> For the complete documentation index, see [llms.txt](https://docs.ipcheck.ing/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ipcheck.ing/knowledge-base/connection-tools/dns-leak-test.md). # DNS Leak Test ## What it does Every time you open a website, your device first asks a DNS resolver to turn the name into an address. If you use a VPN or proxy, those questions should travel through the tunnel too. When they do not — when your provider's resolver still answers them — that is a **DNS leak**. Your provider then knows every site you visit, even though your traffic is encrypted. The **DNS Leak Test** finds out who is actually answering. See [How DNS Works](/knowledge-base/concepts/how-dns-works.md) for background. Here is the trick it uses. MyIP builds a brand-new, one-time-only domain name and asks your browser to load it. Because the name has never existed before, no cache anywhere in the world has an answer, so the question must travel all the way up to a server that MyIP's test partners control. That server writes down which resolver came knocking — and that resolver's address is what you see on the cards. MyIP runs this against four independent partners, so you get four separate views: **ip-api.com**, **surfsharkdns.com**, **ipleak.net**, and **browserleaks.net**. ## How to run it The test runs automatically on page load. Click the refresh button in the section header (**Refresh DNS Leak Test**) to run it again. Each card retries a few times on its own before giving up. ## Reading your results Each card shows one **DNS Endpoint Test** result: * The large value is the **resolver's exit address** — the address the resolver used when it reached the test server. * **ISP** — who owns that address. * **Endpoint Region** — the country that address maps to. | What you see | What it means | | ------------------------------ | ------------------------------------------------------------------------------ | | `Awaiting Test` | Still running | | `Test Error` | The probe failed after several attempts, or the address could not be looked up | | An address plus ISP and region | A resolver was identified | ### Whose resolver is it? Compare the **ISP** and **Endpoint Region** on each card against what you expect. | Result | Reading | | ----------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | | Your home provider's name, in your own country, while a VPN is on | **Leak.** Your DNS questions are bypassing the tunnel | | Your VPN provider's name, or the country of your VPN exit | Healthy. DNS is going through the tunnel | | A public resolver such as Cloudflare, Google or Quad9 | Your device or router is set to use that resolver. Fine on its own, but note it sees your browsing, and it may reveal your general region | | Different cards showing different operators | Normal. Large resolvers use many exit servers, and your device may have more than one resolver configured | | Your home provider's name, no VPN in use | Expected. This is the default setup for most people | {% hint style="info" %} The endpoint region is the region of the resolver's **exit server**, not of you. A resolver in a neighbouring country is not by itself proof of a leak — what matters is whether the operator is the one you expect. {% endhint %} ## Fixing a leak {% stepper %} {% step %} ### Turn on your VPN's DNS protection Most VPN clients have a "DNS leak protection", "use VPN DNS", or "block outside DNS" setting. Enable it and re-run the test. {% endstep %} {% step %} ### Set a resolver manually If your VPN does not manage DNS, set a resolver yourself in your operating system's network settings, or in your browser's secure DNS setting. Then re-run the test to confirm the change took effect. {% endstep %} {% step %} ### Check your router A router that hands out its own resolver can override your device's settings. If the leak survives every change on your computer, the router is the likely cause. {% endstep %} {% endstepper %} ## The In-depth DNS Leak Test Once the homepage test has run, a banner appears: **Want to dig deeper?** with an **Open the in-depth test** button. It opens the **In-depth DNS Leak Test** from Advanced Tools. {% hint style="warning" %} **Available on IPCheck.ing only** — this feature is not included in self-hosted deployments. It also requires you to sign in. {% endhint %} The homepage test captures a few resolvers. This one fires a series of probes and lets IPCheck.ing's own authoritative name server record every recursive resolver that shows up — a typical run captures 20 to 40 records. Click **Run test** and wait a few seconds. **Summary row** * **Unique resolvers** — how many distinct resolvers were captured. * **Raw captures** — how many queries arrived in total. * **DNSSEC posture** — a one-line verdict, from *DNSSEC-aware* down to *Suspicious*. **Result table** | Column | What it tells you | | ------------------ | ----------------------------------------------------------------------------------------- | | Resolver IP | The exit address of a resolver that queried on your behalf | | Location | Where that address maps to | | Org / ASN | Who operates it — the key column for spotting a leak | | Record type | What was asked for (A, AAAA, HTTPS…) | | Transport protocol | UDP or TCP | | ECS | Whether the resolver forwarded a slice of your real address upstream | | DO / CD | Two DNSSEC signals: whether signatures were requested, and whether validation was skipped | The **ECS** column is the one to watch for privacy. If it is filled in, part of your real address is being passed along the DNS chain — useful for routing you to a nearby server, but it chips away at your anonymity. A **Hide duplicates** toggle collapses repeated rows, and a **Field reference** section at the bottom of the page explains every column in more detail. {% hint style="info" %} If the test returns nothing, your browser's DNS cache probably absorbed the probes. Wait a moment and run it again. {% endhint %} ## What to do next * Read [Is My DNS Hijacked or Polluted?](/knowledge-base/diagnose/is-my-dns-hijacked.md) if answers look wrong rather than just leaked. * Use the [DNS Resolver](/knowledge-base/lookup-privacy/dns-resolver.md) tool to compare what different resolvers answer for the same domain. * Check the other common leak with the [WebRTC Test](/knowledge-base/connection-tools/webrtc-test.md). * Confirm the whole setup with [Is My VPN or Proxy Working?](/knowledge-base/diagnose/is-my-vpn-working.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.ipcheck.ing/knowledge-base/connection-tools/dns-leak-test.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.