DNS privacy guide · sources checked 2026-11-03
DNS leak tests: read the resolver result and its limits
Follow a cautious VPN-off/VPN-on DNS leak test checklist, compare the browser resolver with documented expectations, and understand what the result cannot prove.
Short answer: what does a DNS leak test show?
A DNS leak test shows which recursive DNS resolver or resolvers handled the test's own DNS lookups, as observed by that test service at that moment. If a VPN is on, compare the observed resolver with the VPN's documented DNS behavior. A result can suggest that these browser lookups used a resolver you did not expect; it cannot prove that every app's DNS requests use the same path.
What is a DNS resolver?
When software needs an IP address for a domain name, it asks a configured resolver to look it up. A recursive resolver may answer from cache or contact other DNS servers to find an answer. The resolver handling a query can therefore receive the requested name and connection metadata. ICANN defines a DNS query as a request for DNS information; IETF RFC 9076 describes privacy risks of DNS queries and supersedes RFC 7626.
Why might a test list more than one resolver?
A test may trigger multiple lookups, and a device or network can have more than one DNS path or resolver. Results can also be affected by caching, browser behavior, operating-system settings, VPN routing, split tunneling, and network configuration. The test site's method determines what it can observe; check its explanation before treating a list as a complete inventory.
Does seeing my ISP or a local resolver prove a leak?
It is a clue to investigate, not a diagnosis by itself. If the VPN documentation says covered DNS should go to a VPN resolver, but the test consistently reports a resolver associated with your ISP or local network while the VPN is connected, check whether that browser is excluded from the tunnel, whether the VPN is connected, and how the operating system or browser handles encrypted DNS. A resolver's displayed organization or location is an attribution by the test and does not alone establish where every query traveled or who retains it.
Does encrypted DNS hide queries from the resolver?
No. DNS over HTTPS (DoH) encrypts the DNS exchange between the client and its configured DoH server, protecting it from observers along that transport path. The chosen resolver still receives and processes the query. Encrypted DNS changes who can observe the request in transit; it does not make the resolver blind or determine the resolver's logging practices. IETF RFC 8484 describes DoH as DNS queries carried over HTTPS and discusses privacy considerations.
Can a browser test check every device app?
No. A browser-based test observes requests generated for that browser and test page, not every app, background service, profile, or future connection. Some browsers can use their own DNS-over-HTTPS setting; apps can use separate networking behavior; and split-tunnel rules can route apps differently. A successful result is a point-in-time sample, not proof of continuous or device-wide coverage.
VPN/DNS leak self-checklist: how do I compare results?
This page does not run a DNS test. Use this checklist with a third-party browser test: (1) Before testing, check your VPN's documentation for its expected DNS behavior and note browser Secure DNS, device DNS, and any app-routing exceptions. (2) Choose a test service, read its method and privacy policy, and avoid entering account details or sensitive searches. DNSLeakTest.com is one example; its published method says its Standard test makes 6 DNS queries and its Extended test makes 36, and its privacy page describes its Matomo analytics cookie and IP-address handling. (3) On the same device, browser, and network, run the test once with the VPN disconnected and record the time and resolver names. (4) Connect the VPN, confirm the app says connected, then run the same test in the same browser and record the same details. (5) Compare the observed resolver with the VPN's documented expectation; a resolver name or location alone does not prove who operated it or whether traffic leaked. (6) If results differ unexpectedly, reconnect and repeat once under the same conditions, then review browser Secure DNS, device DNS, and per-app routing settings. Change one setting at a time and keep a note of how to restore it. Stop and contact your administrator before changing settings on a managed device. A browser test samples its own lookups at that time; it cannot audit every app or prove continuous protection.
What should I conclude if the result changes with the VPN?
The test service observed a different resolver for its browser lookups under those conditions. That is useful evidence about that test path, but it does not establish the provider's full privacy practices, the route of other apps, whether queries were logged, or whether all traffic is protected. For a separate public-IP check and a step-by-step VPN comparison, see the IP and DNS explainer. HTTPS protects web content in transit between a browser and a site, but does not make a DNS test comprehensive; see EFF's HTTPS explainer for that boundary.
Sources
- ICANN: Domain Name System query definition (accessed 2026-11-03)
- IETF RFC 9076: DNS Privacy Considerations (2021-07; accessed 2026-11-03; supersedes RFC 7626)
- IETF RFC 8484: DNS Queries over HTTPS (2018-10)
- DNS Leak Test: Standard and Extended test method (accessed 2026-11-03)
- DNS Leak Test: privacy policy (accessed 2026-11-03)
- Electronic Frontier Foundation: How HTTPS and Tor Work Together (accessed 2026-11-03)