of your address to their queries (EDNS client subnet) so websites can pick a nearby server. If that subnet belongs to a different network from your connection, it usually reveals your real network even though your traffic goes through a VPN.
Does iplogs.com keep my DNS lookups?
Our nameserver keeps which resolver asked for each random test name for two minutes, so this page can show it to you, and then forgets it. The names identify nothing but the test, and resolver addresses are not logged.