DNS Leak Test — Understanding & Checking Resolver Leaks
A DNS leak happens when your lookups escape your VPN or encrypted DNS and reach your ISP’s resolver instead. Learn how leaks happen, how to test for them properly, and how to fix them.
Why we don’t run a simulated leak test
A genuine leak test needs dedicated authoritative nameservers. Your browser looks up a unique, random hostname such as t-9281.leak.fastestdns.online, and the nameserver records which recursive resolvers ask about it. Browser “pings” or JavaScript timers cannot see this, so any tool that claims to detect leaks without that infrastructure is guessing. We don’t run that infrastructure, so use this guide together with an established leak-test service such as dnsleaktest.com or browserleaks.com/dns.
What a DNS leak exposes
Even with encrypted HTTPS data tunnels, unencrypted or leaked DNS queries reveal your private activity.
Complete Browsing History
Every site domain, subdomain, messaging backend, and app endpoint you open is resolved and logged in plain text by the responding resolver.
Physical & ISP Location
Your ISP’s default recursive servers reveal your real geographic region and identity provider, regardless of which VPN country exit point you chose.
Spoofing & Interception
Unencrypted port 53 traffic can be intercepted, censored, or redirected to phishing portals and advertising landers by untrusted local networks.
Step-by-step VPN leak testing
Comparing a baseline against a connected run is the only way to be sure your VPN is handling DNS.
-
1
Test your baseline (VPN disconnected)
Run an extended test on a leak-test service (linked above) and note the ISP name and resolver IPs it reports. With no VPN, seeing your ISP here is expected.
Take a screenshot or record the IP blocks shown for comparison.
-
2
Connect your VPN
Wait for the tunnel to establish completely, then flush your operating system DNS cache.
Flushing ensures your browser does not reuse pre-VPN cached resolution records.
-
3
Run the test again
Every resolver listed must belong to your VPN provider or chosen privacy DNS.
If your home ISP or local country appears in the list, queries are leaking outside the encrypted tunnel.
Fix leaks on your system
Two changes stop most leaks: turn off Windows’ parallel DNS queries, and force encrypted DNS in your browser.
Disable Smart Multi-Homed Name Resolution
Windows can send DNS queries to every network adapter at once and use the fastest reply — including your ISP’s resolver outside the VPN. Turn it off with an elevated Command Prompt:
> reg add "HKLM\Software\Policies\Microsoft\Windows NT\DNSClient" /v DisableSmartNameResolution /t REG_DWORD /d 1 /f
Or via Group Policy: Computer Configuration → Administrative Templates → Network → DNS Client → Turn off smart multi-homed name resolution.
Enforce DNS-over-HTTPS in your browser
-
Chrome / Brave / Edge
Settings → Privacy and security → Security → Use secure DNS
Select "With: Custom" and paste a verified DoH endpoint from our directory.
-
Firefox
Settings → Privacy & Security → DNS over HTTPS
Set to "Max Protection" to strictly route all browser host queries over encrypted HTTPS.
Not sure which resolver you’re using?
Check your device’s configured DNS before and after connecting your VPN.