IPconf
← Tools

DNS Leak Test

Check which DNS resolvers handle your requests and detect potential leaks.

Resolves a randomized unique hostname under our domain and inspects which DNS server actually reached our authoritative server. The IP and rDNS of that resolver reveal whether your DNS queries are going through a VPN, your local ISP, a public resolver (1.1.1.1, 8.8.8.8), or a corporate proxy. The classic "DNS leak" is when you think you're on a VPN but your DNS still goes through your ISP — this test catches it.

How to read the result

  • Resolver IP — the address that contacted our DNS. This is the resolver your queries actually went through.
  • Resolver hostname (rDNS) — the reverse-DNS name of that IP, often the giveaway: *.cloudflare.com = 1.1.1.1, *.google.com = 8.8.8.8, *.example-isp.net = your local ISP.
  • Multiple resolvers shown? Some systems use anycast or load balancing, so a single query may bounce between a few. That's normal as long as they all belong to your expected provider.

When the result is "leaking"

  • You're connected to a VPN, but the resolver is your real ISP (or its IP geolocation matches your real country).
  • You're using DoH/DoT in the browser but a desktop app bypassed it and used the OS resolver.
  • A captive-portal style proxy intercepted DNS at the network edge.

How to fix a leak

  • Use a VPN with DNS-over-VPN enabled — all DNS goes through the encrypted tunnel.
  • Configure DNS-over-HTTPS or DNS-over-TLS in your OS or browser, pointing at a resolver you trust.
  • Disable IPv6 if your VPN only routes IPv4 — IPv6 DNS queries are a common leak path. Better: pick a VPN that handles both.
  • Set a kill switch so the network is blocked when the VPN drops.
  • Full walkthrough: How to check if your VPN is leaking (on the MyIPInfo site).